Wire Fraud and Payment Redirection: The Risk Real Estate and Property Management Firms Face Every Closing

A closing agent emails wiring instructions to a buyer two days before settlement. Overnight, a criminal who has been reading that email thread sends a second message with a new account number and a plausible reason for the change. The buyer wires the funds. By the time anyone notices, the money has moved through two or three accounts and the closing is dead.

This is payment redirection, and it hits real estate and property management firms harder than most industries because every transaction ends in a large, irreversible transfer. Brokerages, title-adjacent teams, and property managers who handle security deposits, owner distributions, and vendor payments all sit on the same fault line. The attack rarely breaks into a payment system. It breaks into an email account and waits.

How the Scam Actually Works

The FBI calls this family of crimes business email compromise, or BEC. The mechanics are simple and patient.

1. The attacker gets into a mailbox. A phished Microsoft 365 or Google Workspace password is the usual entry point. Sometimes the attacker never gets in at all and instead registers a lookalike domain, such as one swapped letter in a brokerage name.
2. The attacker watches. Inside the mailbox, they read for days or weeks. They learn who the buyer is, who the agent is, when closing is scheduled, and how the firm phrases its emails.
3. The attacker inserts a change. At the moment money is about to move, a message arrives with new wiring instructions, or a vendor "updates" its bank details. It matches the real thread, the real names, and often the real signature block.
4. The money moves. The recipient follows what looks like a legitimate instruction. Funds are sent to an account the attacker controls and are forwarded quickly.

Nothing in this chain requires malware or technical sophistication at the point of loss. The weak point is a person trusting a message that appears to come from a known sender.

What the FBI Numbers Show

The FBI's Internet Crime Complaint Center (IC3) reported in its 2024 annual report that business email compromise generated 21,442 complaints and about $2.77 billion in reported losses in 2024. The previous year's figure was about $2.95 billion. The report also tracks real estate fraud as its own category, covering investment fraud and rental or timeshare scams, and counted 9,359 real estate complaints in 2024.

Two cautions on reading these numbers. First, IC3 counts only what victims report, so actual losses are higher. Second, the real estate category in the report is not the same thing as wire fraud at closing, which is largely filed under BEC. Read the BEC figure as the best available measure of how large this crime is, and assume real estate transactions are a prime target because of the dollar amounts involved.

The practical conclusion is straightforward. A single successful redirection on a closing can equal the margin on dozens of other transactions, and the firm often faces claims, reputational damage, and a buyer who has lost a down payment.

Why Real Estate and Property Management Are Exposed

Several features of the industry line up in the attacker's favor.

Transactions are time-boxed and high stakes. Closing dates create urgency. A message that says "we changed banks, please wire today" does not feel unusual in the final week.

Many parties, many inboxes. A single deal can involve a buyer, a seller, two agents, a lender, a title company, an attorney, and an inspector. Any one compromised account exposes the whole thread, and the firm controls only some of those inboxes.

Shared and personal email. Independent agents often use personal or loosely managed accounts. Property managers receive vendor invoices from dozens of contractors, any of which can be impersonated.

Money held for others. Property managers hold security deposits and owner funds in trust accounts. A fraudulent payment out of those accounts creates a fiduciary problem on top of a financial one.

Lean back offices. A 40 to 150 person firm often has a small accounting team, a manager who approves payments between showings, and no one whose job is to question a change request.

Where the Controls Break Down

Most firms in this position are not negligent. They have an MSP that keeps email running, antivirus installed, and an annual reminder to be careful with links. The gap is that nobody owns the payment process as a security problem. Three failures show up repeatedly.

Verification depends on the same channel as the request. If a change to wiring instructions arrives by email and the confirmation is a reply to that email, the attacker is confirming with themselves.

Email accounts lack basic protection. Without multi-factor authentication enforced on every mailbox, and without alerts for new inbox rules or forwarding, a compromised account can sit unnoticed. Hidden forwarding rules are a common way attackers keep reading after a password reset.

There is no written rule for changes. When a bank detail change is handled case by case, whoever receives it makes a judgment call under time pressure. That is the situation the attacker designs for.

A Practical Control Set for Payment Redirection

The controls that work are mostly procedural, supported by a small number of technical settings. This is the framework we use when advising firms on this risk as part of fractional IT leadership.

1. Require out-of-band verification for every change. Any new or changed bank detail, wiring instruction, or payee must be confirmed by phone, using a number already on file or taken from an independent source, never from the message itself. Make this a written rule with no exceptions for urgency.
2. Verify wiring instructions at the start of the transaction. Have the party who will wire funds call the receiving office to confirm the instructions before the closing week, and tell clients up front that your firm will never change instructions by email.
3. Enforce multi-factor authentication on every mailbox. Include shared mailboxes, contractor accounts, and anyone with access to client or owner data. Phishing-resistant methods are preferable where available.
4. Alert on mailbox rule changes and external forwarding. Both Microsoft 365 and Google Workspace can notify administrators when someone creates a forwarding rule or an inbox rule that hides messages. Turn these alerts on and make sure someone actually reads them.
5. Protect your domain. Configure SPF, DKIM, and DMARC so that spoofed messages using your exact domain are rejected, and consider registering obvious lookalike domains. Lookalikes still require training, because they pass authentication on their own domains.
6. Split payment duties. The person who receives a change request should not be the person who approves it or the person who releases the payment. Dual approval above a defined threshold costs minutes and prevents most losses.
7. Set a client communication standard. Put a short warning in every transaction email signature and closing package: wiring instructions are never changed by email, and clients should call a known number to confirm.
8. Write and rehearse a response plan. If a fraudulent transfer is discovered, speed matters. The plan should name who calls the sending bank, who contacts the receiving bank, who files a report with IC3, and who notifies the carrier, counsel, and the client.

None of these steps requires new software. They require that someone owns the process and checks that it is followed.

What to Do If a Fraudulent Wire Goes Out

Recovery depends largely on how fast the sending bank is contacted. The sequence is the same every time.

• Call the sending bank immediately and ask it to initiate a recall of the wire and to contact the receiving bank.
• File a complaint with the FBI at ic3.gov as soon as the bank has been notified, including account numbers, amounts, dates, and the fraudulent messages.
• Preserve evidence. Do not delete emails. Export message headers and mailbox audit logs, and keep the original thread.
• Lock down the compromised account. Reset credentials, revoke active sessions, and remove any forwarding or inbox rules the attacker created.
• Notify your cyber insurance carrier and legal counsel. Policies typically set notice deadlines and control requirements, so read yours before an incident, not after.

Firms that handle this well treat the first hour as the entire game. That is only possible when the call tree already exists.

Where Fractional IT Leadership Fits

Your managed service provider keeps email, devices, and networks running. Payment fraud sits between IT and finance, which is why it often belongs to no one. A fractional CIO or CTO closes that gap by reviewing how money moves through the firm, setting the verification and approval rules, confirming that mailbox protections are configured correctly, and making sure the response plan matches what your cyber insurance policy requires. The MSP implements the technical settings, and leadership decides what the standard is and checks that it holds.

For a brokerage or property management company, that review usually takes a few weeks and costs far less than one redirected closing.

Elevaire Managed Security adds email security and wire-fraud training across your team, and helps put payment-verification rules in place.

Frequently Asked Questions

What is wire fraud in real estate?

It is a scam in which a criminal impersonates a party to a transaction and sends false payment instructions, so that funds intended for a closing, deposit, or vendor land in the attacker's account. It usually starts with a compromised or spoofed email account and ends with an irreversible transfer.

How can I tell if wiring instructions are fake?

You often cannot tell from the message alone, because attackers copy real threads and signatures. The reliable test is to call a known number for the sender, not one listed in the email, and confirm the account details verbally before sending any money.

Can stolen wire transfers be recovered?

Sometimes, but the odds fall quickly with time. Contact the sending bank immediately to request a recall, then file a complaint with the FBI's IC3. Recovery is more likely when the funds have not yet been moved out of the receiving account.

Who is liable when a client wires money to a fraudulent account?

That depends on the facts, the contracts, and state law, and it is a question for counsel. Firms that failed to follow reasonable verification practices or to warn clients can face claims even when the criminal is the root cause, which is a strong reason to document your controls.

How does this work alongside our existing MSP or IT team?

Your MSP or internal team handles the technical settings such as multi-factor authentication, mailbox alerts, and email authentication records. Fractional IT leadership sets the payment verification standard, tests whether it is followed, and aligns it with your insurance policy, so the two roles reinforce each other.

How do we get started?

Begin with an inventory of every place your firm sends or approves a payment, and write down who can change bank details in each. Then confirm multi-factor authentication on all mailboxes and adopt the callback rule. Those two steps address the most common failure points within a week.