Picture the inbox of somebody three days from closing on a house: a title company, an agent, a lender, an attorney, and an inspector, all sending documents that require action within hours. Into that stream arrives a message about the wire, from an address that looks right, referring to details only somebody involved would know, correcting the account information because of a last minute change at the bank. It is the most costly fraud an ordinary household is likely to encounter, and it works precisely because everything about it is unremarkable.
How It Actually Works
The intrusion happens weeks earlier and somewhere else. A real estate agent, a small title office, or an attorney's assistant has an email account compromised through a reused password or a convincing login page, and the intruder does nothing visible. They read. They learn the closing date, the amount, the names of everybody involved, and the ordinary tone of the correspondence, and then they wait until the moment when a change to payment instructions would be plausible. Weeks of patience is what distinguishes this from ordinary spam, and it is why the message reads as though somebody involved wrote it.
The message itself is often sent from the genuine compromised account, which is why looking for a misspelled domain frequently fails. Where a lookalike address is used, the difference is a single transposed character that nobody notices on a phone. Some versions set up rules that hide replies from the real party, so the buyer and the title company each believe they are corresponding with the other while an intermediary sits between them.
Why Closing Day Specifically
Three conditions converge and the fraud depends on all of them. The amount is large and, unusually for a household, moving by wire rather than by card or check, which matters enormously because a completed wire is close to irreversible while a card charge can be disputed for months. The transaction has a hard deadline, so nobody wants to introduce delay by asking a question. And the buyer has never done this before, so has no sense of what is normal. First time buyers are targeted for precisely that reason, and repeat buyers are targeted less often because they tend to ask.
That combination is what makes the request to disregard earlier instructions land so easily. In any other context a sudden change of bank details would prompt a phone call. On closing day, with a moving truck booked and a seller waiting, it prompts compliance, and the message is written by somebody who has read six weeks of correspondence and knows precisely which sentence will produce it, in the tone the sender has been using all along.
The Rule That Defeats It
One habit stops essentially all of it. Never take wiring instructions from an email, ever, under any circumstances, and never call a number contained in that email. Instead, telephone the title company or attorney on a number obtained independently, from the signed engagement paperwork or the company's published listing, and read the account details back to them digit by digit before sending anything. This takes four minutes and it is the entire defense. There is no second measure that adds much to it.
The second half of the rule is that instructions never change. Legitimate closings do not revise wire details at the last moment, and any message doing so should be treated as fraudulent until a verified phone call proves otherwise. Saying this out loud to the title company at the start, and asking them to confirm they will never send changed instructions by email, sets the expectation on both sides and makes an eventual fake message obvious rather than plausible. Most title companies now say this unprompted.
The Same Thing Aimed at a Business
Small companies see the same fraud in a different costume. A message from a known supplier announcing new banking details, an invoice arriving slightly early with an altered account number, or a request from the owner's own address asking somebody in the office to send a payment quickly and quietly. The mechanism is identical and so is the defense: verify any change of payment details by telephone, on a number already on file, before anything moves. The number on the new invoice does not count, since whoever changed the account details also changed that.
The organizational version of the rule is a written policy that everybody knows, because the fraud targets the person who is new, junior, or eager to be helpful. A rule stating that account changes require a callback to a known number, and that nobody will ever be criticized for making that call, removes the social pressure the fraud depends on. Most successful versions of this succeed because somebody did not want to seem obstructive. Removing that social cost from the office is more effective than any amount of training about spotting fake addresses.
If a Wire Has Already Gone Out
Speed is the only thing that matters and the window is measured in hours. Call the sending bank immediately and ask for a recall on the specific grounds of fraud, then report it to law enforcement, since there is a federal process for freezing fraudulent wires that works when it is triggered quickly and rarely works after several days. Call the title company on a verified number so they know the closing funds have not arrived and why.
Recovery is genuinely possible and it depends almost entirely on the first few hours, before the money is moved onward through other accounts. What makes the difference is a household that recognized within a morning rather than at the closing table two days later. The inbox three days before closing will always be crowded and urgent, and the one message in it that changes where a large sum of money goes deserves the four minute phone call that every other message does not.