A household closing on a house has been exchanging emails for six weeks with an agent, a lender, and a title company. On the morning of the closing an email arrives from one of those addresses, in the same thread, with the same signature, saying that the wiring instructions have changed and giving new account details.
The money goes out that morning and it does not come back. This is the largest single loss most households will ever be exposed to in one transaction, and the entire scheme depends on a single unremarkable assumption.
How it actually works
Somebody has been reading the email. Usually not yours: more often an account at a small real estate office or a title company, compromised weeks earlier through a reused password or a convincing login page.
Having access, the intruder reads quietly. They learn the names, the transaction, the closing date, the tone people use with each other, and the exact format of the documents. Nothing happens for weeks. Then, at the right moment, a message goes out that is correct in every detail except the account number.
Sometimes the message comes from the real account, in the real thread. Sometimes it comes from an address that differs by one character, which nobody notices on a phone. Either way it does not look like fraud, because it is not a stranger asking for money. It is a familiar person completing a step everybody was expecting.
Why closing day
Because of what the day is like. There is time pressure, several parties, a large sum that is supposed to move, and a buyer who has been told for weeks that delays are costly. A last minute change is annoying rather than suspicious in that context.
It also exploits the fact that wire transfers are designed to be fast and final. Unlike a card payment, there is no dispute mechanism and no chargeback. Once the funds arrive and are moved onward, recovery depends on speed and on the receiving bank, and by the afternoon they are usually gone.
The rule that defeats it
One rule, and it works every time. Never accept wiring instructions from an email, a text, a fax, or a document attachment. Call the title company or the closing attorney on a number you obtained independently, at the beginning of the transaction, and verify the account details verbally.
Independently is the load bearing word. Not the number in the email. Not the number on the letterhead of the document that arrived this morning. The number from the signed agreement, the office's published number, or the one you wrote down at the first meeting.
Make the call even when nothing has changed, and make it again if anything changes. Any legitimate closing agent will expect this and most now ask you to do it. A person who is irritated by the request is telling you something.
The business version
Identical mechanics, different setting. A vendor emails to say their banking details have changed, please update the account for future payments. The email comes from the real vendor's real address, because that mailbox is the one that was compromised.
Businesses lose serious money to this every year, and the defense is the same plus one piece of process: any change to payment details for any vendor requires a phone call to a known contact at a previously known number, made by somebody other than the person who received the request. Write that down as a rule and apply it without exception, including to requests that appear to come from the owner.
The related version targets payroll, where an email purporting to come from an employee asks to change their direct deposit account before the next run. Same rule, same reason.
If a wire has already gone out
Speed is everything and the window is measured in hours. Call your bank immediately and ask them to initiate a recall for fraud. Call the receiving bank as well. Report it to law enforcement the same day, including the federal reporting channel for internet crime, because a fast report is occasionally enough to freeze funds before they move onward.
Then notify everyone in the transaction, because if a mailbox was compromised, other parties are exposed too and may still be able to stop something.
Recovery does happen, and it happens in the cases reported within hours rather than days. That is the only reason to say this plainly: hesitating out of embarrassment is what closes the window.
The habits that make it not work
Two, and they cost nothing. Establish the verification rule at the start of any transaction involving a large transfer, out loud, with everyone, so that a later phone call is expected rather than awkward. And treat any message about money that creates urgency as a reason to slow down, since urgency is not a feature of legitimate processes.
If it does happen anyway, the bank comes first and the Federal Trade Commission comes second, and filing that report matters even when the money is gone, since what is known about these schemes is assembled out of reports like it. Households that make the one phone call are not vulnerable to this at all, which is an unusually clean result for a fraud this expensive.