The short version
- The scam: a criminal watches a transaction through a hacked or spoofed email account, then sends convincing new wiring instructions right before closing.
- The amounts are life-changing. In one 2024 case in the FBI's annual report, homebuyers received a spoofed email from their supposed real estate agents and wired $956,342; the FBI's Recovery Asset Team stopped $955,060 because the victims reported quickly.
- Washington regulators are explicit. The Department of Financial Institutions, which licenses escrow agents, says email communication alone should never be used to confirm wire instructions.
- Everyone in the chain is exposed: escrow agents, brokerages, lenders, attorneys holding closing funds, and the buyers and sellers themselves.
- Errors and omissions is not enough. Brokerages and escrow firms need social engineering, funds transfer fraud, and cyber coverage, coordinated with their professional liability.
How closing wire fraud works
| Step | What the criminal does |
|---|---|
| 1. Get inside | Phishes a broker, escrow officer, lender, or buyer, or registers a look-alike email domain |
| 2. Watch | Reads the transaction emails to learn names, dates, amounts, and the closing schedule |
| 3. Strike at the right moment | Sends "updated" wiring instructions, often a day or two before closing, from the real account or a near-identical address |
| 4. Add urgency | Claims the closing will be delayed or the rate lock lost if funds do not arrive today |
| 5. Move the money | Transfers the funds onward within hours, often overseas |
Who is exposed, and how
| Party | Exposure | Coverage to look at |
|---|---|---|
| Escrow agent | Fake instructions to disburse seller proceeds or payoffs; an employee tricked into wiring funds; a hacked escrow mailbox used to target buyers | Crime with social engineering, cyber, escrow errors and omissions |
| Real estate brokerage | An agent's hacked email sends fake instructions to a buyer; claims the brokerage failed to warn or protect the client | Cyber (including social engineering and liability), errors and omissions, with wording checked for cyber exclusions |
| Lender | Altered payoff or funding instructions | Crime, cyber, financial institution bonds |
| Attorney holding closing funds | Trust account disbursements to a fraudulent account; Washington RPC 1.15A covers funds held incident to a real estate closing | Cyber and crime with social engineering, lawyers' professional liability |
| Buyer | Down payment wired to a criminal | Prevention first; some personal policies offer limited fraud or cyber coverage |
| Seller | Proceeds redirected to a criminal | Prevention first; verify payout instructions in person or by known phone |
Whether a professional is legally responsible for a client's loss depends on the facts, the contracts, and the law. Lawsuits against brokerages and escrow firms often follow, which is why the liability side of coverage matters as much as the first-party fraud side.
What Washington regulators tell escrow agents
Washington's Escrow Agent Registration Act (RCW 18.44) requires escrow agents to be licensed by the Department of Financial Institutions. In its guidance to the escrow industry on protecting against wire fraud, DFI says email communication alone should never be used to confirm wire instructions, and recommends measures such as multifactor authentication and encrypted email.
Washington's real estate brokerage statute (RCW 18.86) does not address cybersecurity directly. That leaves brokerages to set their own procedures, and their insurers to decide what is covered.
Coverage for brokerages and escrow firms
| Coverage | What it does in a closing fraud | What to check |
|---|---|---|
| Social engineering | Pays when your employee is tricked into sending funds | Sublimit vs typical closing amounts; whether client or escrow funds count |
| Funds transfer fraud | Pays when a criminal moves money from your accounts directly | Whether it covers trust or escrow accounts |
| Cyber breach response | Investigation and notification when your email is compromised | Mailboxes full of client documents often trigger breach notice |
| Cyber or privacy liability | Defends claims that your security failure caused a client's loss | Whether it covers a client's financial loss, not just data exposure |
| Errors and omissions | Defends claims of professional negligence | Many forms exclude cyber or fraud-related claims; read the exclusions |
| Crime | Employee theft and many fraudulent transfers | Coordination with cyber so one loss is not denied by both |
See does cyber insurance cover wire fraud and fake invoices? for how these coverage parts differ.
Procedures that stop it
- Tell clients at the start, in writing and by phone, that you will never change wiring instructions by email, and give them a known number to call.
- Verify every instruction by calling a number already on file, never one in the email.
- Require two-person approval for outgoing wires and any change to payee details.
- Use multifactor authentication on every email account, transaction platform, and bank portal, including agents' personal email if used for business.
- Use encrypted email or a secure transaction portal for documents and instructions.
- Watch for look-alike domains and register common misspellings of your own.
- Train agents and escrow staff on the closing-day pattern: urgency, last-minute changes, and new banks.
If a closing wire goes to the wrong account
| Step | Why |
|---|---|
| 1. Call the sending bank's fraud line immediately and request a recall | The first hours decide whether money can be frozen |
| 2. File a complaint at ic3.gov | The FBI's Recovery Asset Team works with banks through the Financial Fraud Kill Chain |
| 3. Notify the escrow agent, lender, and brokerage | Others in the transaction may be targeted next |
| 4. Call your insurer's claims or breach hotline | Fraud and cyber coverage require prompt notice |
| 5. Secure compromised email accounts | Reset passwords, add MFA, remove forwarding rules |
| 6. Preserve every email and record | Investigators, banks, and insurers will need them |
In 2024, the FBI's Recovery Asset Team froze about $561.6 million of the $848.4 million in attempted theft it worked on, a 66% success rate. Speed is the difference.