Wire Fraud at Closing: The Attack on Claremont Escrows

Every other risk in this cluster is about the record. This one is about the money, and it is the only closing risk that can take everything in a single afternoon with no defect on title at all.

Closing wire fraud is a social engineering attack. Nobody breaks into a bank. Somebody reads email, waits for the right moment, and sends a very convincing message telling you where to send your funds.

How the attack actually runs

It begins with ACCESS, usually to an email account. Not necessarily yours. The compromised account might belong to an agent, an escrow assistant, a lender's processor, or a transaction coordinator. Real estate transactions involve many parties emailing each other constantly, and the attacker only needs one.

Then comes OBSERVATION, and this is the part people underestimate. The intruder reads quietly. They learn the parties' names, the property address, the escrow number, the closing date, the tone people write in, and who normally sends the funding instructions. Sometimes for weeks.

Then TIMING. The message arrives when funds are expected, referencing your actual transaction with correct details, signed the way that person signs, sometimes with a lookalike domain that differs by one character, sometimes from the genuine compromised account itself. It says the wiring instructions have changed, or that there is a new account for this closing, or that the bank made an update.

Then the wire goes, and within hours it is moved through intermediary accounts and out. Recovery is possible in some cases if the reporting is immediate, and it becomes rapidly less likely as time passes.

Why this transaction is the target

Because it combines a large single transfer, a hard deadline, many parties, an unfamiliar process, and a buyer who is emotionally invested and does not want to be the reason the closing slips. Every one of those works in the attacker's favor.

Sellers are targeted too. Net proceeds go out by wire as well, and instructions purportedly from a seller redirecting the payoff are a known variation.

The one habit that defeats it

CALL AND VERIFY, using a phone number you obtained independently, before every transfer.

Independently is the load-bearing word. Not the number in the email. Not the number in the signature block. Not a number on a website you reached by clicking a link in the message. Use the number on your signed escrow instructions, or one you looked up yourself, or one you were given in person.

On the call, read the account and routing numbers aloud and have them confirmed digit by digit. Do it for the first wire. Do it again for any instruction that CHANGES anything, because legitimate changes are rare and change requests are the attack's signature.

Treat any of these as an attack until proven otherwise: last-minute instruction changes, urgency, a request for secrecy, a slightly different sending address, a request to switch to text or a different email, or an instruction to a bank in a state unrelated to the transaction.

Supporting practices

Use multi-factor authentication on the email account you use for the transaction, and encourage the same of everyone in it. Prefer a secure portal over email for documents where your escrow provides one. Never send a photograph of a check, an account number, or a routing number by email.

Ask your escrow officer at the start how they transmit wiring instructions and what their verification protocol is. A good answer is specific. Reputable Claremont escrow providers will also tell you plainly that they do not change instructions by email, and that statement is worth having in writing at the outset so a later message contradicting it is obviously false.

Consider whether you need to wire at all for smaller amounts, since a cashier's check can be an alternative for some items. And confirm the receipt by phone after sending, rather than assuming silence means success.

If it happens

Speed is the entire strategy. Call your bank immediately and ask for a recall or a SWIFT indemnity request. Call the receiving bank. Report to the FBI's Internet Crime Complaint Center, which operates a process specifically aimed at freezing fraudulent domestic wires quickly. Notify your escrow officer, your agent, and your lender. File a police report.

Then get a lawyer. Questions about who bears the loss between the parties, and whether any professional's conduct contributed, are legal questions with real stakes, and they should not be settled in a phone call at the moment of panic.

What it means for the closing itself

Worth being clear about a boundary: this is not a title defect and a title policy is not designed to answer it. Your policy insures the state of title, as described in the title insurance guide. Money diverted before it reaches escrow is a different category of loss entirely.

Practically, a diverted wire usually means the closing does not fund. The purchase agreement's deadlines keep running, the seller may have remedies, and a rate lock may expire. That is why prevention is the whole discussion.

The verification step belongs in the same review as your closing figures, both of which happen in the same few days; the reading method is in the settlement statement guide. And the signing appointment where you will be handed instructions sits inside the sequence described in the closing overview.

One sentence to carry into your closing week: nobody legitimate will ever be inconvenienced by you calling a known number to confirm before you send money.

For the full sequence from escrow opening to recording, see the title and closing guide. Anthony Grynchal has been licensed in California since November 2009.