A wire transfer for a luxury home closing is one of the largest, most predictable, and most exposed money movements a private buyer will ever make. Instructions arrive by email, the amount has been known for days, and everyone at the table is worn down from months of negotiation.
And somewhere in the middle of that thread, a criminal is often reading along. The pattern is now familiar enough that federal agents, title insurers, and wire fraud attorneys see the same script play out week after week: a compromised inbox, a plausible-looking update to routing instructions, and a seven-figure transfer that lands in the wrong account before anyone picks up the phone.
What follows is a look at how these hijacks work, who ends up on the wrong end of a federal investigation, and the handful of verification habits that stop most of them cold.
Why Are Luxury Closings Suddenly the Target?
High-end residential deals combine every ingredient a fraud crew wants: a large, one-time transfer, a compressed timeline, multiple parties emailing PDFs across time zones, and buyers who are used to delegating logistics. According to an FBI advisory, victim reports of business email compromise tied to real estate rose 27% between 2020 and 2022, with reported losses over the same period climbing 72%. Rising property prices are part of the arithmetic. A single successful wire on a trophy property can equal dozens of small scams.
Attackers rarely break the escrow company’s systems. They break the email thread. Once they’re sitting inside a real conversation between a buyer, an agent, and a settlement officer, they know the closing date, the amount, the personalities, and the language everyone uses. When they send the fake wire instructions, the message reads like the rest of the file because, in every way that matters, it is.
How Does a Legitimate Closing Get Hijacked?
The mechanics are consistent across price points, but luxury deals give attackers more room to work. Watch for these patterns:
- Lookalike domains. A single character swap turns a familiar sender into a stranger, such as an ‘m’ rendered as ‘rn’ or a domain that slips from .com to .net.
- Mailbox rules. After a phishing hit, the intruder installs a silent filter that forwards or hides any message containing words like ‘wire,’ ‘escrow,’ or ‘closing,’ so the real settlement agent never sees the buyer’s questions.
- Timed intercepts. The fake instructions land the afternoon before funding, when everyone is tired, the buyer is traveling, and the assistant just wants to check one more box before dinner.
- Second-account revisions. A polite ‘our bank changed intermediaries this week, please use the updated coordinates’ looks routine at closing and is almost never real.
When Does a Bad Wire Become a Federal Investigation?
The moment a wire crosses state lines under false pretenses, prosecutors have jurisdiction under the federal wire fraud statute. On a seven- or eight-figure closing, that jurisdictional hook is the whole case. Anyone whose email account was compromised, whose credentials were reused, or who forwarded the fraudulent instructions can end up as a subject of the investigation rather than a witness to it.
The exposure is not modest. Federal wire fraud under Section 1343 carries up to 20 years in prison, and up to 30 years when the offense affects a financial institution. Buyers and sellers who assume they’re simply the victims sometimes learn, months later, that agents and lenders are pointing the other way. Anyone whose name is on a suspicious email chain should talk to counsel before giving a voluntary statement to investigators or the wiring bank’s fraud unit.
Can the Money Actually Be Recovered?
Sometimes, if the response starts inside hours rather than days. Domestic banks can attempt a recall while the funds are still parked in the receiving account. The FBI’s Recovery Asset Team can push a Financial Fraud Kill Chain request that flags the transfer at correspondent banks before it hops overseas. Once funds land at an international institution and are split, recovery odds fall sharply.
Insurance is uneven. Standard homeowner policies don’t cover a fraudulent wire, and title insurance generally doesn’t either. Cyber coverage at the escrow firm is a coin flip, and the buyer typically discovers which side it landed on the week the money vanishes.
What Should a Buyer or Seller Actually Do Before Funding?
The verification steps are unglamorous and boring, and that’s the point.
- Establish a callback number in person. At the first meeting with your settlement agent, write down a direct phone number and confirm it aloud. Use only that number to verify wire instructions later, per title-industry guidance.
- Assume any change is fake. Legitimate escrow coordinates rarely change mid-transaction. Treat any revised routing or account number as fraudulent until a live human at the verified number confirms it.
- Send a small test wire. Ask your bank to send a nominal amount first and confirm receipt by phone before releasing the balance.
- Move fast if it goes wrong. Call the sending bank, request a wire recall, file at IC3.gov, and notify counsel the same day. Hours matter more than paperwork.
The most dangerous wire instruction isn’t the one that looks suspicious. It’s the one that arrives in the right thread, at the right moment, from an address nobody thinks to question. On a multimillion-dollar closing, a two-minute phone call may be the only thing standing between a routine transfer and a federal fraud case.
