The Last Email Before Closing

This is not a rare event or a scare story. The FBI, the Treasury Department's Financial Crimes Enforcement Network (FinCEN), the Consumer Financial Protection Bureau and the American Land Title Association all warn buyers, sellers and law firms about fake wiring instructions sent just before closing. The FBI's 2025 Internet Crime Report lists about $275 million in real estate fraud losses. That category is broad and includes rental and timeshare fraud, but the closing scam is a large part of the story the agencies keep telling.

The scam works because it does not need to break anything. It only needs one believable message at the right time.

There are two common ways in:

1. They are inside someone's email. A real estate agent, a title company, a buyer or a law firm gets its email account taken over. The criminal reads along quietly, learns the closing date and the people involved, and waits.
2. They pretend to be you. If your firm's email settings are weak, a criminal can send email that looks like it came from your domain, or register a lookalike address that is one letter off.

Either way, the fake message arrives with real details, at the real moment, from what looks like a real sender. Modern AI writing tools make these emails read naturally, so spotting typos no longer works. Some criminals now follow up with a phone call in a cloned voice.

When the money is gone, everyone looks for the weak link. A buyer who lost a down payment may ask why your office did not warn them, why the fake email looked like it came from you, and what you did to prevent it.

New York Rule of Professional Conduct 1.6(c) requires reasonable efforts to protect client information. North Carolina has looked at this exact scam. Its 2020 Formal Ethics Opinion 5 considered a buyer who was tricked by a spoofed email into wiring closing money to a criminal. The lawyer in that case had already warned the client in writing, with steps to verify any wiring instructions, and was found not to have broken the rules. The lesson is worth borrowing: a written warning, given early, is one of the simplest protections a firm can offer.

We are an IT company, not a law firm. This is not legal advice. Ask your own counsel what applies to you.

Wiring instructions are never accepted or changed by email alone. Every change is confirmed by phone, using a number the firm already had on file.

Not the number in the email. Not the number in the signature block of a new message. The one from the original engagement or the title company's known contact.

This is the step the FBI, FinCEN and the CFPB recommend, and it works because it moves the check outside the channel the criminal controls.

1. Tell clients early, in writing. In the engagement letter and again a week before closing: "We will never change wiring instructions by email. If you get a message that says otherwise, call us at this number before you send anything."
2. Call back on the number on file. For every incoming wire instruction and every change, with a short note in the file showing who confirmed it and when.
3. Lock down your own email. Turn on SPF, DKIM and DMARC for your domain, and move DMARC to reject when it is safe to do so. CISA, the FBI, the FTC and the UK National Cyber Security Centre all recommend it. It makes it much harder for anyone to send email that looks like it came from you. Your IT provider sets these up; the question to ask them is: "Is our DMARC set to reject?"
4. Protect the accounts that move money. Use passkeys or security keys for email and banking logins, especially for whoever handles escrow.
5. Watch for lookalikes. Know your real domain by heart, and train staff to check the full sender address on anything about money.
6. Have a same hour plan. That means a written plan to act within the hour if money goes to the wrong place, because speed matters. Call the sending bank right away and ask them to start a recall, then report it to the FBI at ic3.gov. Write these steps down before you need them.

We help small New York firms close the gaps this scam depends on: email settings that stop spoofing, phishing resistant sign in for the people who handle money, staff training built on this exact scenario, and a written same hour response plan. We also keep a record of what is in place, so you can answer clients and insurers when they ask.

If closings are a big part of your practice, start with a free 30 minute Technology Readiness Review, a no cost conversation with no access to your systems needed. We will talk through how money and documents move in your office and give you a short list of what is solid and what to fix first.

• FBI, Business Email Compromise and Real Estate Wire Fraud, report to Congress, Nov. 2022
• FBI IC3, 2025 Internet Crime Report
• FinCEN, Analysis of Business Email Compromise in the Real Estate Sector, Mar. 30, 2023
• CFPB, Mortgage Closing Scams: How to protect yourself and your closing funds
• ALTA, Title Companies Help Mitigate Risk of Wire Fraud, Feb. 27, 2025
• North Carolina State Bar, 2020 Formal Ethics Opinion 5
• FBI IC3, Criminals Use Generative AI to Facilitate Financial Fraud, Dec. 3, 2024
• FBI IC3, PSA I-051525-PSA (AI voice impersonation), May 15, 2025
• CISA, NSA, FBI and MS ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One, Oct. 18, 2023
• UK National Cyber Security Centre, Email security and anti spoofing
• FTC staff, Businesses Can Help Stop Phishing Using Email Authentication
• New York Rules of Professional Conduct (22 NYCRR Part 1200), Rule 1.6
• Full source list and how we check claims