In this article
The phone call every closing attorney, title officer, settlement agent, and OTC desk operator dreads arrives without warning. A counterparty calls to report funds never landed. Or your own team notices that an outgoing wire settled to an account that does not match the disbursement schedule you approved. Or the buyer's bank calls to say the money never cleared on their end. However it begins, the diagnosis is the same: a suspected diversion is underway, and the clock is already running.
The first hours after a fraudulent wire are decisive, because once funds are withdrawn or moved overseas, recovery becomes far harder. That is not a figure of speech. The mechanics of how stolen funds move — fragmented across secondary accounts, converted to other instruments, sometimes routed internationally — mean that every action taken in the first sixty minutes has an outsized impact on outcomes. The professional who already knows what to do, in what order, without needing to search for guidance under pressure, is the professional whose clients stand the best chance of getting their money back.
This piece is written for that professional. It covers the warning signs that a diversion has occurred, the minute-by-minute response framework once suspicion is confirmed, the legal exposure that follows, and the structural change in how settlements can be routed to reduce the surface area for this kind of fraud in the first place.
Freeze rate from the FBI's 2024 Internet Crime Report; recovery figure according to ALTA.
The anatomy of a payment diversion
Before building a response protocol, it helps to understand what you are actually responding to.
Wire fraud is a scam using electronic communications to divert money to the bank accounts of cybercriminals. Cybercriminals target the participants in a real estate transaction, including buyers, sellers, real estate attorneys, title companies, and real estate brokers and agents. These scammers hack into email accounts, monitor the progress of the transaction, and wait for just the right moment when the transfer of funds is necessary for the closing.
A criminal gains access to one party's email — most often a real estate agent, but sometimes a title officer, attorney, or even the buyer — often via phishing, credential stuffing, or simple password reuse. The attacker silently monitors email for weeks, learns the deal terms, parties, and timing. Then, 24 to 72 hours before closing, the attacker sends an email "from" the title company saying wire instructions have changed.
The email is spoofed from a similar domain — titleco-secure.com instead of titleco.com — or sent from an actually-compromised account. The buyer wires funds to a money-mule account controlled by the attackers. Within hours, funds are moved through layers of accounts, often international, broken into smaller transfers, and converted to crypto or cash.
This is not a niche scenario. In 2024 alone, the FBI's IC3 received 21,442 BEC complaints with adjusted losses of $2.77 billion, making it the second-highest loss category among all reported internet crimes that year. And diversion is not limited to residential real estate. The category of business email compromise includes executive impersonation, vendor impersonation, supplier invoice fraud, payroll diversion, payment diversion, real-estate wire fraud, and weak approval workflows that let urgent payment requests bypass verification. Settlement agents, OTC desks executing multi-million-dollar block trades, and brokers coordinating multi-party commercial closings are all in scope.
Commercial real estate transactions can be particularly vulnerable because they happen on a regular and recurring basis and typically use established, straightforward processes. Fraudsters have grown increasingly sophisticated. Many have learned the who, what, and when of purchase transactions, including when investors and banks finalize loan documents and send deposits.
The attack vector is social, not technical. Reconnaissance turns a generic scam into a credible business conversation. Attackers collect open-source intelligence from company websites, professional profiles, conference videos, social media, job postings, press releases, and public filings. These sources reveal reporting lines, job titles, office locations, supplier relationships, current projects, travel schedules, and the language employees use internally.
The warning signals: what to catch before the wire leaves
Not every diversion is discovered after the fact. Some are stopped before the wire leaves — if someone in the transaction knows what to look for. These are the signals that should trigger an immediate pause and a verification callback before any funds move.
A sudden change in account details. A change in wire instructions is rare — it is genuinely uncommon for any party to change banking information in the middle of a real estate transaction. A legitimate title company, closing attorney, or settlement agent does not routinely alter disbursement accounts mid-deal. If a message arrives claiming the recipient account has changed, that message deserves maximum scrutiny before any action.
Urgency as a weapon. Emails that demand urgent action — particularly those sent at the end of the month or the beginning of bank holidays — and outreach through multiple mediums, such as texts and phone calls, regarding the wire transfer, or emails sent outside of business operating hours, are all red flags. Fraudsters manufacture pressure because pressure suppresses verification. Fraudsters rely on urgency. Take a pause before sending funds.
Domain discrepancies. Sophisticated fraudulent emails mimic the real person's identity using company logos and email addresses that are very close but off by a letter or number. A closing attorney's domain of firmname.com versus firmname-closing.com is the kind of difference that is easy to miss when twenty emails have arrived that day and the closing is scheduled in three hours.
Hidden inbox rules. A cyberattacker can create a rule that silently forwards invoices, password resets, or executive correspondence to an external mailbox. Hidden inbox rules can move replies into obscure folders, mark messages as read, or delete warnings before the account owner sees them. If you are dealing with a counterparty whose replies seem slightly out of character, or responses arrive faster than expected, it is worth asking your counterpart to verify via voice.
The silent takeover. Follow-up concealment begins immediately after the transfer. The attacker may delete messages, alter mailbox rules, continue impersonating the executive, or send a reassuring reply that discourages questions. A compromised account can remain active while the attacker watches for evidence that the payment was noticed. The goal is to delay discovery until funds have moved beyond practical recovery.
The first sixty minutes: a minute-by-minute response framework
The moment suspicion is confirmed — not proven, confirmed — the following framework applies. Every minute spent deliberating instead of acting reduces the probability of recovery.
Minutes 0–5: Do not move anything, confirm the suspected diversion
The first instinct in a crisis is to send a corrective wire. Resist it entirely. Do not issue any further payments until the full picture is understood. Do not reply to the email thread that appears suspicious. Do not call numbers from that thread.
Simultaneously, designate one person in your team as the incident lead. Everyone else stops touching the affected accounts and channels until that person gives direction. The purpose of this is evidence preservation and containment: document all verification attempts and implement your firm's emergency protocols if fraud is suspected.
Confirm the suspected diversion by cross-referencing the wire confirmation against your own pre-approved disbursement schedule. If the receiving account does not match what was in the signed closing documents, the disbursement instructions, or the trade confirmation — treat it as compromised. Do not wait for certainty.
Minutes 5–15: Call your bank and request an immediate wire recall
Call your bank immediately and request a recall of the wire. Most banks have a fraud response line available around the clock. The faster the recall request is made, the higher the probability that funds can be recovered before they are moved.
Call your bank first, immediately. Not tomorrow, not after you have worked out how to explain it. Ask specifically for the fraud department and use the words "fraudulent wire transfer" — that phrasing routes you to the people who can act.
When you reach the fraud department, be precise. Request a wire recall, asking the bank to initiate a SWIFT or Fedwire recall and reverse the transfer, and have the receiving bank notified to freeze the account. Have the following information ready before you call: the exact dollar amount, the time and date of the wire, the originating account details, the receiving bank name, the routing number, the account number as you sent it, and the wire confirmation number. Vague reports cannot be actioned; specific ones can be sent straight to a receiving institution.
Minutes 15–30: Notify all transaction parties in writing and by voice
Notify all transaction parties, including the title company and closing attorney, in writing. Follow your firm's escalation process for affected borrowers and lenders.
Do this in parallel with the bank call, not after it. Every party in the chain needs to know simultaneously: the seller, the buyer's lender, any co-brokers, the title company if they were not the source of the compromise. Why? Because the attacker may be monitoring multiple threads at once. Other legs of the same transaction may be at risk. And a party who receives a wire from a compromised escrow account needs to know immediately so they do not release goods, property, or services against funds that may be recalled.
Use voice calls first, then written follow-ups. The most effective step to take is conducting a callback. This involves using a phone number from a trusted system of records and calling to verify payment details or instructions. Never use a number sent in an email, as it could be the criminal's — nor should an inbound call be blindly trusted in such situations.
Minutes 30–45: File with IC3 and trigger the Financial Fraud Kill Chain
File a complaint with the FBI's Internet Crime Complaint Center at IC3.gov. The FBI's Recovery Asset Team can initiate a freeze request through the banking system when a complaint is filed promptly.
The mechanism here is specific and worth understanding in detail. The IC3's Recovery Asset Team was established in February 2018 to streamline communications with financial institutions when individuals become victims of various money scams. When the IC3 receives a complaint from a victim that made a transfer under fraudulent pretenses to a bank account located in the United States, the RAT forwards the transaction details to an identified point of contact at the recipient bank to notify the bank of the fraudulent activity and request freezing of the account. Once a response is received from the recipient bank, the RAT contacts the appropriate FBI field office.
The success data on this process is compelling. The 2024 figures come from the FBI's 2024 Internet Crime Report and count the complaints on which the IC3 Recovery Asset Team initiated the Financial Fraud Kill Chain; the 2025 figures count the emergency freeze actions the FBI's IC3 triggered, with the success rate on the transfers it was able to chase.
| Year | Kill Chain actions | Attempted theft | Frozen by financial institutions |
|---|---|---|---|
| 2024 | 3,020 complaints | $848.4 million | $561 million (66% success rate) |
| 2025 | Roughly 3,900 freeze actions | $1.2 billion | $679 million (58% success rate) |
The effectiveness of this process depends heavily on how quickly fraud is reported, which is why having a response plan in place and acting immediately is critical. The FBI can only chase what it hears about in time, and the window is measured in hours.
Call your local FBI field office too. A phone call in parallel with the online complaint gets a human on it faster, particularly for large sums.
Minutes 45–60: Preserve all evidence and notify your insurer
Preserve the fraudulent instructions alongside any legitimate instructions previously received, wire confirmation numbers, account numbers and routing information, screenshots of any websites, domains, or email addresses involved, bank statements and any contracts or closing documents referencing disbursement instructions.
Do not delete anything. Do not "clean up" the email thread. Do not close browser tabs with suspicious domains open. Forward suspicious emails to a secure folder rather than deleting them. Retain emails, full headers, attachments, portal records, and call logs. These are the materials that will matter to the FBI, your insurer, and potentially a court.
Implement your firm's emergency protocols and notify insurance carriers of potential exposure without delay, as some policies require prompt notice to preserve coverage. This step is easy to defer under pressure — it feels administrative when everything else feels urgent. But an insurer who is not notified promptly may later contest coverage on timeliness grounds. Make the call.
Report the fraud to the FTC at ReportFraud.ftc.gov. File a police report with your local law enforcement agency to create an official record. The police report matters for insurance claims, civil litigation, and regulatory purposes even if local law enforcement cannot directly recover the funds.
The liability picture
The question of who bears the loss when a diversion occurs is rarely simple. Liability for diverted closing funds is fact-specific and often disputed, turning on whose email was compromised and who was negligent. Real estate wire fraud typically involves a criminal hacking a real estate agent's, title company's, or attorney's email and sending the buyer fake wire instructions, sometimes as a last-minute change. Depending on the facts, responsibility may be argued among the buyer, the title or escrow company, the agent, and the criminal, based on who was hacked, who failed to verify the instructions, and what duties each party owed, often analyzed under state negligence and tort law.
The central question in BEC litigation is who bears the financial loss. It may seem that the answer is which party was hacked. But in reality, courts often allocate it to the party best positioned to have detected and prevented the fraud, and the hacked party is not often in the best position to identify that the fraud has occurred. This analysis considers factors such as whether each party secured its systems, had notice of prior compromises or targeting, scrutinized spoofed addresses, followed payment-change protocols, and confirmed wire instructions.
Courts often apportion losses based on the extent to which each party exercised ordinary care. BEC events often involve failures on both sides — one party may have had the compromised account or ambiguous payment-change process, while another may have ignored mismatched payee names, suspicious domains, or broken callback procedures.
The practical implication for the professionals reading this: the quality of your response protocol, and whether you followed it, will be scrutinized. A title company that issued a wire without a voice-verified callback, a closing attorney whose email was not protected by multi-factor authentication, a broker who forwarded new wire instructions via the same email thread that was already compromised — each of these will be examined against what a professional exercising ordinary care would have done.
Also report to the state attorney general's consumer protection office and, if a licensed escrow or title professional was involved, to the relevant state licensing regulator. This is not optional in most jurisdictions; it is a regulatory obligation.
Three concrete scenarios and how the framework applies
Scenario 1: A $3.2 million (AUD $4.9 million) commercial closing
A title officer issues disbursement wires on the morning of closing. Three hours later, the seller's attorney calls to say the seller received nothing. The title officer checks the wire detail and sees the routing number is correct but the account number differs by two digits from the seller's verified account in the closing documents.
Response: The title officer immediately calls the originating bank's fraud line — using a number from the bank's official website, not from their email — and requests a SWIFT recall. They simultaneously call the FBI field office and begin an IC3 complaint. They notify the buyer's lender, the selling broker, and the seller's attorney by phone in sequence, then confirm in writing. The insurance carrier is notified before the end of the hour. All emails from the past seven days involving the wire instructions are preserved with full headers.
Scenario 2: A broker coordinating a multi-party property deal
A commercial broker has four parties receiving proceeds at closing: a lender being paid off, a seller, a junior lienholder, and a referral party. At 4 PM the day before closing, an email arrives — ostensibly from the junior lienholder's legal counsel — providing "updated" account details. The email domain is off by one character. The broker's assistant nearly processes the change.
Response: The assistant pauses and calls the lienholder's attorney directly using the number from the original engagement letter, not the email signature in the new message. The attorney confirms no instruction change was sent. The email is forwarded to the broker's IT provider for forensic header analysis. The closing proceeds the following morning with original, verified instructions. A formal incident report is filed.
Scenario 3: An OTC desk processing a $7.5 million (AUD $11.5 million) block settlement
An OTC desk has routed a large block trade and the fiat leg is due to settle to the counterparty's nominated bank account. Minutes before the wire, a message arrives from what appears to be the counterparty's operations team saying the receiving account has changed because of an "internal treasury restructure." Alternative settlement instructions should always be independently verified, because impersonation and payment-detail fraud can target large transfers. The desk's settlement officer calls the counterparty's CFO on a number from their onboarding file — not from the day's correspondence — and confirms no such change was made. The desk suspends the wire and reports the attempted fraud to its compliance team and, subsequently, law enforcement.
The structural question: why settlement design matters
A diversion is not only a security event. It is a process failure at the settlement layer. In each scenario above, the core vulnerability is the same: instructions governing where money goes were communicated through a channel that could be intercepted, spoofed, or altered. The fix has two parts — a response protocol for when something goes wrong, and a settlement design that reduces the likelihood and impact of that happening.
This is where the architecture of how a deal is structured at the payment layer becomes directly relevant. Traditional deal closings require a single large wire to a trust or escrow account, followed by a sequence of outgoing wires to each party — each with its own account details, each requiring its own verification. Every hop in that sequence is a surface area. Every email conveying an account number is a potential intercept. Every moment when funds are in transit from one account to another before reaching their final destination is a window for diversion.
The fundamental problem is sequential disbursement through intermediary custody. When a settlement agent receives USD $3.2 million and then issues individual wires to six parties across the next two hours, there are six opportunities for a fraudster to intercept one of those instructions, six sets of account credentials that need to be verified, and an extended window during which the funds are nominally settled but not yet final in the hands of the parties they belong to.
A different approach routes the total amount directly to all parties simultaneously — at preset, cryptographically fixed shares, in a single transaction, with finality at the moment of execution. This is the settlement model that shaka.deal is built on. One payment in, every party paid out at their agreed share in the same transaction, with the routing logic committed before the deal closes and visible to all parties. The settlement agent's role is not replaced — they structure the deal, agree the shares, and coordinate the parties. But the outgoing disbursement happens in a single onchain event, not as a sequence of individually addressable wires.
When disbursement instructions are encoded in a smart contract before closing, there is nothing to intercept mid-transaction. There is no email carrying a routing number. There is no moment during which the money sits in a trust account awaiting the settlement agent's next action. The shares are set, the trigger is pulled, the distribution is simultaneous and final. An attacker cannot redirect a payment that has already settled to six parties at once in a single atomic transaction.
Onchain payments on Ethereum are final at settlement. They cannot be recalled, reversed, or disputed in the way that a SWIFT wire can be recalled under the Financial Fraud Kill Chain. That finality is a design property, and it cuts in both directions: it means that correct settlement is just as final as incorrect settlement, which places the full weight on getting the routing logic right before execution. But for professionals who already know how to verify deal structure before funding — which is the core skill of every settlement agent, title officer, and closing attorney — this is not a new burden. It is the same diligence moved earlier in the process, with a much harder surface for interception afterward.
This is not a replacement for professional judgment, verification protocols, or the expertise that settlement professionals bring to complex multi-party transactions. It is a routing layer that gives those professionals a settlement architecture with less operational exposure once they pull the trigger.
Building the response into your firm's standard operating procedure
A response protocol that only exists in someone's head is not a protocol. The following elements should be documented, tested, and accessible to every team member who touches settlements.
Pre-transaction: Verify all account details by voice, using numbers sourced independently, before closing. Closing communication should follow a written sequence that every participant understands before the funding date. The loan officer or settlement coordinator should engage with title, escrow, and the closing attorney at contract acceptance, not when the client is already waiting to sign.
Dual approval for wire releases: No single employee should be able to initiate and release a wire alone. Dual approval works when the second person performs an independent review — not just a rubber stamp of the first person's work. The second reviewer should verify account details against the original engagement documents, not against the most recent email.
Incident contact list: Bank fraud hotlines (sourced from the bank's official website before a crisis, not during one), FBI IC3 at ic3.gov, the firm's insurance carrier, outside counsel, and all counterparty principals — each with a verified, non-email contact number. This list should be printed, not just stored digitally, because a compromised email account makes digital contacts unreliable.
Evidence preservation drill: Staff should know exactly how to forward an email with full headers, screenshot a browser domain, and save a wire confirmation before taking any other action. These are simple steps but they are easily corrupted by urgency if they have not been practiced.
Post-incident review: Every suspected or confirmed diversion — even one that was caught before the wire left — should trigger a written review. What was the attack vector? Which process caught it? What would have let it through? Even the most vigilant companies may fall victim to fraud, but having a clear response plan and a trained team in place can significantly improve the chances of recovering lost funds.
The first hour sets the outcome
In 2022, only 7% of businesses reported that they were able to fully recover the amount originally lost to wire fraud, according to ALTA. The professionals who make it into that group are not luckier than the others. They are faster, better prepared, and in possession of exactly the information the FBI and their bank need to act.
The sixty-minute framework above is not complicated. Call the bank immediately, with specific information. Notify all parties by voice. File with IC3 the same day. Preserve everything. Notify your insurer. Do it in that order, do it without delay, and do not let urgency cause you to skip any step because it feels administrative.
The deeper structural answer — routing settlements through a system where the disbursement logic is committed before funds are received and executed atomically to all parties — is what reduces the surface area before any of this needs to happen. shaka.deal is built precisely for that: one incoming amount, preset shares for every party, simultaneous distribution, and final settlement in a single transaction, with no sequenced outgoing wires to intercept.
The professionals who will use this most effectively are not the ones looking to change how they work. They are the ones who already understand settlement, already run rigorous verification processes, and want a payment routing layer that holds up under pressure when it matters most.
