Wire Fraud Starts in the Inbox: A Payment Instruction Routine for Real Estate Offices

The short version

Wire fraud in real estate rarely starts with someone breaking into a bank. It often starts with an email that looks like it came from someone the client already trusts: the agent, the title officer, the loan processor. The email says the wiring instructions changed. The client sends the money. By the time anyone calls to check, the funds have moved on.

Fixing that is mostly an operations problem, not a software purchase. It comes down to a few rules about how payment instructions travel, a short list of mailbox settings, and a routine everyone on the team follows every time.

What the FBI reported this year

According to HousingWire's April 10, 2026 coverage of the FBI Internet Crime Complaint Center's (IC3) 2025 report:

• Real estate fraud: 12,368 complaints and $275.1 million in reported losses.
• Business email compromise: $3.04 billion in losses across 24,768 complaints, the second-largest loss category.
• All cyber-enabled crime: more than 1 million complaints and losses above $20.8 billion, up 26% from the prior year.

Those are reported losses only. Plenty of incidents never reach the FBI. For a brokerage, team, or private lender, the takeaway is simple: the email channel your deals run on is also the channel attackers use to redirect the money.

Where the routine usually breaks

Wire fraud succeeds in the gaps between people. A few patterns show up again and again:

• Instructions sent by email alone. If a client is used to receiving wiring details in an email, a fake email with new details looks normal.
• Verification by replying. Asking "is this right?" in the same thread only reaches the attacker if the thread is compromised.
• Phone numbers taken from the email. A callback to the number in the signature block can reach the person who wrote the fake email.
• Nobody owns the warning. Every party assumes someone else told the client how payment instructions will arrive.
• Quiet mailbox changes. An attacker with access to an agent's mailbox can add a forwarding rule or a filter that hides replies, and nobody notices for weeks.

A payment instruction routine you can adopt this week

None of this requires new software. It requires writing the rules down and following them on every file.

1. Warn early, in writing and out loud. At contract, tell every buyer and seller that your office will never change wiring instructions by email, and that they should call a known number before sending any funds. Put the same sentence in your email signature and your transaction checklist.
2. Verify by phone, using a number you already had. Before any wire goes out, or any instructions go to a client, confirm by calling a number from your CRM, the contract, or the title company's published contact page. Never a number from the email asking for the payment.
3. Treat any change as a stop. A request to change bank details, even from a known sender, pauses the file until two people have verified it by phone. Write down who verified, when, and how.
4. Keep instructions out of threads. Where possible, deliver wiring details through the title company's secure portal rather than in a long email chain that gets forwarded and copied.
5. Record verified contacts in one place. Store each party's verified phone number on the deal record so the next person on the file is not guessing.

Mailbox settings worth checking

The routine protects the money. These settings make it harder for an attacker to get into position in the first place.

• Multi-factor sign-in on every mailbox, including shared inboxes and the accounts of people who have left.
• Forwarding and inbox rules reviewed monthly. Look for rules that forward mail outside the company or move messages containing words like "wire" or "invoice" out of sight.
• SPF, DKIM, and DMARC on your domain so it is harder for someone to send mail that claims to be from you. Our setup guide walks through the records.
• Lookalike domain awareness. Teach the team to read the full sender address. A swapped letter or an extra word in a domain is a common trick.

Where automation helps, and where it should not

Automation is useful for the parts people forget. A CRM or workflow tool can send the wire fraud warning automatically when a deal moves to "under contract." It can add a "verify by phone" task before any closing date. It can flag inbound messages that mention changed bank details and alert a second person instead of leaving the decision to whoever opened the email.

What automation should not do is verify anything on its own. The callback to a known number is the control. Software can remind, route, and record. A person still makes the call.

Where to start

Write your payment instruction policy on one page. Add the warning to your contract checklist. Check every mailbox for forwarding rules this week. Those three steps cost an afternoon and close the gaps most wire fraud depends on.

If you want help building the routine into your CRM and email setup so it runs on every deal without anyone having to remember it, talk to Genesis AI or see how we approach operations workflows.