The crime, in plain English

You've saved for years. The lender is ready, the movers are booked, and closing is Monday. Then an email arrives with "updated" wire instructions for your closing funds. It has your file number, your closing date, a familiar signature block. It looks routine, and looks like it is from the closing attorney or your real estate agent.

It is a theft in progress—and if you follow it, your money can be gone within hours.

This scam can sometimes come in the form of business email compromise (a scheme where criminals break into, or convincingly imitate, a real email account and use it to send fake payment instructions). Real estate closings are one of its most common targets, and it usually works the same way:

  1. Criminals monitor a pending transaction—often by compromising the email account of someone involved in the deal or by scraping listing and public data. They learn the parties, the timeline, and the amounts.
  2. Shortly before closing, they email the buyer posing as the closing office, agent, or lender, with wire instructions pointing to an account they control.
  3. The buyer wires the cash to close (the total funds you owe at settlement—down payment plus closing costs) to the criminal's account.
  4. The money is moved within hours through money mule accounts (accounts, often belonging to recruited or duped third parties, used to shuffle stolen funds) and frequently out of the country.

The scam targets wires for a reason. A wire transfer (an electronic bank-to-bank payment that settles the same day) is fast, final, and hard to claw back. There is no chargeback, the way there is with a credit card. Once the receiving account is emptied, the trail goes cold quickly.

Why closings are the target

According to the FBI's Internet Crime Complaint Center (IC3) (the federal clearinghouse for internet crime reports, at ic3.gov), Americans reported $275.1 million in real estate fraud losses in 2025 alone. Business email compromise as a whole cost victims more than $3 billion that year, second only to investment fraud among the internet crimes the FBI tracks.

Closings are attractive to criminals because they combine everything a fraudster wants:

  • Large, predictable sums. A single email can redirect an entire down payment.
  • A known timeline. Contracts, listings, and public records tell criminals roughly when money will move.
  • Crowded inboxes. A typical closing involves the buyer, seller, two agents, a lender, an insurance agent, and a closing office—lots of email traffic for a fake message to hide in.
  • Stressed, cooperative victims. Days from closing, buyers are primed to follow instructions quickly so nothing derails the deal.

How the scam is changing

The fake email at the end of the scheme has looked much the same for years. What keeps changing is how criminals get to the money. Three newer tactics are worth knowing about.

Getting into an email account without the password. In May 2026, the FBI warned about Kali365, a phishing kit sold by subscription that lets criminals take over Microsoft 365 email accounts without ever learning the password. The target gets an email that looks like a document-sharing notice. It contains a short code and asks the reader to enter it on a Microsoft sign-in page. The page is real, which is what makes the trick work. Entering the code approves the criminal's device, which can then read the account's email and files without a password or another multi-factor prompt. From inside a real mailbox, a criminal can watch a closing unfold and send fake instructions from an address that is not spoofed at all. So never enter a sign-in code you didn't ask for. A genuine code is one you requested yourself, on the screen in front of you.

Phone calls that look like they come from your bank. In November 2025, the FBI reported that it had received more than 5,100 complaints since January of account takeovers by criminals impersonating banks and other financial institutions, with losses of more than $262 million. The criminals call, text, or email about "suspicious activity" and ask the victim to confirm a password or the one-time code the bank just texted. With that, they sign in, lock the owner out, and wire the money away. The caller ID may show the bank's real number, because caller ID can be faked. The American Land Title Association warned at the end of 2025 that the same scheme is now aimed at closing offices and real estate law firms. A bank that calls, texts, or emails you has no legitimate reason to ask for your password or a one-time code. Hang up and call the number on the back of your card.

Saved wire instructions that have been altered. A title insurer has also warned that criminals are planting malicious software on business computers to find wire instructions saved as documents and quietly change the account numbers. The person who sends the altered document may not notice, because it came from their own files. This is one more reason to confirm every digit by phone before you wire, even when the instructions came from the right person.

Days from closing: Rachel's near miss

Consider Rachel, a nurse buying her first home in Brandon. Her closing is set for Monday morning, and her cash to close is $42,780.

Thursday evening, an email lands in her inbox. It appears to come from her closing office. It uses her file number, her closing date, and the paralegal's name and signature block. It reads: "Our bank is completing a year-end audit, so we've updated our wiring instructions. Please use the account below and initiate your wire Friday morning to avoid delaying your closing."

The new instructions name a bank in another state and an account held by an LLC Rachel has never heard of.

Everything about the email is real except the sender. The address is a spoofed domain (a lookalike email address, often one character off from the genuine one—an extra letter, a swapped ".net" for ".com"). Criminals had been watching the transaction and timed the message for maximum pressure: after business hours, with a deadline the next morning.

Friday morning, Rachel is standing in line at her bank with the fake instructions printed out. Then she remembers the advice from her closing packet: verify by phone first. She steps out of line and calls the closing office—at the number on its website, not the number in the email signature, because fraudsters change that too.

The paralegal's answer takes ten seconds: nothing has changed. The wiring instructions are the same ones issued at the start of her file. Rachel wires to the correct account, closes on Monday, and the office reports the spoofed email.

Now run the other version. If Rachel had sent the wire at 9:00 a.m. Friday, the money would likely have left the drop account before lunch, split across mule accounts, and possibly been converted to cryptocurrency by the weekend. Recovery odds fall sharply after the first 24 to 72 hours—and many victims recover nothing. No refund, no house, and a seller still legally entitled to close.

One phone call was the difference.

How Maples Richey handles wire instructions

Here is something worth understanding clearly: like most closing offices, we do send wire instructions by email. What protects you is not the delivery method—it's the rule that comes with it:

Our wire instructions will not change during your transaction.

That single fact defeats the entire scam. If you receive anything that claims our instructions have been "updated," "corrected," or "revised"—by email, text, or phone—treat it as fraud until we confirm otherwise by phone. Call us at the number on this site—not one from an email—and we'll verify everything before a dollar moves.

Behind that rule, the firm runs on a few concrete safeguards:

  • Independent phone verification of wire instructions, using known numbers—not numbers supplied in an email.
  • Multi-factor authentication (a second login step beyond a password) on our systems.
  • Identity verification of signers, in person at our office or through a mobile notary.
  • Errors and omissions insurance carried by the firm.

Before you wire: the checklist

  • Call first, every time. Before sending closing funds, call your closing office at a number you found independently—on its website or in your contract, not in the email or its signature block.
  • Verify the details out loud. Confirm the bank name, routing number, account number, and account name digit by digit over the phone. Do this even with instructions you received at the start of your file and saved.
  • Make the call yourself. A call you receive is not verification, even if the caller ID shows the right name and number. Hang up and call back at a number you found yourself.
  • Never share a password or a code. No closing office or lender needs your email password, and a bank that contacts you has no reason to ask for your password or the one-time code texted to your phone. Treat anyone who contacts you and asks for either as a fraud.
  • Ask your bank to match the beneficiary name. Some banks process wires on account numbers alone—ask them to check that the name matches.
  • Wire early in the day, early in the week. Scammers rely on time pressure, and a wire sent Friday afternoon is hard to chase over a weekend.
  • Confirm receipt. After sending, call the closing office to confirm the funds arrived where they should.

The Consumer Financial Protection Bureau publishes similar prevention guidance for mortgage closing scams if you want a second source.

Red flags that should stop you cold

  • Any "updated," "corrected," or "revised" wire instructions, at any point in the transaction
  • A new bank, a new account holder name, or an out-of-state or foreign bank you weren't told about by phone
  • A SWIFT code on the instructions (SWIFT codes are used for international wires; a domestic wire to a Mississippi closing office doesn't need one)
  • Urgency: "wire today," "before noon," "to avoid delaying your closing"
  • An email address that's slightly off, or a reply-to address that differs from the sender
  • A request to keep the change quiet or handle it only by email
  • Changes in tone, grammar, or formatting from earlier messages, a generic greeting, stiff wording like "kindly," or emails sent at odd hours
  • Wire instructions arriving by text message
  • An email asking you to enter a code on a sign-in page to open a document
  • A call or text from "your bank's fraud department" asking you to confirm a password or a code

Any one of these is reason enough to stop and pick up the phone.

If you already sent the money

Speed matters more than anything else. Funds often move out of the destination account within hours, so act immediately—even at night or on a weekend.

  1. Call your bank right away and ask it to initiate a wire recall (a formal request to the receiving bank to freeze and return the funds). Ask for the fraud department, and get a case number.
  2. Call the receiving bank's fraud department too. You'll have its name from the wire instructions. Ask it to freeze the account.
  3. File a complaint with the FBI at ic3.gov—immediately, not the next business day. When fraud is reported quickly, the FBI's recovery process can sometimes freeze funds before they disappear. Every hour counts.
  4. Call your closing office at the number on this site so we know what happened, can alert the other parties, and can talk through where your closing stands.
  5. Report it to local police and keep the report number—your bank and insurers will ask for it.
  6. Secure your email. These schemes often begin with a compromised account. Change your password, turn on multi-factor authentication, and use your email provider's option to sign out of every device, which can help cut off someone who got in without the password, and remove any device you don't recognize. Then check your settings for forwarding rules you didn't create and your Sent folder for messages you didn't send.

Recovery is possible, especially in the first day or two, but every hour matters. Act immediately.

The bottom line

Wire fraud is the most dangerous thing that can happen to your closing, and also one of the easiest to prevent. The criminals' entire scheme depends on you trusting an email. Don't. Trust the phone call you make yourself, to a number you found yourself.

Our instructions won't change. If something says they did, that's your signal—stop, call, verify. Two minutes on the phone protects everything you've saved.

Have a question about wire instructions on a Maples Richey closing? Call us at the number on this site before you send anything.

This article is general information about Mississippi law, not legal advice. Every title is different—if you have questions about a specific property, contact us.