is that a scam?
← Back to all scams
CRITICAL phishing Last reported: Sep 22, 2026 Share

Email from "title company" changes wire instructions on closing day

A scammer sends "updated" wire instructions for your closing funds — by hacked email or an AI-cloned voice call impersonating your mortgage broker or title officer. The account belongs to them. Hundreds of thousands of dollars are gone in minutes.

Also known as: business email compromise (BEC), escrow wire fraud, closing day wire scam

What to do right now

  1. 1 Never trust wire instructions sent only by email. Always call to verify, using a phone number from a previously-trusted source — not the number in the email or provided in that final call
  2. 2 Save your title company's phone number from their official website at the start of the transaction — not from any email — and call only that number before wiring
  3. 3 Before the wire goes out, confirm the account name, routing number, and account number by reading them back digit-by-digit on that pre-saved number
  4. 4 Even if the caller sounds exactly like your mortgage broker, hang up and call back on the number you saved earlier — AI voice cloning can replicate familiar voices perfectly
  5. 5 If you suspect the wire was already sent to a scammer, call your bank immediately and ask them to file a SWIFT recall. The first 24–72 hours give the best chance of recovery
  6. 6 Also call the FBI's IC3 within 24 hours — they run a Financial Fraud Kill Chain that has recovered wires
  7. 7 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

  • ⚠ Wire instructions arrive by email and change at the last minute, often the day of closing
  • ⚠ The sender's email is close to the real one but with a swapped letter or different domain (e.g. titleco-llc.com instead of titleco.com)
  • ⚠ The email asks you to act quickly so 'closing is not delayed'
  • ⚠ The new account is in a different state or city than the title company is based in
  • ⚠ A phone call or voicemail from someone who sounds exactly like your mortgage broker or title officer confirms the 'changed' wire instructions — AI voice cloning can replicate a familiar voice
  • ⚠ The caller or email says the change is due to a 'bank routing issue,' 'processing update,' or 'last-minute bank switch'

This scam is uniquely devastating because the amounts are large and the funds usually move overseas within hours. Recovery is possible but rare, and only if you act within 24–72 hours of the wire leaving your bank.

The single best defense is a simple rule: wire instructions are never accepted by email alone. Always call to confirm on a number you already have, and confirm the account details by reading them back out loud.

If your wire has already gone to a scammer: do not wait. Call your bank’s fraud line right now. Then call the FBI IC3. Then call the title company.

Known variants

  • AI voice-cloning on closing day: scammer clones the mortgage broker or title officer's voice using public audio to call claiming wire instructions changed. Paired with a spoofed email, this defeats 'call to verify.' Michigan case: $66,000 lost Sep 2026. RE wire fraud losses exceeded $275M in 2025.

    Last seen: 9/22/2026

Sources

Share this with someone who might need it