Real Estate Wire Fraud: Whose System Was Compromised?

A buyer wires funds on Tuesday. On Wednesday, the other side asks where the money is.

In a residential closing, that call may come from the title company.

In a commercial transaction or high-value lease, it may come from the landlord, lender, escrow agent, broker, or counsel.

At first, everyone focuses on the thief. Soon, the focus shifts to a different question: whose inbox was compromised?

That answer often determines who will be responsible for the loss. And it can’t be found by reading emails alone.

It requires a complex forensic investigation, often completed by experts with former law enforcement experience. One wrong wire can place an entire organization under internal investigation, with litigation holds and insurance notices to follow.

A single fraudulent wire can trigger an internal investigation, a forensic review of how the compromise occurred, insurance notifications; and, in some cases, regulatory scrutiny.

Transactions are different in the age of AI. The FBI reports that “Chan generators can quickly create official-sounding emails” that direct victims to wire funds to fraudulent accounts. (FBI IC3, 2025 Internet Crime Report, p. 39.)

The Scope of Threat

The risk is not theoretical.

The FBI’s Internet Crime Complaint Center registered 12K+ real estate fraud complaints in 2025. The amount of reported real estate losses exceeded $275M. (FBI IC3, 2025 Internet Crime Report, pp. 7–8).

Business email compromise (BEC) had more $3,046,598,558 in reported losses in 2025. That was the the second-largest loss category after investment fraud (FBI IC3, 2025 Internet Crime Report, p. 9).

FinCEN found that real estate represented 16 percent of reported BEC cases (FinCEN, Updated BEC Advisory, 2019, p. 5).

The same advisory noted that criminals target individuals “particularly and increasingly those with high net worth” (FinCEN, Updated BEC Advisory, 2019, p. 3).

The IC3 received more than 22,000 AI-related complaints in 2025, with adjusted losses above $893 million (FBI IC3, 2025 Internet Crime Report, p. 39).

Common Wire Fraud Attack Vectors

The FBI describes “[real estate wire fraud]… as a sub-category of BEC, in which criminal actors target individuals or companies executing large wires related to real estate transactions” (FBI, BEC and Real Estate Wire Fraud, FY2022 Report, p. 3).

Victims include title companies, law firms, real estate agents, buyers, and sellers (FBI, FY2022 Report, p. 3).

For example, in 2025, a Missouri buyer received a “compromised email from the ‘title company'” with instructions to wire more than $1.3 million (FBI IC3, 2025 Internet Crime Report, p. 23).

In another closing, buyers received “an email impersonating their legitimate attorneys” and wired more than $449,000 (FBI IC3, 2025 Internet Crime Report, p. 23).

Fortunately, the investigation determined that title company’s email system had been compromised. That finding likely saved the buyer significant time and resources that otherwise would have been required to prove the source of the breach.

In one federal case, a company wired $51,040.99 in rent after an email from an impersonator posing as its landlord (DOJ, N.D. Ga., June 1, 2021).

The FTC has received more than 65K+ rental scam reports with about $65 million in losses since 2020 (FTC Data Spotlight, Dec. 22, 2025).

The FBI warns of “title pirates” who use forged deeds to convey title and of scammers who impersonate owners to list property (FBI Boston, Apr. 1, 2025).

New York now treats deed theft as larceny under Penal Law § 155.05(2)(g) (N.Y. Penal Law § 155.05).

A Texas title company employee created “a fraudulent email address resembling that of a legitimate lienholder” and requested the title company to wire more than $350,000 (DOJ, S.D. Tex., Apr. 28, 2025). Not every compromise comes from outside.

The first question: whose email was compromised?

In our experience, most real estate wire fraud losses start with either a compromised email account or a convincing email impersonation scheme.

The critical question is not whether fraud occurred, but whose account was compromised.

The breach could originate with the buyer, seller, attorney, broker, title company, landlord, lender, or escrow agent.

The answer often defines liability analysis and could determine who ultimately bears the loss.

A party whose email system was compromised may face claims that inadequate cybersecurity controls enabled the fraud.

A party that wired funds based on unverified instructions could face allegations that it failed to follow basic verification procedures.

The forensic evidence usually paints the story. FinCEN lists the indicators that matter: email auto-forwarding, inbox sweep or sorting rules set up in the victim’s account, and the authentication protocol that was compromised (FinCEN, Updated BEC Advisory, 2019, p. 10). None of them is visible in the fraudulent email itself.

Why forensics Often Determines Liability

NIST defines digital forensics as “The application of science to the identification, collection, examination, and analysis, of data while preserving the integrity of the information and maintaining a strict chain of custody for the data” (NIST SP 800-86, via CSRC Glossary).

In practice, the compromised devices have to be analyzed.

Computers, phones, and mailboxes must be imaged and analyzed, and the audits are expensive.

Dilendorf Law Firm uses retired cybercrime law enforcement agents to conduct these audits. Their reports establish which account was breached, when, and through what path.

Showing that your organization was not compromised requires mailbox audit logs, sign-in records, rule-change histories, and endpoint images.

FinCEN’s recovery program asks for sender email addresses with associated IP addresses and timestamps, and for login information with location and timestamps (FinCEN, RRP Fact Sheet, Feb. 11, 2022).

Proving a negative is harder than proving a breach. One wrong wire can place an entire organization under internal investigation, with litigation holds and insurance notices to follow.

Proving a negative is harder than proving a breach. One wrong wire can place an entire organization under forensic scrutiny.

What begins as a missing payment could quickly evolve into audits, insurance claims, regulatory inquiries. And if a system compromise is confirmed, company could be subject to extensive reporting obligations under federal/ state law.

Critical Evidence Does Not Last Forever

Claims must be investigated on time.

In our experience, consumer providers such as Gmail and Apple may retain the account activity records needed to prove a compromise for only about six months after the incident.

In our experience, consumer email providers such as Gmail and Apple may retain account activity records for only a limited time, sometimes as little as six months after an incident.

Private organizations vary widely. A landlord, title company or broker m may retain years of logs, while others may retain little or no historical data. Some may not have formal retention policies at all.

That matters. Missing logs can make it difficult to determine how the fraud occurred and whether a system was compromised.

The bank will not resolve it

Under UCC § 4A-207(b)(1), “if the beneficiary’s bank does not know that the name and number refer to different persons, it may rely on the number as the proper identification of the beneficiary of the order. The beneficiary’s bank need not determine whether the name and number refer to the same person.” (UCC § 4A-207).

The FBI observed: “When BEC acts occur, the bank does not have to verify the transfer beyond the number. In order to address this shortcoming, it’s ” (FBI, FY2022 Report, p. 11).

FinCEN adds that such transfers “are often irrevocable” (FinCEN, Updated BEC Advisory, 2019, p. 8). The loss therefore usually remains between the transacting parties.

When splitting the loss makes sense

A full forensic audit of two organizations can cost tens of thousands of dollars. Where the loss is modest relative to that cost, a negotiated allocation before the forensic phase may be the rational outcome, depending on the facts.

Where the loss is large, forensics are unavoidable, and the findings drive the claim. Either way, preservation comes first, because talks fail and logs expire.

What to do in the first 72 hours

1. Contact the originating bank and request a recall. Send your bank a “Hold Harmless Letter or Letter of Indemnity” (IC3, Business Email Compromise).
2. File a complaint at ic3.gov immediately. “FinCEN is most likely to be able to interdict or recover funds when fraudulently induced wire transfers are reported to law enforcement within 72 hours of the transaction.” (FinCEN, RRP Fact Sheet, Apr. 15, 2026, p. 2).
3. Suspend mailbox deletion, export audit and sign-in logs. Retain forensic expert witness to image affected devices before anyone “cleans” the account.
4. Notify every counterparty in writing and request that each preserve evidence.
5. Review cyber/crime policies and give notice within policy deadlines.
6. Retain counsel and independent forensic investigators before assigning blame.

The recovery window is measured in hours and so is the evidence. If you’re a victim of wire fraud, call our New York office at +1 212 457 9797.

Contact Us

If you’re a victim of wire fraud, contact Max Dilendorf at +1 212 457 9797 or info@dilendorf.com, or use our contact page.

This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.

Wire fraud recovery is time-sensitive and uncertain. Contacting Dilendorf Law Firm does not guarantee that any funds will be recovered or that any claim will succeed.