A couple in Utah walked into their bank to wire closing funds on their new home. A small flyer on the teller’s desk caught their eye: “Beware of wire fraud.” They’d already gotten wiring instructions by email from their title company. Same logo. Same contact name. Same formatting.
Except it wasn’t their title company.
That story comes from CertifID’s State of Wire Fraud survey, and it’s way more common than anyone in real estate wants to admit. Brokerages, title companies, property managers, commercial firms. It’s happening all over Utah.
This Isn’t Random Phishing
Most people picture wire fraud as some sketchy email from a Nigerian prince. Real estate wire fraud is nothing like that. These criminals are patient.
They start by compromising an email account. Usually it’s a real estate agent, loan officer, or someone at the title company. Maybe the person clicked a bad link six months ago and never realized their inbox was being watched. Because that’s the thing: the attacker doesn’t do anything right away. They just… read. They learn everyone’s names, follow the deal timelines, figure out who trusts who.
When a closing date gets close, they strike. They send new wiring instructions from an email address that looks identical to the real one. Sometimes they’re actually using the real person’s compromised account. The buyer wires $350,000 to what they think is the title company. The money lands in the criminal’s account. Gone.
The FBI’s latest IC3 Report put total cybercrime losses at over $16 billion last year, up 33% from the year before. Business email compromise, which is the technique behind most of these real estate scams, is consistently one of the most expensive categories.
It got bad enough that the Utah Division of Real Estate launched a whole statewide awareness campaign about it.
Why Real Estate, Specifically?
If you wanted to design an industry that’s perfect for wire fraud, you’d probably end up with something that looks a lot like real estate:
Huge wire transfers are totally normal. Nobody questions a $300,000 wire during a closing. There’s always time pressure (“we need to fund by 3 PM or we lose the house”), so people rush through verification. You’ve got five or six different parties involved in every transaction, each one a potential weak link. And somehow, despite everything, most of this still gets coordinated over regular email.
The National Association of Realtors reported over 13,000 victims in the real estate and rental sector in a single year, with losses north of $213 million. That was a few years ago. It’s gotten worse since.
What We Actually See Out There
We work with small and mid-size businesses across Utah, and when we talk to real estate firms, the same gaps show up over and over:
Email accounts with no multi-factor authentication. Agents sharing passwords to the office MLS login. No email filtering that would catch a lookalike domain. (Quick test: can you spot the difference between [email protected] and [email protected]? One of those is a zero, the other is the letter O. Most people miss it.)
A typical brokerage might have 15 agents, all using their own laptops, their own phones, connecting from coffee shops and open houses. Nobody’s managing those devices. Nobody’s monitoring for weird login activity. One compromised agent account and the attacker has a front-row seat to every active transaction.
Zero monitoring for unauthorized inbox access. No alerts when someone logs in from a new country. Nothing.
So What Do You Actually Do About It?
Look, you don’t need to spend a fortune on this. But you do need to actually do a few things instead of just hoping it doesn’t happen to you.
Turn on MFA. Right now. Multi-factor authentication on every single email account. Not next quarter. Not “when we get around to it.” This week. Microsoft 365 and Google Workspace both make it pretty simple. This one step stops most account takeovers cold.
Verify wires by phone. Every time. Make it a firm-wide policy: before anyone sends a wire, they pick up the phone and call the title company or attorney at a number they already have on file. Not the number in the email. Not the number in the “updated instructions.” A number you looked up yourself. Print a card with this rule and give it to every buyer at the start of the transaction.
Get real email filtering. Your basic spam filter won’t catch a spoofed domain. You need something that flags lookalike addresses, detects unusual sending patterns, and quarantines sketchy attachments before anyone can click them.
Put some guardrails on agent devices. If your agents are accessing client financial data on the same laptop their kids use for YouTube, that’s a problem. Encrypted drives, automatic updates, basic endpoint protection. It doesn’t need to be complicated, but it needs to exist.
Show people what these scams look like. Forget the corporate security awareness PowerPoint. Pull up actual examples of wire fraud emails and show your team. When people see how real these fakes look, they start paying attention. One 30-minute session with real screenshots is worth more than a year of “don’t click suspicious links” reminders.
Know who to call when something goes wrong. The FBI’s IC3 has a Recovery Asset Team that can sometimes freeze fraudulent wire transfers. But you have to report it fast, within 24 to 48 hours. Have that number posted somewhere. Know the process before you need it.
This Isn’t Theoretical
The Utah Division of Real Estate didn’t put out a statewide warning because they were bored. This is happening to real firms, in real transactions, right now.
Most of the fixes are straightforward. MFA, phone verification, decent email security. The problem is that most firms just haven’t gotten around to it yet. They figure they’re too small to be a target, or that their title company has it handled, or that it won’t happen to them.
Until it does.
If you run a real estate business in Utah and you’re not sure where things stand, we do security assessments that take the guesswork out of it. No pressure. We’ll just tell you what’s covered and what’s not, and you can decide what to do from there.