A residential closing is a perfect target for a fraudster. Large sums move on a known date, several parties exchange emails, and everyone is in a hurry. Attorneys and title agents sit in the middle, and attackers know that one altered set of instructions can redirect an entire purchase price.
The FBI's Internet Crime Complaint Center has highlighted real estate transactions as a common setting for business email compromise. This post walks through a closing from start to finish and shows where to put controls. It is general guidance for firm administrators, not legal advice.
Stage 1: intake and engagement
Set expectations early
Tell every client in writing at engagement that the firm will never email changed wiring instructions and that any wire request should be confirmed by phone with a known firm number. Put the same sentence in your email signature for closing matters.
Capture trusted contact information
Record phone numbers for the client, lender, title company and real estate agents from independent sources at intake, such as signed documents or official websites you look up yourself. These become the numbers you call to verify.
Secure the communication channel
Use a client portal or encrypted email for sensitive documents, and ask clients to avoid sending financial details from shared or public accounts. ABA Formal Opinion 477R discusses reasonable efforts to secure client communications.
Stage 2: incoming funds from buyers
Buyers are the most common victims, because they receive "wire instructions" that appear to come from the firm or title company.
- Send your real wiring instructions once, through a secure method, accompanied by a clear warning.
- Invite the buyer to call you at a known number to confirm before sending.
- Never accept a statement like "I'll just email it" for changed details.
- When funds arrive, confirm receipt with the sender by phone.
Stage 3: outgoing disbursements
Outgoing wires include payoffs to lenders, seller proceeds and payments to other parties.
- Obtain payoff letters and instructions from lenders through verified channels.
- Call the lender using a number from an independent source, not from the letter or email.
- Verify the account details by reading them aloud.
- Require the seller to confirm proceeds instructions by phone, ideally in an earlier meeting or at signing.
- Use two-person approval for every wire: preparer and approver.
- Document each callback with date, time, person and number.
Stage 4: internal controls at the firm
- Dual control on the bank portal, so no single employee can release a wire alone
- Bank-side protections such as payee matching, limits and new-beneficiary holds, which you should discuss with your bank
- Segregation of duties between those who handle instructions and those who approve
- Trust account reconciliation performed by someone separate from the person who posts transactions, consistent with your state's trust-accounting rules, which you should confirm with your bar
- Written procedures that all staff, including temps, have read
Stage 5: protecting the email environment
If attackers read your emails, they can time their fraud perfectly.
- Multi-factor authentication on every mailbox
- Alerts on new forwarding rules and suspicious sign-ins
- Lookalike-domain monitoring
- Regular review of mailbox permissions
- Staff training on spotting spoofed senders
Stage 6: closing day
Hold a quick check before releasing funds: Does each wire have a callback record? Did anything change in the last 48 hours? Does the second approver agree? If anything looks off, delay. A short delay is easier to explain than a lost purchase price.
If something goes wrong
Call your bank's wire or fraud department immediately and request a recall, then file with IC3, notify your cyber insurance carrier and involve the clients. ABA Model Rule 1.4 addresses communicating with clients about material developments, and Formal Opinion 483 discusses obligations after a data breach. Consult ethics counsel.
Practice the process
Run a mock closing with a staff member playing the attacker. Reward those who follow procedure and reflect any friction in revisions.
How we can help
Counsel Cyber helps law firms and closing offices secure email, set alerts and train staff on closing-day fraud. If you would like us to map these controls to your workflow, we can start with a short review.