Title Office Guardby Haddad Solutions
(301) 202-1128 Free Exposure Report
Response guide

Wire fraud at a closing: what to do in the first hour

If closing funds were just wired to a criminal, speed is everything. Here are the steps to take right now, and what to have ready before it ever happens.

Updated October 7, 2026 ยท Title Office Guard

If this is happening right now: stop reading and call the sending bank's fraud department. Ask them to recall the wire and to request the FBI's Financial Fraud Kill Chain. Then come back to this list.

The first hour

These steps follow the American Land Title Association's Rapid Response Plan for Wire Fraud Incidents and FBI guidance. The FBI's wording is that "time is of the essence."

  1. Alert your management and response team. One person leads; everyone else supports.
  2. Call the sending bank's fraud department. Ask for a wire recall, ask what paperwork they need (often a hold harmless letter), and ask them to request the FBI's Financial Fraud Kill Chain. Call the receiving bank too and ask them to freeze the funds.
  3. Tell the parties to the transaction, using phone numbers you already know to be real. Do not use contact details from the suspicious email.
  4. File a complaint at ic3.gov, the FBI's Internet Crime Complaint Center. Include the full wire details and the email headers.
  5. Report to law enforcement: local police, your FBI field office, and the Secret Service.
  6. Call the sending bank again to confirm the recall was actually sent.
  7. Write everything down as you go: who you called, when, and what they said.
  8. Consider contacting your insurance carriers and attorney.
  9. Review your own systems: change passwords and check email logs for signs of a break-in.
  10. If the money left the country, ask counsel about engaging a lawyer in that country.

Why speed matters

Criminals move stolen funds out of the receiving account quickly, often within hours. The FBI's Recovery Asset Team works with banks to freeze funds before that happens. In its 2025 report, the Internet Crime Complaint Center said the team handled about 3,900 incidents and froze $679 million of $1.16 billion, a 58 percent success rate. The same report counted 24,768 business email compromise complaints with more than $3 billion in losses.

The FBI's guidance is to contact your bank immediately and to file at ic3.gov regardless of the amount lost.

Before it happens: be ready in advance

The agencies that recover money are the ones that didn't have to look anything up. ALTA Best Practices 5.0 calls for a written wire fraud response procedure, reviewed annually. Have these ready today:

  • The fraud department phone number for your escrow bank, printed and posted, not just saved in email.
  • A printed copy of the ALTA Rapid Response Plan and its worksheet.
  • A named lead and a backup who know they're responsible.
  • Known-good phone numbers for every party in each open file.
  • Email logging turned on, so you can tell afterward whether a mailbox was broken into. See signs your email has been hacked.

Prevent the next one

Most closing wire fraud starts with an email that appears to come from the title company. Two controls stop the most common versions:

And keep the human control: verify any change to wiring instructions by calling a number you already trust.

Sources

Common questions

What is the first thing to do after a fraudulent wire transfer?

Call the fraud department of the bank that sent the wire immediately and ask them to recall it. Ask for the documents they need (often a hold harmless letter) and ask them to request the FBI's Financial Fraud Kill Chain. Then contact the receiving bank and ask them to freeze the funds.

Can wired money be recovered after real estate wire fraud?

Sometimes, and speed is the deciding factor. In its 2025 annual report, the FBI's Internet Crime Complaint Center said its Recovery Asset Team handled about 3,900 incidents and froze $679 million of $1.16 billion in attempted theft, a 58 percent success rate. Report within hours, not days.

Where do I report real estate wire fraud?

File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov with full transaction details and email headers. ALTA's plan also calls for reporting to local police, your FBI field office, and the Secret Service.

Does a title company need a written wire fraud response plan?

ALTA Best Practices 5.0 calls for a written wire fraud response procedure that incorporates the ALTA Rapid Response Plan and is reviewed annually.

Keep reading

Email security guide7 signs your title company's email has been hackedHidden inbox rules, unexpected forwarding, sign-ins from unfamiliar places: how to tell if a title agency mailbox is compromised, and what to do first.Email security guideDMARC for title companies, in plain EnglishWhat DMARC is, why p=none doesn't stop anyone from sending email as your title company, and how to reach p=reject safely on Microsoft 365 or GoDaddy email.Compliance guideALTA Best Practices 5.0: the IT checklist for title agenciesWhat ALTA Best Practices 5.0 asks of your IT: the Pillar 3 written information security plan, MFA, and the Pillar 2 wire verification and fraud response rules.