Key takeaways

  • The FBI's 2025 Internet Crime Report counts 24,768 business email compromise complaints and about $3.05 billion in losses. Real-estate fraud adds 12,368 complaints and about $275 million.
  • FinCEN found that real estate is a top-three BEC sector because closings involve large wires, public information about the parties, email-only coordination and weak identity checks on instructions.
  • The best single control is a call to a phone number you already had, for every new or changed set of wire instructions, by someone other than the person who received the email.
  • Speed decides recovery. The FBI says time is of the essence: call the bank, ask for a recall and indemnification papers, and file at ic3.gov regardless of the amount.
  • Prevention is also technical: phishing-resistant MFA, mailbox-rule monitoring, and email authentication reduce the odds that the attacker is inside the conversation to begin with.

What business email compromise is

The FBI defines business email compromise (BEC) as a scam that targets businesses, or individuals who work with them, that regularly make wire transfers. The criminals compromise email accounts and other channels, such as phone numbers and virtual meeting tools, through social engineering or computer intrusion, and then trigger an unauthorized transfer of funds. In plain terms: someone convinces a person to send money to the wrong account, and the request looks like it came from a person they trust.

There are two common versions. In the first, the attacker breaks into a real mailbox, such as a paralegal's, a realtor's or a title officer's, and reads the thread until a payment is due. In the second, the attacker never gets in. They register a look-alike domain, copy the style of earlier messages and slip into the conversation. Both versions end the same way, with a message that says the account details have changed.

The numbers

The FBI's Internet Crime Complaint Center (IC3) published its 2025 report in 2026. It counts 1,008,597 complaints and $20.877 billion in reported losses across all crime types, a 26 percent rise in losses from 2024. BEC accounted for 24,768 complaints and $3,046,598,558 in losses. That is up from 21,442 complaints and about $2.77 billion in 2024, and about $2.95 billion in 2023. Only investment fraud caused larger losses in 2025.

Real estate is tracked as its own category. In 2025, IC3 recorded 12,368 real-estate complaints with about $275 million in losses, up from 9,359 complaints and about $174 million the year before. That category covers fraud involving rentals and real-estate investments as well as closing-wire scams, so it is not a pure count of closing fraud. It still shows the direction. The same report notes that victims aged 60 and over reported about $568 million in BEC losses in 2025.

IC3 also reports that businesses lost more than $30 million to BEC scams involving AI in 2025, and warns that chat generators can quickly create official-sounding messages that mimic a company's executives. The old advice to look for bad grammar no longer works. A fraudulent email can read perfectly.

Why closings and law firms are targets

FinCEN, the Treasury bureau that tracks financial crime, studied BEC reports from banks and published its findings in an updated advisory in July 2019. It found that the top three targeted sectors were manufacturing and construction (25 percent of cases), commercial services (18 percent) and real estate (16 percent). Its advisory singles out real-estate transactions as a particularly lucrative target and names three weak points in how closings usually run.

  • Detailed public information about transactions and the people in them, such as agents and homeowners, is easy to find.
  • Parties to the transaction communicate by email, so a single compromised mailbox exposes the whole deal.
  • There is often no strong process for verifying that wire instructions are real.

Law firms sit in the middle of this. A firm that handles closings, settlements, estates or escrow deposits holds client money, receives wire instructions from several outside parties, and is expected to move funds quickly. A law firm is also a good place to hide for an attacker who wants to watch a deal develop. The firm's mailbox shows who is buying, how much, and when the money is due. The FBI's 2025 report describes one case where a couple closing on a home received an email impersonating their attorneys and sent more than $449,000. The firm's own mailbox does not need to have been breached for this to happen. A spoofed look-alike is enough.

What the attack looks like in a closing

The sequence is usually the same. Reconnaissance: the attacker learns a closing date and the names involved, either from a hacked mailbox or from public listings. Contact: a message arrives, close to the closing date, saying that the title company or law firm has changed banks and that the buyer should send funds to a new account. Pressure: the message stresses speed and may ask the buyer not to call because of a busy schedule. Wire: the buyer sends the funds. Cash-out: within hours the money is split across several accounts.

A version aimed at the firm itself asks the finance contact to change the account for a seller's payoff or a vendor's invoice. Another version impersonates a managing partner and asks an assistant to send a quick wire. FinCEN notes that impersonating executives, sometimes called CEO fraud, is common because it discourages the person who receives the instruction from questioning it.

Prevention that works

Start with process, then add technology. The process controls are cheap and they stop the most losses.

  • Call back on a known number. Treat every new or changed set of wire instructions as unverified until someone confirms them by phone using a number from the engagement letter, the contract or your own records, never from the email. The FBI and FinCEN both recommend verifying payment changes through a second channel.
  • Separate the roles. The person who receives instructions should not be the only person who confirms them. Large wires need two people, and the second person should see the call notes.
  • Give clients the rule in writing, early. State in the engagement letter and the closing packet that the firm will never change wire instructions by email and that clients should phone the firm if they receive such a message. Repeat it on the firm's email signature.
  • Use a short delay for first-time payees. A same-day hold on a new account, with a second confirmation, costs little against the size of a typical wire.
  • Watch for the look-alike domain. Register obvious variants of your own domain, and train staff to read the full sender address, not just the display name.

The technical controls reduce the chance that the attacker is inside a real mailbox. Phishing-resistant multi-factor authentication on email and remote access is the first step, because most mailbox takeovers start with a stolen password. Next, configure email authentication, meaning SPF, DKIM and DMARC at an enforcing policy, so that spoofed mail from your own domain is rejected by receivers. Third, audit mailbox rules and forwarding. A common sign of a hidden attacker is a rule that forwards or deletes messages that contain words such as wire, invoice or closing. Finally, log sign-ins and alert on impossible travel or new devices. Our articles on MFA and passkeys and on email authentication cover those steps in detail.

The first hour after a wrong wire

The FBI's guidance is blunt: if you discover a fraudulent transfer, time is of the essence. IC3 says to contact your financial institution immediately and request a recall of the funds, along with any indemnification documents the bank needs, then file a complaint at ic3.gov regardless of the amount. Different banks have different policies, so it helps to know in advance what yours will do.

The IC3 Recovery Asset Team runs the Financial Fraud Kill Chain, a process that works with banks and FBI field offices to freeze funds. In 2025 it handled 3,900 incidents, covering about $1.16 billion in attempted theft, and was able to freeze about $679 million, a 58 percent success rate. The report describes a 2025 closing case where the buyers sent more than $449,000 to an account named in a spoofed email from their attorneys. After an IC3 complaint was filed, the team asked the recipient bank to freeze the account and the bank confirmed the full amount was still there. Prompt reporting made the difference.

The American Land Title Association (ALTA) publishes a Rapid Response Plan for Wire Fraud Incidents, revised in March 2026. It opens with this line: time is of the essence, and every second and minute counts. Its ten steps are a good template for any firm that handles closing funds.

  • Alert management and your internal response team, including finance, IT, legal counsel and the underwriter.
  • Call the sending bank to request a recall and a hold-harmless or indemnity letter, ask it to start the Financial Fraud Kill Chain, and call the receiving bank's fraud department to ask that the account be frozen.
  • Tell the other parties to the deal, using known phone numbers, and confirm that further communication will go by phone.
  • File a complaint with IC3, with the transaction details and the email headers.
  • Report to local police, the FBI field office and the Secret Service.
  • Call the sending bank again to confirm the recall is in progress.
  • Document everything on a worksheet, then consider your insurer and outside counsel, review your incident response plan and email logs, and, if the money went abroad, retain a lawyer in that country.

Write your own version of this list before you need it, with the phone numbers on paper. When money is leaving, nobody wants to look for a bank's fraud line.

If you are a bank or title company: the regulatory view

FinCEN notes that BEC transactions are often irrevocable, which leaves banks and customers unable to cancel the payment or recall the funds, so catching the instruction before the wire goes out is the key. It asks banks to put the term "BEC FRAUD" in suspicious activity report narratives when a business is the victim, and to mark the cyber-event field. If your firm uses a bank's wire product, ask what call-back and hold options it offers on new beneficiaries.

A short checklist for a law firm

  • Is every wire instruction confirmed by phone, on a known number, by a second person?
  • Do clients receive a written warning about changed wire instructions at the start of the engagement?
  • Is phishing-resistant MFA turned on for email, remote access and the practice management system?
  • Does the firm's domain have enforced DMARC, and have look-alike domains been registered or monitored?
  • Are mailbox rules and forwarding reviewed on a schedule?
  • Is there a printed rapid response plan with bank fraud-desk numbers, the FBI field office and your insurer?
  • Have you practiced the plan once, with the whole team, in the last year?

How Clayton Cybernetics can help

Our team designs and runs defensive security programs for businesses, including law firms and companies that move client funds. That work covers identity and MFA rollouts, email authentication and hardening, mailbox monitoring, staff awareness exercises, and written response plans that name the people and the phone numbers. We can also test your process: a defensive exercise that sends a harmless, authorized look-alike wire request shows whether your call-back rule works under pressure. If you have just sent a wire you now doubt, call your bank first, then us at (305) 404-9404.

Sources

This article is general information, not legal advice. Duties of a lawyer or title agent who handles client funds depend on state rules, contracts and insurance. Confirm them with your counsel, bank and insurer. Figures come from the FBI IC3 2025 report and FinCEN's 2019 advisory. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity