Real estate wire fraud is the diversion of closing funds through a compromised or spoofed email thread, and the FBI does not count it where most of the industry looks for it. The 2025 IC3 report lists Real Estate losses at $275.1 million, but that category covers investment, rental and timeshare fraud. A diverted closing wire is coded as Business Email Compromise instead. That line reads $3.05 billion.
This is not a rounding difference. It changes which number a brokerage should be managing against, and it explains why so much published real estate wire fraud guidance aims at the wrong moment in the transaction.

Why the $275 million figure describes a different crime
When the FBI released its 2025 Internet Crime Report, the real estate press reported a single figure: $275.1 million in real estate fraud losses across 12,368 complaints, up from $173.6 million the year before. ALTA’s own April 2026 statement cited it. The figure is accurate. The label attached to it in most coverage is not.
Appendix B of the IC3 report defines the category precisely: Real Estate Fraud is “loss of funds from a real estate investment or fraud involving rental or timeshare property.” Read that definition twice. It says nothing about closing, escrow, settlement, title, or wire instructions. Its scope is investment property, rental scams and timeshare schemes.
Appendix C then sets the counting rule that makes this decisive: “Each complaint will only have one crime type.” There is no double-counting. A complaint lands in one bucket and one bucket only.
Where a diverted closing wire lands
The report answers this in its own case files. In March 2025 a Missouri senior closing on a property received a compromised email from the “title company” with instructions to wire more than $1.3 million. IC3 describes it as a BEC incident. In August 2025 a buyer closing on a home received email impersonating their attorneys and wired more than $449,000. IC3 labels that one BEC/Real Estate, a compound descriptor the report uses only underneath BEC, never underneath Real Estate.
So the answer is that real estate wire fraud sits inside the $3.05 billion Business Email Compromise line, mixed with vendor payment fraud, payroll diversion and every other flavor of email-enabled transfer fraud across the economy.
The FBI publishes no figure isolating the real estate share of BEC. The only quantified crossover anywhere in the 2025 report is 104 recovery incidents involving victims aged 60 and over. The industry has been managing real estate wire fraud against a number that describes timeshare scams, and the number that does contain its losses has never been broken out.
| IC3 category | 2025 losses | 2025 complaints | What it covers |
|---|---|---|---|
| Real Estate | $275,110,419 | 12,368 | Investment property, rental and timeshare fraud |
| Business Email Compromise | $3,046,598,558 | 24,768 | Email-enabled transfer fraud, including diverted closing wires |
What the 2025 numbers show when you read them correctly
Once the category is right, the real estate wire fraud trend inside it is more useful than the headline. BEC losses rose about 10% year over year, from $2.77 billion to $3.05 billion. Complaints rose faster, up 15.5% from 21,442 to 24,768.
Divide one by the other and the average reported BEC loss fell from roughly $129,193 in 2024 to about $123,005 in 2025, a decline of just under 5%. Those averages are our arithmetic on the FBI’s published totals; IC3 does not print them.
More attempts, slightly smaller average take. That is the signature of a threat getting cheaper to run rather than more surgical, and it is the opposite of the picture the $1.3 million case files suggest. At 24,768 complaints, BEC is reported roughly 68 times a day, and the average one still runs about 5.9 times the $20,699 average across all cybercrime complaints IC3 received.
The reconnaissance window
Nearly every piece of real estate wire fraud guidance written for consumers activates at one moment: call to verify before you send. That advice is correct and it is far too late.
By the time a buyer is looking at wire instructions, the attacker has usually been reading the thread for weeks. Call the gap between the first multi-party email on a file and the day funds move the reconnaissance window. On a typical purchase it opens within about 48 hours of contract acceptance and stays open until closing.
An attacker running this play does not need to break anything. They need three facts: who is authorized to send instructions, when money will move, and how much. None of those are secrets inside a transaction. All three are the coordinator’s ordinary work product, updated continuously, and assembled in one place.
In real estate wire fraud, a transaction file is not a target because it holds money. It is a target because it holds the schedule. Everything the standard playbook defends happens on the last day of a window that has been open for a month.
Where a transaction file leaks its schedule
Real estate wire fraud starts with schedule information escaping through ordinary, well-intentioned coordination. The common paths:
- Reply-all threads that carry buyer, seller, both agents, lender and title on one chain, so a single compromised mailbox exposes every party and every date.
- Calendar invitations naming the closing, the property address and the settlement agent, sent to external addresses.
- Status emails that state the exact figure due at closing before the Closing Disclosure is final.
- Auto-forwarding rules on a personal mailbox, the mechanism that turns one phished password into months of quiet access.
- Out-of-office replies that name a covering colleague, which hands an attacker a plausible identity to impersonate.
None of these are mistakes in any conventional sense. They are the coordination job being done. Which is why the fix cannot be “be careful with email.”
Controls that belong at file open
If the exposure starts at contract acceptance, the controls have to start there too. The real estate wire fraud controls that shift risk:
Establish the verification channel on day one. Capture a voice-verified phone number for the settlement agent and for the buyer at file open, recorded in the file, before anyone needs it. Verification fails on closing day because people improvise a number from an email signature.
State the negative up front. Send one message at file open saying wire instructions will never arrive by email and will never change. Any later message that contradicts it is then self-evidently false, which converts a judgment call into a rule.
Protect the earnest money deposit specifically. It is the first funds transfer in the file, it moves within days of acceptance, and it arrives before anyone has started thinking about closing security. Our guide to escrow and earnest money deposits covers the handling rules.
Keep the schedule off open threads. Dates and amounts belong in the system of record, not in reply-all chains. A complete audit trail also gives you something to reconstruct from if a thread is later disputed.
Re-verify on any change. A changed bank, a changed amount, a new sender, a sudden urgency: each is a trigger to call the number captured on day one. Urgency is the tell. It is manufactured because it works.
This is exactly the kind of control that decays when it lives in someone’s memory instead of the workflow. ReBillion runs as an AI control plane that orchestrates your stack, so verification steps sit inside the file itself rather than depending on whoever happens to be covering that day. You can see how that maps to your process on our pricing page.
State practice varies in ways that matter here. In attorney and escrow states the party who transmits final figures differs, which changes who must be verified. Our Florida transaction coordinator guide walks one such variation, and the master closing checklist covers where these steps sit in sequence.
If the money has already moved
Recovery from real estate wire fraud is more likely than the industry assumes, and it is almost entirely a function of speed.
The FBI’s Recovery Asset Team runs the Financial Fraud Kill Chain, contacting receiving banks to freeze funds. In 2025 the team worked 3,900 incidents covering $1.16 billion in attempted theft and froze $679 million, a 58% success rate. In the August 2025 case where a buyer wired more than $449,000 to an account controlled by someone impersonating their attorney, the recovery team reached the receiving bank and the full amount was still there, on hold.
The report gives no deadline and no minimum. Its instruction is “regardless of the amount lost, file a complaint” at ic3.gov, and its only timing language is that time is of the essence. Treat any published recovery deadline with suspicion; the 2025 report does not contain one.
The practical order: call the originating bank and request a recall, file with IC3 with full transaction detail, notify the settlement agent and broker, and preserve the email headers. Coordinators who have worked a live incident tend to describe the same failure, which is that nobody knew who owned the first call. Assign that in advance. Our compliance catch stories collect similar near-misses, and the closing timeline shows where funds movement sits relative to everything else.
Frequently asked questions
What is real estate wire fraud?
Real estate wire fraud is the theft of transaction funds by deceiving a party into sending money to an account the criminal controls, usually by compromising or spoofing an email thread and supplying fraudulent wire instructions that look like they came from the settlement agent, attorney or agent.
Why is real estate wire fraud not in the FBI real estate category?
Because IC3 defines Real Estate Fraud as loss of funds from a real estate investment or fraud involving rental or timeshare property, and assigns each complaint exactly one crime type. A diverted closing wire is classified as Business Email Compromise, so it appears in the $3.05 billion BEC total rather than the $275.1 million Real Estate total.
How much money is lost to real estate wire fraud each year?
No published figure isolates it. Closing wire diversion is counted inside the 2025 BEC total of $3,046,598,558 across 24,768 complaints, and the FBI does not break out the real estate share. Any single number presented as the annual cost of real estate wire fraud is an estimate rather than a reported total.
Who is targeted in a real estate wire fraud attempt?
The buyer usually sends the money, but the target is whichever mailbox reveals the schedule. Agents, coordinators, settlement agents and attorneys are all reconnaissance targets because their threads contain the parties, the closing date and the amount due.
Can a diverted wire be recovered?
Often, if reported immediately. The FBI’s Recovery Asset Team froze $679 million of $1.16 billion in attempted theft across 3,900 incidents in 2025, a 58% success rate. Recovery odds fall as funds move through second-hop accounts, so the first hours matter more than any other factor.
What should a transaction coordinator do first?
Capture a voice-verified phone number for the settlement agent at file open, send one message stating that wire instructions will never arrive or change by email, and name in advance the person who owns the first call if something goes wrong.









