The Friday-Afternoon Email That Can Steal Your Down Payment

The email arrives on a Friday afternoon, days before closing.

It looks like it came from the attorney's office or the title company. The property address is right. The closing date is right. The amount matches what the buyer expects to bring. The message is short and helpful: there has been a change, and here are the updated wiring instructions.

The buyer sends the money.

By the time anyone realizes what happened, the funds may have moved through another account. A down payment that took years to save can disappear in a matter of hours.

Real estate wire fraud can succeed because a fraudulent email may look legitimate. It may arrive inside a familiar email thread and use details taken from the actual transaction. That is why the buyer should verify the instructions before sending the wire.

More Than $275 Million In Reported Losses Last Year

The FBI's 2025 Internet Crime Report recorded 12,368 real estate fraud complaints and more than $275 million in reported losses. The broader business email compromise category accounted for 24,768 complaints and more than $3 billion in reported losses.

Those figures reflect reports submitted to the FBI's Internet Crime Complaint Center. They do not mean every reported loss involved a Connecticut closing, and they do not capture crimes that were never reported. Even so, the reported losses are substantial, and these schemes can reach buyers, sellers, real estate agents, lenders, title companies, and law offices.

The same FBI report describes a 2025 incident in which people closing on a home received an email impersonating their attorneys and wired more than $449,000 to a fraudulent account. The message arrived when a request for money made sense. That timing is part of the scheme.

How A Closing Email Becomes Convincing

Business email compromise can involve a criminal gaining access to a legitimate email account or creating an address that closely imitates one. The criminal may then watch the transaction unfold.

They learn the names of the parties, the property address, the expected closing date, and the amount the buyer needs to send. They may see when the loan is cleared to close or when the final figures are circulated. Then they send instructions that fit the conversation.

The email may not contain the warning signs people associate with an ordinary scam. It may be well written, refer to real documents, and appear to come from a person who has already been emailing the buyer for weeks.

An email can look familiar and still be fraudulent.

Why Closing Day Creates The Opening

A real estate closing concentrates several pressures in one place:

• A large transfer that the buyer may never have made before
• A fixed date with movers, lenders, sellers, and attorneys waiting
• Several people exchanging documents and updated figures
• A buyer who has been trained by weeks of requests to respond promptly
• A transaction where a last-minute instruction may not seem unusual

The criminal uses that pressure. An urgent message leaves less time to study the sender's address, question a changed account, or call someone independently.

Closing delays can add to the risk because they create more messages and more last-minute adjustments. If your transaction has already moved off schedule, our guide to Connecticut real estate closing delays explains why the contract and written extensions still matter.

Verify The Instructions Through A Separate Channel

The safest habit is simple: never verify an email using contact information supplied by that same email.

Before sending closing funds, call the closing attorney or settlement office using a number you obtained independently. That may be a number from earlier paperwork, the firm's official website, or a contact you established before the wiring instructions arrived.

Confirm the receiving bank, account name, and instructions verbally. If anything has changed, ask why. Do not call a number contained in the changed message, click its link, or simply reply to the email thread. If an account has been compromised, the criminal may answer the reply.

The FBI's current business email compromise guidance recommends using a secondary channel to verify requests for changes in account information. A second email is still part of the same potentially compromised conversation, so verification should happen by phone, using a number that did not come from the message itself.

Treat Every Unexpected Change As A Stop Sign

An unexpected change in the bank, account number, account name, payment method, or timing should stop the wire until the closing office confirms it independently.

A legitimate change can happen, but the closing office should confirm it before the buyer sends any money.

The same caution applies when the message says the usual contact is unavailable, asks you to keep the change confidential, or creates a new deadline measured in minutes. Urgency and secrecy are useful to a criminal because both discourage verification.

A closing can be paused long enough to make a phone call. Money sent to the wrong account may be much harder to recover.

Ask These Questions Before Closing Week

Do not wait until the wire is due to learn how the process works. Ask the closing attorney or settlement office:

• How and when will I receive wiring instructions?
• What trusted phone number should I use to verify them?
• Could the instructions ever change, and how would a legitimate change be confirmed?
• Should I call again after wiring to confirm that the funds arrived?

The exact process may vary by office and transaction. What matters is having the answer before an urgent email appears.

If LoRicco Law is handling your transaction, we will explain how and when you will receive wiring instructions and how to verify them before you send any funds. If another office is handling the closing, ask that office to establish the same plan with you.

If The Wire Has Already Been Sent

If you believe the funds went to a fraudulent account, act immediately.

First, call your bank and ask for a recall or reversal of the wire. The FBI also advises asking about the documents the bank may need to contact the receiving institution, including a Hold Harmless Letter or Letter of Indemnity.

Second, file a detailed complaint with the FBI at ic3.gov. Include the banking and transaction information requested by the complaint form.

Third, notify the closing attorney and lender immediately. They need to know that the closing funds are at risk and that the transaction itself requires immediate attention.

Finally, preserve the evidence. Save the email in its original form, along with attachments, account information, transaction confirmations, text messages, and notes of every call. Do not delete the message just because it is fraudulent.

The FBI's recovery process has helped freeze funds in some reported incidents, but no process guarantees recovery. Reporting the fraud quickly gives the bank and law enforcement a better chance to freeze the funds.

Before You Send Your Closing Funds

Take the time to confirm exactly where the money is going.

Verify the instructions through a separate, trusted channel. Stop when an unexpected change appears. Confirm that the funds arrived. Those steps take minutes, and they are worth taking even when everyone is waiting.

If you are buying or selling property in Connecticut and need help preparing for a closing, speak with a New Haven real estate attorney before closing day. If something about a payment request feels wrong, pause before sending the money and contact our office.