Every other risk in a rental purchase is reversible. A low appraisal can be rebutted. A title defect can be cured. A tenant who will not let the appraiser in can be worked around. Wire fraud is the one failure in the whole process that is close to permanent, and it is the one most investors have never actually planned for.
The pattern is boring and it works. Someone reads the email traffic around your closing, waits for the day the funds are due, and sends you instructions that look exactly like the ones you were expecting. You send. The money is gone within minutes, moved through two or three accounts, and by the time anyone notices, the recovery window has closed.
This is a business-purpose transaction, which means most of the consumer protections you may assume exist do not apply to you. Nobody is going to make you whole out of goodwill. The defense is procedural, it takes about ninety seconds, and almost nobody does it.
How the fraud actually happens
The compromise is almost never at your bank and almost never at the title company’s wire desk. It is in an email inbox, and usually the least protected one in the deal.
A closing on a rental has a lot of people in it: you, a listing agent, a buyer’s agent, a title or escrow officer, a paralegal, a lender’s closing coordinator, sometimes a property manager and an insurance agent. That is eight or nine inboxes, each with its own password hygiene. The attacker only needs one.
Once inside, they do not act. They read. They learn the closing date, the approximate cash to close, the names everyone uses, whether the escrow officer signs off with a first name or a full title, and whether your emails run long or short. Then, one or two days before funds are due, one of two things happens.
Domain spoofing. You get a message from a domain that is one character off the real one. A lowercase L in place of a capital I. An extra S. A dot-co instead of dot-com. On a phone, where the sender name displays and the domain does not, this is invisible.
Thread hijacking. Worse and more common on investor deals. The attacker replies inside the real thread from the real compromised account, with the real signature block and the real history quoted below. There is nothing to spot because nothing is fake.
The message says the wire instructions have been updated, or that the bank changed routing, or that a new account is being used for this closing. It often carries a light urgency: funds must be received by two o’clock to record today. That urgency is the tell, and it is the only tell you get.
Why investors are better targets than consumer buyers
A first-time homebuyer wires once, is terrified the whole time, and has usually been warned three separate times by three separate parties. An investor buying a fourth rental is a very different mark.
You close often, so a wire request is routine rather than alarming. You are frequently traveling or handling the closing remotely, so a signing that never happens in person raises no flags. You use an entity, so funds move from a business account where an unusual outbound transfer is less likely to trip a fraud alert than it would on a personal account. And your cash to close is bigger, so the payoff justifies the attacker’s time.
Add one more thing: investor closings involve more moving pieces. When there are already three legitimate reasons the numbers might change late, a fourth reason does not stand out.
The one rule that actually works
Call to verify, on a number you obtained independently, before you release funds. That is the whole defense.
The word doing the work is independently. Not the number in the email. Not the number in the signature block of the email. Not the number on the PDF attached to the email. If the inbox is compromised, every one of those is under the attacker’s control.
The number you call should come from one of these places:
- The title company’s website, typed into a browser yourself, not clicked from any message
- Your engagement letter or the signed purchase agreement, where the escrow officer’s direct line was recorded at the start of the deal
- A number you have already used successfully earlier in this transaction and saved to your phone
On the call, read the routing number and account number back digit by digit and have them confirm each one. Do not ask “are these instructions correct.” An attacker who has intercepted your call forwarding will say yes. Read the digits.
Second rule, equally short: instructions never change. Any mid-transaction change to wire instructions is fraud until proven otherwise, and it is proven otherwise only by a call to a number you sourced yourself. Legitimate title companies do occasionally change banks. It is rare, and they will expect you to verify.
What the title company does and does not do for you
There is a widespread assumption that the title company is somehow standing behind the wire. It is not.
The lender’s title policy insures the lender’s lien position. Your owner’s policy, if you bought one, insures your title to the property against covered defects. Neither one insures a payment you sent to the wrong account. That is not a title defect. It is a transfer you authorized. The fact that you were tricked into authorizing it does not change the mechanics.
Most title companies carry cyber liability coverage, but that coverage responds to their breach, not yours. If the compromised inbox was theirs and their controls failed, you may have a claim. If the compromised inbox was your agent’s, or yours, the coverage does not reach it. Either way, that is a claim, not a refund, and claims take months while your closing date does not wait.
What the title company will do is give you correct instructions and confirm them on a recorded line. That is genuinely valuable. Use it. Just understand that the obligation to verify sits with the person sending the money, which is you. If you want a broader look at what the policies in your file actually cover, we walked through it in what a lender’s title policy covers and why you want your own.
Your wire and the lender’s wire are separate problems
On a purchase, two wires arrive at the closing table. The lender funds the loan proceeds, and you fund the balance. They travel on completely different rails.
The loan proceeds move from a funding department to a settlement agent under a set of instructions the lender independently verified before the file ever reached the closing table. Those instructions are checked against a vetted list of approved settlement agents. This is the part of the transaction with the most controls on it, and it is almost never where a loss happens.
Your cash to close moves from your account, on instructions you received by email, under no verification other than the one you perform yourself. That is the exposed leg. The mechanics of how funding-side money moves are covered in more detail in our walkthrough of how loan funding and the wire at closing actually work.
One more exposure worth naming: the payoff wire on a refinance. If you are refinancing a rental, the settlement agent wires off your existing loan payoff. A fraudulent payoff demand letter, sent to the settlement agent on spoofed servicer letterhead, redirects that money and leaves the old lien unpaid and outstanding against your property. You will find out when the release never records. That is the same problem described in our piece on an old unreleased mortgage or judgment sitting on title, except self-inflicted and much more expensive.
What a misdirected wire does to the deal
Run the numbers on an ordinary rental so the size of this is concrete.
Say the purchase price is 285,000 dollars. You are putting 25 percent down, so 71,250 dollars, financing 213,750 dollars. Add roughly 9,500 dollars in closing costs, prepaid taxes and insurance, and reserves, and your cash to close is about 80,750 dollars.
The rent is 2,450 dollars a month. At a 7.25 percent rate on a thirty-year amortizing structure, principal and interest on 213,750 dollars runs about 1,458 dollars. Taxes at 3,600 dollars a year add 300 dollars a month, insurance at 1,500 dollars a year adds 125 dollars. That is a PITIA of roughly 1,883 dollars.
Divide 2,450 by 1,883 and the coverage ratio is 1.30. That is a clean file. It closes without a conversation.
Now lose the 80,750 dollars to a fraudulent account. The deal does not become a worse deal. It stops being a deal. There is no cash to close, the contract dies or goes into default, your earnest money is at risk, your rate lock expires, and the appraisal you paid for goes stale. The loan was never the problem. The ratio was 1.30 the entire time.
That is the thing worth sitting with. Investors spend enormous energy optimizing a ratio from 1.28 to 1.34 and almost none on the single event that can take the entire equity contribution to zero in one afternoon. If you want to see how the ratio side behaves under different assumptions, the DSCR deal calculator will show you that in about a minute. The wire side has no calculator. It has a phone call.
The first hour if it goes wrong
Speed is the only variable you control. Domestic wires can sometimes be recalled or frozen if the receiving bank is notified before the funds are dispersed onward, which usually means hours, not days.
- Call your bank immediately and ask for a wire recall on the basis of fraud. Use the words “fraudulent wire” and ask them to contact the receiving institution directly. Do not send an email and wait.
- File with the FBI Internet Crime Complaint Center at IC3.gov the same day. The Financial Fraud Kill Chain process can freeze funds at the receiving bank, but it works on a short clock and generally applies to larger domestic transfers reported quickly.
- Notify the title company and the lender. They need to know the closing is compromised, and the title company may have seen the same attacker on other files.
- Preserve everything. Full email headers, not screenshots. The header is what shows the actual sending server.
- Assume the inbox is still compromised. Move all further communication to the phone until you know which account was breached.
Recovery rates on wires reported within twenty-four hours are meaningfully better than on wires reported after seventy-two. That is the entire spread between getting the money back and writing it off.
A short pre-wire checklist
- Instructions received. Do not act on them yet.
- Phone number sourced independently, not from the message.
- Call placed. Routing and account numbers read back digit by digit and confirmed.
- Beneficiary name matches the title or escrow company exactly, not a similar name, not an individual, not a holding entity you have never heard of.
- Receiving bank is a domestic institution. Any request to route offshore stops the transaction.
- Send a test transfer first if your bank permits it and the timeline allows.
- Call again after sending to confirm receipt. Confirming receipt on the same day gives you the twenty-four hour window instead of finding out at recording.
If any part of this feels excessive, compare it against the number in the example above. Ninety seconds against 80,750 dollars is not a close call.
Where this sits in the rest of your closing
Wire verification is one item on a closing checklist that also includes prorations, escrow setup, and a signing process that may or may not happen in person. Those pieces interact more than people expect. Remote closings in particular remove the in-person moment where an escrow officer would hand you instructions and say them out loud, which is exactly the moment fraud used to get caught. If you are closing remotely or through an agent, read our piece on power of attorney and remote closings alongside this one, and confirm who is authorized to release funds before the day arrives.
It also helps to know what the final number should be before anyone emails you about it. If you already know your cash to close within a few hundred dollars because you understood the prorations, rent credits, and security deposit transfer, then an instruction asking for a materially different amount is obvious on sight. Fraud works best against people who do not know what to expect.
Working with us
FMC Capital is a Pittsburgh-based mortgage brokerage. We finance rental purchases, refinances, and rehab projects for real estate investors across Pennsylvania and a number of additional states, and we see the closing process from the funding side on every file we place.
Practically, that means two things for you. We verify our own settlement agent instructions before loan proceeds move, and we will tell you plainly which wire in your transaction is the exposed one and how to check it. If you want a second set of eyes on a closing that feels rushed, get in touch or call 412-990-2941. It is a faster conversation than the one that happens afterward.
If you are earlier than that and still sizing the deal, start with the DSCR deal calculator and our breakdown of DSCR loan requirements.
FMC Capital LLC, NMLS #1840537. This article is general information for real estate investors and is not legal, tax, or security advice. Loan terms, program parameters, and pricing vary by lender, property, and borrower profile and are subject to change without notice. Nothing here is a commitment to lend. Wire fraud procedures described are general best practices and are not a guarantee against loss. Consult your own counsel and your financial institution regarding funds transfer security. FMC Capital LLC, NMLS #1840537, equal housing opportunity.