The compromised mailbox need not be the buyer's, and that is what defeats the usual advice. A residential closing involves a real estate agent on each side, a lender, a settlement or escrow agent, a title company and often an attorney. Any one of those accounts is a viable entry point, and a professional's mailbox is more valuable than a consumer's because it contains many transactions with their dates and amounts. Once inside, the intruder reads until the closing date and the cash to close are known, then sends instructions that are correct in every detail except the account number. Advice built around the buyer's own password hygiene misses this entirely: the buyer's account can be perfectly secure while the scheme runs through somebody else's.
The timing structure is the mechanism, not an aggravating circumstance. Four features of a closing combine into an unusually exposed moment. The payment is large and its size is already known to everyone involved, so a six-figure transfer raises no suspicion. It is due on a specific morning, so the request is expected rather than a surprise. Wiring instructions legitimately do arrive by email late in the process, so a message containing them is normal. And the schedule has no slack: a buyer who pauses to verify risks the closing, the rate lock and, in some contracts, the deposit. A scheme that needs the target to act quickly without checking does not have to manufacture urgency here, because the transaction supplies it.
The one intervention that reliably works, and why it has to be phrased carefully. Confirm the instructions by telephone using a number obtained independently, from an earlier document, a signed agreement or the firm's published listing, and never a number contained in the same message as the instructions. A compromised account can reply to a "please confirm" email in the sender's own voice and can answer a number it supplied. The verification has to leave the channel that may already be compromised. That countermeasure is stated in the same terms on the wire transfer page, which is where the commercial-law reasons behind it belong.
Why the money is hard to get back, in one sentence with a pointer. A domestic wire is governed by state commercial law adopted from Article 4A of the Uniform Commercial Code, under which an order the customer authorized is the customer's order, and a cancellation is not effective once the beneficiary's bank has accepted it. A buyer who was deceived into sending the money has still sent it. The full machinery, including the refund rule that applies when a transfer is never completed, is on the wire transfer page.
What recovery actually looks like, described the way the FBI describes it. The Internet Crime Complaint Center runs a Recovery Asset Team, established in 2018, which operates a process it calls the Financial Fraud Kill Chain. The report's own description is that the team "streamlines communications with financial institutions and FBI field offices to assist in the freezing of funds for victims of fraudulent domestic and international transactions", that the domestic process can extend "beyond the initial recipient bank ... on 'second hop' transactions", and that the international process coordinates with the Financial Crimes Enforcement Network's rapid response team and with legal attachés abroad. In 2025 the team acted on 3,900 incidents involving $1,163,919,846 of attempted theft and froze $679,013,183, a success rate the report states as 58 percent.
The report also publishes a case that shows the shape. In March 2025 a Missouri victim, a senior citizen, "was attempting to close on a property and received a compromised email from the 'title company' containing wire instructions for over $1.3 million to a fraudulent bank account." The team froze the recipient account and found that wires from other victims had arrived in the same account. The following month an Oregon city government reported a separate loss of over $6 million to what turned out to be that same account, and because the earlier freeze was on record the receiving bank alerted the originating bank, which recalled the $6 million wire.
Two things follow that a reader can act on. First, the kill chain works often enough to be worth invoking, and it depends on the transaction details reaching the receiving bank while the funds are still there, which is a matter of hours. Second, the published figures carry no dollar threshold and no stated time window, so anyone quoting a minimum loss size or a fixed number of hours is adding something the FBI has not published. Report regardless of the amount and report immediately.
