AegisAI Perspectives · 070
Criminals target law firms in real estate wire fraud by posing as the title company in a closing thread, then emailing new wire instructions to clients.
Criminals target law firms in real estate wire fraud by posing as the title company or the firm and emailing new wire instructions; one such email moved over $449,000 in August 202514. FinCEN found title and closing parties are the identities most often impersonated12. AegisAI reads each thread for the sender's history, the change asked for and where the reply goes23, and the controls below cover the steps outside the inbox.
This page is the closing fraud detail behind the hub on email security for law firms. The hub sets out the firm's ethics duties; this page shows the real estate wire fraud attack step by step, then the seven controls that stop it.
Criminals run real estate wire fraud in four moves: research the deal, get a sending position, wait for the wire, then switch the account. The FBI reports victims at every level of the transaction, including title companies, law firms, agents, buyers and sellers1.
Money sent to domestic accounts is often drained fast, which makes recovery difficult7.
AI removes the grammar and spelling mistakes that used to expose a fake closing email. The FBI says criminals use AI-generated text to appear believable to a reader16. They use generative AI for translation to limit grammar and spelling errors. The 2025 IC3 report says chat generators quickly create official-sounding emails that carry directions to wire funds, and businesses reported over $30 million in 2025 losses to BEC involving AI15.
Because AI copies tone, the firm checks the account number and the payment method. FinCEN lists e-mailed instructions with different language, timing or amounts as a red flag10. A model can match the title company's language, but the new account number and the switch from check to wire remain. A look-alike domain can also pass SPF, DKIM and DMARC when the attacker publishes valid DNS records18. A green authentication result therefore proves nothing about the account in the email.
Put one sentence in every engagement letter and closing checklist: the firm never changes wire instructions by email. The FBI calls verifying every change in payment type or location the best defense4.
Confirm every set of wire instructions by phone, on a number from the matter file, never from the email. Agree a code phrase with the client at intake, known only to the two legitimate parties.
In Microsoft Defender for Office 365, add each title company and lender, plus the firm's own domain, to domain impersonation protection, up to 50 custom domains per anti-phishing policy19.
Each week, run Get-InboxRule with IncludeHidden on paralegal and closing staff mailboxes21. Look for rules that forward to unknown addresses or move mail to Notes, Junk Email or RSS Subscriptions. The page on how email account takeover works traces how those rules get set.
Treat a move from check to wire or a new beneficiary account as a hold until the callback in step 2 is done.
A request to wire money out of trust or escrow from a client's email gets the same callback, because the client's own mailbox can be the compromised one.
When a wrong wire leaves, call the firm's bank and request a recall, then contact the local FBI office and file at ic3.gov6. Revoke the active sessions on any mailbox involved, which invalidates access with the stolen password.
The same switch, run from a supplier's real account, is traced in how vendor email compromise works.
| Signal in the closing thread | What the criminal is doing | Control that stops it | Owner |
|---|---|---|---|
| Sender domain one letter off the title company's | Look-alike address that can pass email authentication | Domain impersonation protection, 50 domains per policy | IT |
| Real firm address, new instructions | Mailbox takeover to read client transactions | Weekly Get-InboxRule check with IncludeHidden | IT |
| Payment moved from check to wire | Redirect of the closing funds | Hold plus callback on a known number | Closing paralegal |
| Client asks for a trust wire by email | Compromised client mailbox | Callback and code phrase | Responsible attorney |
| Funds already sent | Account being drained | Bank recall, then FBI report | Managing partner |
Illustrative example, figures are fictional. A nine lawyer firm closes 30 residential deals a month. On a Tuesday, the buyer in one deal receives an email from an address one letter off the title company's, sent the morning wiring instructions were due. The email is well written, signed with the real closer's name, and moves $386,000 to a new account. Domain impersonation protection, set up in step 3, shows the buyer a warning. The buyer calls the number in the matter file, and the title company confirms its account never changed. IT runs Get-InboxRule on the closing paralegal's mailbox the same day and finds no new rule.
AegisAI reads the thread the way an analyst would: the sender's history, the change being asked for and where the reply actually goes23. Authentication can pass, so AegisAI does not rely on it, and the verdict rests on what the sender has sent before and on the request itself. A trial on your own tenant runs in monitoring mode on live mail with no MX change, then removal is turned on.
Track three numbers from the day the controls go live.
They pose as the title company or the firm in a closing thread, using listing site data to pick the deal. Then they email new wire instructions or a switch from check to wire. Title and closing parties are the most impersonated.
Yes. A look-alike domain with valid DNS records can pass all three, and AI-generated text removes the grammar errors that once gave it away. Confirm the account by phone, not by the email's authentication result.
Trust and escrow accounts hold client money in transit. FinCEN describes criminals using a client's compromised email to request wires from trust and escrow accounts the attorney manages. A callback before every trust disbursement closes that route.
Call the bank and request a recall, then report to the FBI and ic3.gov. Money in domestic accounts is often drained fast. In the August 2025 case the bank froze the full $449,000 after the report.
The FBI counted more than $275 million in real estate fraud losses from at least 12,368 victims in 2025.
