This is not legal advice. We are an IT and security provider, not a law firm. Every source is linked so you can read it yourself, and your counsel and your title underwriter have the final word on what applies to your firm.
A closing is an ideal target: a large sum, a fixed date, several parties who mostly know each other by email, and often a buyer who has never wired that much money before. A criminal does not need to break into a bank. One mailbox, or one look-alike address, and one person who trusts an email at the wrong moment is enough.
1. What the FBI’s 2025 report counts
The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, reporting $20.877 billion in losses, a 26% increase from 2024. These are losses victims chose to report, not an estimate of all fraud.
- Business email compromise (BEC), a scam in which a criminal takes over or imitates a trusted email account to redirect a payment, drew 24,768 complaints and $3,046,598,558 in reported losses, second only to investment fraud. By our arithmetic that is about 10% more than 2024’s $2,770,151,146.
- California led every state in both complaints (116,414) and reported losses ($3,674,716,305), across all crime types.
One figure is often misread. IC3’s Real Estate category rose to 12,368 complaints and $275,110,419 in 2025, from $173,586,820 in 2024, about 58% by our arithmetic. It is frequently described as closing-wire fraud, but the report defines it as “Loss of funds from a real estate investment or fraud involving rental or timeshare property.” The report’s closing-day examples, in its Recovery Asset Team section, are described as business email compromise incidents (one is labeled “BEC/Real Estate”). In one, a buyer “attempting to close on a property” received a compromised email from the “title company” containing wire instructions for more than $1.3 million to a fraudulent bank account. For a title or escrow office, BEC is the threat to plan around.
The report also notes that “Chat generators can quickly create official-sounding emails,” and that businesses reported more than $30 million in 2025 losses to BEC scams involving AI. A well-written email is no longer a sign that it is genuine.
Read the FBI’s 2025 Internet Crime Report (PDF) →
2. When a wire goes out, minutes matter
The FBI’s Recovery Asset Team, set up in 2018, works with banks and FBI field offices to freeze stolen funds through a process the FBI calls the Financial Fraud Kill Chain. In 2025 it acted on 3,900 incidents involving $1,163,919,846 in attempted theft and froze $679,013,183, which IC3 reports as a 58% success rate. In one of the report’s cases, people closing on a home wired more than $449,000 after an email impersonating their attorneys, and the receiving bank reported “the full amount was still in the account and on hold.”
The report’s advice is short: “If you discover a fraudulent transfer, time is of the essence.” Contact your bank and ask it to recall the funds, then file at ic3.gov with the full transaction details. ALTA’s Rapid Response Plan for Wire Fraud Incidents (version 2.6, March 3, 2026) lays out the order:
- Alert your internal team and your underwriter.
- Call the sending bank’s fraud department, ask for a recall, and ask it to initiate the Financial Fraud Kill Chain. Then call the receiving bank and ask it to freeze the account.
- Warn every party in the transaction, using phone numbers you already trust.
- File a complaint with IC3.
- Contact local police and the FBI field office.
Read ALTA’s Rapid Response Plan →
3. What ALTA Best Practices 5.0 asks for
The American Land Title Association (ALTA) publishes the Best Practices framework for title insurance and settlement companies. Version 5.0, approved by ALTA’s board on June 23, 2026, took effect October 8, 2026. It keeps seven pillars and makes Vendor Management a pillar of its own (Pillar 7). The wire controls sit in Pillar 2 (Funds and Escrow Trust Accounts) and Pillar 3 (Information Security and Privacy Plans):
- A written wire transfer procedure, tested at least annually (2.G). For outgoing wires it includes documented procedures to verify instructions “independent of the initial communication,” and those procedures “should include the use of multi-factor authentication” (2.G.1).
- A documented warning to consumers about the risks of wire fraud on incoming wires, with guidelines to mitigate losses (2.G.2).
- A written wire fraud response procedure that includes the Rapid Response Plan’s recommendations, reviewed at least annually (2.K).
- Positive Pay (the bank checks each check or payment against a list you approved) where available for the payment type (2.E), reconciliation of bank activity at least daily, and a three-way reconciliation at least monthly (2.M).
- Multi-factor authentication (a second proof of identity beyond the password), if available, for systems containing non-public personal information, or NPI (3.A.1); annual training that covers social engineering (3.B.4); and an incident response plan that is periodically tested (3.B.2).
In our reading, 2.G.1 rules out the two shortcuts people take under deadline pressure: replying to the same email thread, and calling the number printed in the email that asked for the wire. Neither is independent of the initial communication.
Read ALTA Best Practices 5.0 at alta.org →
4. The federal floor: the FTC Safeguards Rule
ALTA’s framework is an industry standard. The FTC’s Safeguards Rule (16 CFR Part 314) is federal regulation, and it states: “An entity that provides real estate settlement services is a financial institution.” Among other things, it requires:
- Multi-factor authentication “for any individual accessing any information system,” unless the person running your security program (the rule’s “Qualified Individual”) approves an equivalent or stronger control in writing.
- Encryption of customer information held or transmitted, and security awareness training for staff.
- A written incident response plan, and notice to the FTC “no later than 30 days after discovery” of an event involving the unencrypted information of at least 500 consumers.
Firms holding information on fewer than 5,000 consumers are exempt from a few provisions, including the written incident response plan (16 CFR 314.6). ALTA’s 2.K still asks for a written wire fraud response procedure, and the worst time to write one is during an incident.
