The FBI's 2025 Internet Crime Report recorded 12,368 real-estate complaints and $275.1 million in reported losses. Those numbers make one point clear for Sarasota and Manatee County closing teams: a last-minute change to wire instructions must be handled as a potential fraud event, not politely forwarded through an already-compromised mailbox.
Business email compromise (BEC) works because the message arrives in a familiar thread at the moment everyone expects money to move. The FBI explains that criminals can watch a real-estate transaction after gaining access to a participant's email, then redirect payment type or bank-account details. The technical controls in our ALTA wire fraud prevention guide reduce that exposure; this companion guide focuses on what the team does when the signal appears.
Recognize the trigger and pause the transaction
Make the rule simple enough to follow under deadline pressure: no one acts on changed wire instructions received by email alone. A sender display name, a familiar signature, and a reply in an existing thread are not verification. Fraudsters rely on all three.
- New or changed bank, routing, or beneficiary details
- An urgent request to bypass the normal approval path
- A message from a familiar contact with a different reply address or unusual wording
- A request to keep a change confidential or communicate only by email
Pause disbursement, preserve the email and headers, and call a previously known number from the closing file or an independently verified website. Do not call a number in the suspicious message. ALTA's wire-fraud guidance emphasizes preventive practices and consumer education at every stage of the transaction.
Use a response plan with named owners
First 15 minutes: contain and verify
The closing manager owns the business decision: hold the wire and notify the affected parties through verified channels. The technology owner preserves evidence, checks the sender mailbox for forwarding rules and suspicious sign-ins, and forces a password reset and session revocation if compromise is suspected. A managed security partner can isolate an affected workstation and investigate sign-in activity without turning the closing office into a crime scene.
First hour: contact the bank and report
If funds were sent, call the originating financial institution immediately and ask for its fraud or wire-recall process. Time matters. File an IC3 report and preserve the transaction details, bank information, sender/recipient addresses, and timeline. In a confirmed or suspected account compromise, engage counsel and your cyber-insurance carrier according to the incident plan.
Same day: protect the next closing
Do not treat a single incident as a single-email cleanup. Review mailbox rules, MFA coverage, administrator accounts, conditional-access policies, and every shared inbox involved in closings. Notify staff and active clients using approved language so another team member does not honor the same fraudulent instructions. This is also the moment to document decisions and timestamps for the insurer, counsel, and a future lessons-learned review.
Build a workflow clients can understand
Security should make a closing more predictable, not make clients decode technical jargon. Give clients the verification rule early: your office will not change wiring details by email, and they should call a known office number before initiating a transfer. Repeat it at milestones where urgency rises. The FBI's BEC guidance describes the impersonation pattern; clear, repeated client instructions interrupt it.
A protected workflow also needs reliable operations underneath it: managed Microsoft 365, enforced MFA, phishing-resistant credential practices, monitored endpoints, and tested backups. Those controls belong in a broader real estate IT program, not in a binder opened only after an incident. Sarasota teams can also use our managed IT services hub to evaluate the operational side of the control stack.
Three Things You Can Do This Week
- Publish a one-sentence wire-verification rule. State that no emailed wire change is valid until confirmed by a known phone number.
- Run a 15-minute tabletop exercise. Give the closing, escrow, and IT leads a mock changed-wire email and time how they pause, verify, and document it.
- Audit every closing mailbox. Confirm MFA is enforced, remove stale delegates, and review forwarding rules and shared-mailbox access.
Make the safe path the easy path
Real-estate BEC is designed to borrow trust from a legitimate transaction. A written, rehearsed response plan gives your team permission to slow down at exactly the right moment. It also gives buyers, sellers, and referral partners a clear reason to trust the closing process.
Author & technical scope review
Gregory Mathews
Gregory is the Systems Architect and founder of Suncoast MIS, with 15+ years of practical IT and systems architecture experience. He authored this article and reviewed its technical scope. Compliance and legal conclusions remain with each organization and its qualified advisors.