Risk scenario / Microsoft 365

Closing-Day Wire Fraud: How Title and Escrow Firms Get Targeted

Harris Ejiofor, CISM – CyberShield Advisory

An illustrative scenario: a criminal watches a title company's email for weeks, then sends fake wiring instructions on closing day. How it happens and what stops it.

This illustrative scenario is fictional. The organization and people described are invented.

The situation

Lakeside Title & Escrow is a six-person firm that handles residential closings. Maria, an escrow officer, juggles a dozen files at a time, and most of the work happens by email: buyers, sellers, lenders, real estate agents and the firm's own staff trade documents and dates all day.

One morning Maria clicked a link in what looked like a shared-document notice and typed her Microsoft 365 password into a convincing sign-in page. Nothing seemed to happen, so she moved on. The firm did not require a second sign-in step, so the password alone was enough.

What the criminal did next

For three weeks nobody noticed anything. The criminal quietly read Maria's mailbox and set up a rule that moved any message containing the words "wire" or "payoff" into a folder she never opened. They learned which deals were closing, who the buyers were, how Lakeside worded its emails and exactly when money would move.

Two days before one closing, the buyer received an email from what looked like Maria's address. It explained that the firm's bank had changed and attached new wiring instructions on what appeared to be Lakeside letterhead. The tone matched Maria's earlier emails. The buyer, eager to close on time, sent the down payment to the new account.

How it came to light

On closing day the funds were not in Lakeside's account. Maria called the buyer, and within minutes everyone understood what had happened. The firm called its bank and the buyer's bank straight away, reported the fraud to the FBI's Internet Crime Complaint Center, and brought in help to secure Maria's account. Getting money back after a fraudulent wire depends heavily on how fast the banks are told, and it is never guaranteed.

Why it worked

One password was enough. Without multi-factor authentication, a stolen password gave full access.
Nobody watched for mailbox rules. A hidden forwarding or filing rule is a common sign of a compromised account, but no alert was set up.
Clients were not warned in advance. Lakeside had never told buyers, in writing and at the start of the deal, that it would never change wiring instructions by email.
There was no call-back step. Nobody phoned to confirm the new instructions using a number already on file.

What Lakeside changed

A second sign-in step for every account, starting with anyone who handles funds.
Alerts for new forwarding and inbox rules, reviewed the same day.
A written wire-fraud warning given to every client at the start of every file, repeated before closing.
A call-back rule: any change to payment instructions is confirmed by phone using a number from the original file, never a number in the email.

Questions for your firm

Could one stolen password open your escrow officers' mailboxes?
Would anyone notice a new rule hiding messages about wires?
Do your clients know, in writing, that you will never change wiring instructions by email?

Take the next step

Our free Microsoft 365 security assessment asks five quick questions, including whether everyone needs a second step to sign in, and shows where to start. It is a short check, not a full review of your settings.