CyberShield Advisory
Verifying Payment Instructions: A One-Page Guide for Title and Escrow Staff
A simple routine for every title and escrow employee: how to check payment instructions before money moves, and what to do in the first hour if something looks wrong.
The rule
Payment instructions are never accepted or changed by email alone. Every set of instructions is confirmed by phone, using a number you already had before the message arrived.
Before any wire goes out
- Find the original number. Use the phone number from the signed file, your firm's records or the other party's known website, never the number in the email or the attached letter.
- Call and ask open questions. Ask the person to read the account details back to you, rather than reading them out yourself.
- Compare carefully. Check the bank name, account number and routing number against what you were given at the start of the file.
- Get a second approval. A colleague checks the details and approves the wire before it is released.
- Write it down. Note who you called, the number you used, the time and what was confirmed.
Red flags that mean stop
- A "last-minute change" to banking details, especially close to closing.
- Pressure to hurry, keep it quiet, or skip the usual steps.
- An email address that is slightly different from the one you know, or a reply-to address that does not match.
- A request that arrives only by email or text, with an excuse for why nobody can talk by phone.
If something looks wrong
- Do not send the wire. If it has already gone, call your bank's fraud line immediately and ask them to contact the receiving bank.
- Tell your manager and stop any related payments on the same file.
- Report it to the FBI's Internet Crime Complaint Center (ic3.gov) as soon as possible.
- Assume an email account may be compromised. Ask IT to check for unknown sign-ins and hidden mailbox rules, and reset passwords.
Speed matters: the sooner the banks are told, the better the chance of stopping the money.
Take the next step
Our free Microsoft 365 security assessment asks five quick questions, including whether everyone needs a second step to sign in, and shows where to start. It is a short check, not a full review of your settings.
Related reading
- Before You Send That Wire Transfer: Could the Email Be Fake?
- Closing-Day Wire Fraud: How Title and Escrow Firms Get Targeted
- Protecting Client Funds and Closing Documents: A Checklist for Title and Escrow Firms