Real Estate Closing Wire Fraud
Attack Trigger
Intercepted real estate email thread with substituted wire instructions days before closing
What Attackers Want
$50,000–$500,000+ (full down payment or closing cost wire)
How This Attack Works
Fraudsters compromise the email accounts of real estate attorneys, title companies, or realtors and monitor closing conversations. Shortly before closing day they send fraudulent wire transfer instructions from what appears to be a trusted party. Buyers wire their entire down payment or closing costs to the criminal's account.
Red Flags to Watch For
- ✗Wire instructions arrive by email without a follow-up phone confirmation call
- ✗Bank account or routing number differs from earlier documents
- ✗Sender email has a subtle typo or extra character in the domain
- ✗Instructions arrive at an unusual time or with atypical urgency
- ✗Title company or attorney cannot be reached by their known phone number to confirm
- ✗Any last-minute change to previously agreed wiring instructions
Known Malicious Domains
These domains have been associated with this attack. Never click links going to these addresses.
- title-escrow-wire.comMALICIOUS
- closing-instructions-update.netMALICIOUS
- realty-wire-confirm.comMALICIOUS
- escrow-closing-alert.netMALICIOUS
Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.
How Glance Stops This
- Domain similarity analysis catches lookalike sender addresses at millisecond speed
- SPF / DKIM / DMARC validation flags authentication failures before you ever see the email
- VirusTotal + Google Safe Browsing checks every link in real time
- Urgency language detection scores the email higher for manual review
- Known malicious domain blocklist updated continuously from live scan data
Don't wait to get hit.
Glance scans every incoming email against 12 detection layers — including the exact tactics described above — before it reaches your inbox.
Protect My Inbox — Free