Real Estate Wire Fraud — Escrow Intercept
Attack Trigger
Criminals compromise a real estate email thread and substitute fraudulent wire instructions days before closing
What Attackers Want
$50,000–$500,000+ (entire down payment or closing costs)
How This Attack Works
Attackers monitor compromised email accounts belonging to real estate agents, title companies, or closing attorneys. Days before closing, they inject a convincing email with updated wire transfer instructions routing the buyer's entire down payment to a criminal account. Once wired, funds are laundered within hours and are virtually unrecoverable.
Red Flags to Watch For
- ✗Wire instructions were updated by email alone with no simultaneous phone confirmation
- ✗Bank account or routing number differs from what appeared in earlier closing documents
- ✗The email domain has a single extra character or hyphen compared to the real company
- ✗Instructions arrive with unusual urgency or outside business hours
- ✗Title company or attorney cannot be reached at their previously known phone number
- ✗Any last-minute change to previously agreed wiring instructions — always verify by calling a known number
Known Malicious Domains
These domains have been associated with this attack. Never click links going to these addresses.
- escrow-wire-update.comMALICIOUS
- title-closing-wire.netMALICIOUS
- realty-closing-instructions.comMALICIOUS
- attorney-wire-confirm.netMALICIOUS
Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.
How Glance Stops This
- Domain similarity analysis catches lookalike sender addresses at millisecond speed
- SPF / DKIM / DMARC validation flags authentication failures before you ever see the email
- VirusTotal + Google Safe Browsing checks every link in real time
- Urgency language detection scores the email higher for manual review
- Known malicious domain blocklist updated continuously from live scan data
Don't wait to get hit.
Glance scans every incoming email against 12 detection layers — including the exact tactics described above — before it reaches your inbox.
Protect My Inbox — Free