← Articles and guides on fraud, cybersecurity, privacy and AML

BEC and real estate wire fraud in the US: how it works, how to stop it

Business email compromise cost US victims $3 billion in 2025. How BEC and real estate closing scams work, and the controls that stop wire fraud before it lands.

2026-10-16

A homebuyer receives an email that looks exactly like it came from their closing attorney: new wiring instructions, a polite tone, a deadline. They send the down payment. The money lands in an account controlled by criminals. Variations of this story, aimed at both families and businesses, are what the FBI calls business email compromise (BEC), and it remains one of the most expensive cybercrimes in the United States.

The numbers

Indicator (FBI IC3, 2025)	Figure
BEC complaints	24,768
BEC reported losses	$3.05 billion
Real estate fraud complaints	12,368 (9,359 in 2024)
Real estate fraud losses	$275 million ($173 million in 2024)
BEC losses among victims 60+	$568 million (4,566 complaints)

BEC losses are concentrated: about 2.5% of all IC3 complaints, but roughly 15% of all reported losses. Real estate fraud losses rose about 59% in a year, according to the National Association of Realtors' reading of the FBI data, though they remain below the 2022 peak of $397 million.

How BEC works

The FBI describes BEC as targeting businesses and individuals who regularly send wire payments. Criminals take over or impersonate email accounts, phone numbers or even virtual meeting tools, through social engineering or intrusion, to redirect payments.

Reconnaissance: scammers study who pays whom, when invoices are due and who approves transfers.
Access or impersonation: they phish an employee's credentials, compromise a vendor's mailbox, or register a look-alike domain.
The ask: a "CEO" asks finance for an urgent, confidential payment, or a "supplier" sends new bank details.
Cash-out: funds move quickly through mule accounts, often abroad, or are converted to crypto.

The FBI warns that criminals now use AI chat tools to write convincing emails that mimic executives, and voice cloning to request payments by phone.

The real estate variant

Home purchases are an ideal target: large one-time wires, many parties (buyer, agents, lender, title company, attorney) and emails flying in the final days before closing. A compromised agent or title mailbox lets criminals send instructions at exactly the right moment. NAR cites one case where a couple wired more than $449,000 after an email impersonating their attorneys; the funds were recovered only because the IC3 Recovery Asset Team froze them at the receiving bank.

Why BEC keeps working

BEC needs no malware and often no hacking at all: a convincing message at the right moment is enough. It exploits normal business processes such as vendor payments, payroll changes and closing schedules. Because wire transfers settle fast and are hard to reverse, a few hours of delay can make the difference between recovery and total loss. Older adults are also exposed: victims over 60 reported $568 million in BEC losses in 2025, and BEC and real estate cases were the second most common type among elder cases handled by the Financial Fraud Kill Chain.

Speed matters: the Financial Fraud Kill Chain

The domestic side of the Kill Chain accounted for 3,574 incidents and about $507 million frozen in 2025, and the international side for 326 incidents and about $172 million.

The IC3 Recovery Asset Team works with banks to freeze funds through the Financial Fraud Kill Chain. In 2025 it handled 3,900 incidents involving about $1.16 billion in attempted theft and froze about $679 million, a 58% success rate. The process works best when victims report within hours, before money leaves the receiving bank.

Controls that work

For businesses

Out-of-band verification: confirm any new or changed bank details by calling a number already on file, never one in the email.
Dual approval for wires above a threshold and for changes to vendor master data.
Phishing-resistant MFA on email, plus alerts for suspicious inbox forwarding rules.
Email authentication (SPF, DKIM, DMARC) and flags for external senders and look-alike domains.
Training on urgency and secrecy cues, including deepfake voice and video requests.
A rehearsed playbook: who calls the bank, who files with IC3, within what time.

For homebuyers and sellers

At the start of the deal, get the title company's or attorney's phone number in person or from their official site.
Treat any email that changes wiring instructions as fraud until verified by phone.
Call to confirm receipt immediately after wiring.
Brokers should provide regular wire fraud and AI awareness training to agents, NAR recommends.

Red flags in an email

A last-minute change to bank details or payment method.
Urgency combined with a request for secrecy.
A sender address that differs by one character from the real one.
A request to move the conversation to a personal phone or messaging app.
A voice or video call from an "executive" that cannot be verified on a known number.

If you have been hit

Call your bank immediately and ask for a recall of the wire. Policies vary, so ask what help they offer.
File at ic3.gov regardless of the amount, with full transaction details.
Secure the mailbox: reset passwords, review forwarding rules and check for other altered payments.
Warn counterparties who may receive follow-up fraudulent requests.