AMDigitec InsightsKey takeaways
- Closing-fund fraud diverts client money by altering payment instructions at the last moment.
- It usually starts with a compromised or impersonated email account, not a technical hack of the firm.
- A firm rule, verified by phone and communicated to clients early, stops most attempts.
For a law firm, few emails are as dangerous as the one that arrives on closing day with updated payment instructions. It looks routine. The deadline is real. And if the instructions are fraudulent, the money is often gone within hours. This is real estate wire fraud, and it is one of the most costly risks a law firm faces.
How real estate wire fraud works
Criminals target transactions where large sums move on a predictable schedule. Real estate closings are the classic example, but any settlement or trust payment can be targeted.
- An email account belonging to the firm, the client or another party in the transaction is compromised or impersonated.
- The attacker watches the correspondence and learns the timing and the people involved.
- Close to the deadline, a message arrives with “updated” banking details.
- The funds are sent to the attacker’s account and moved on quickly.
The weakest point is rarely the firm’s technology. It is the moment someone trusts an email that changes where money goes.
Why law firms are attractive targets
- Large payments move on known dates.
- Many parties are involved: clients, other firms, realtors, lenders.
- Communication is often by email, under time pressure.
- Client trust and confidentiality are central to the firm’s reputation.
Get AMDigitec Insights by email
The controls that stop it
Good wire fraud prevention combines one simple habit with a few technical safeguards.
- A firm-wide verification rule. Payment instructions are never accepted or changed by email alone. Every change is confirmed by calling a known number.
- Tell clients early. State in your engagement or closing letters that the firm will never change payment instructions by email.
- Protect every mailbox. Multi-factor sign-in stops most account takeovers.
- Protect your domain. SPF, DKIM and DMARC make it harder to impersonate the firm.
- Share documents securely. A secure portal reduces reliance on email for sensitive documents.
- Train lawyers and staff. Everyone who handles closings should recognize the warning signs.
The single most effective control costs nothing: a clear rule that every change to payment instructions is verified by phone, and that clients know to expect it.
These controls also matter at renewal time: cyber insurers often ask how payment changes are verified.
If you suspect a fraudulent instruction
- Do not send the payment. If it has been sent, contact your bank immediately to try to stop or recall it.
- Verify with the client or counterparty using contact details you already hold.
- Secure any affected email account and check for unknown forwarding rules.
- Report the incident to your bank, the police and, in Canada, the Canadian Anti-Fraud Centre.
We cover how we help firms prevent this, including secure document signing and client file sharing, on our legal IT page. For a broader explanation of these attacks, see what business email compromise is, and how to stop it.
Common questions
Does this only affect real estate law?
Real estate closings are the most common target, but any practice that moves client funds on a schedule can be targeted.
Can stolen wire transfers be recovered?
Sometimes, but only if the bank is contacted very quickly. Funds are usually moved on within hours, so the steps above, starting with a call to your bank, matter more than anything else. Recovery is never guaranteed, which is why prevention comes first.
Is technology enough to stop it?
It helps a great deal, but the decisive control is a verification habit that everyone in the firm follows, every time.