Closing Wire Fraud: How to Keep Your Down Payment
How closing wire scams work, the CFPB steps that stop them, and what to do immediately if a down payment or earnest money goes to the wrong account.
The cash you bring to closing is often the largest payment you have ever sent, and it usually moves by wire. That is the opening scammers use. The Consumer Financial Protection Bureau describes a pattern that shows up in the days before closing: an email that looks like it came from your real estate agent, settlement agent, attorney, or title company, with new instructions for where to send the down payment and closing funds. If you follow the email, the money can land in an account the scammer controls. Wires are built to be fast. Getting them back is not.
This is a habit problem with a short checklist, not a software problem. The Bureau's own guidance is a phone call to a number you saved earlier. Everything else in this guide is that idea, spelled out, plus what to do if the wire already left.
What the CFPB says is happening
In its article on mortgage closing scams, the CFPB, citing the FBI, reported that attempts of this kind rose 1,100 percent between 2015 and 2017, and that estimated losses in real estate transactions were nearly $1 billion in 2017 alone. Those figures are the Bureau's published account of that period. They are not a new measurement by this site, and they are not a forecast. The reason to read them is the shape of the crime, which the same article and the Bureau's one-page warning still describe.
Scammers try to get into, or convincingly imitate, the email of someone already on your transaction. They can see the property, the names, and the closing date, so the message does not look like a generic scam. It looks like the next ordinary email in a thread you have been having for weeks. The payload is a change: a new bank, an account "under audit," a cashier's check they no longer accept, a link, or an attachment with "updated wiring instructions." The CFPB's one-pager puts the timing in plain words. Days before closing, the message poses as your agent and changes where the funds should go. If it works, the money is hard to recover.
The same pattern can hit the earnest-money deposit earlier, as soon as there is a real file and a real amount to steal. The defense is the same, because the deposit is also a wire or a transfer to a company you have just met.
Why a wire is the target
Closing companies use wires because the money has to be in the right account on a specific day, in a form the other side can rely on. A wire that arrives and is withdrawn is difficult to reverse. That is a feature of the banking system, and it is why "I'll dispute it like a card charge" is not a plan. The CFPB's guidance treats speed as the reason to prepare before you need the instructions, not as a reason to hurry when an email tells you the instructions changed.
The Closing Disclosure will tell you the amount. The Bureau's Closing Disclosure explainer says cash to close is typically paid by cashier's check or wire, and that you should ask the closing agent how they want to be paid. The form does not authenticate an email. The person who can authenticate the destination is the settlement agent, on a phone number that did not arrive in the suspicious message. Our Loan Estimate and Closing Disclosure walkthrough is where that cash-to-close line is explained. This page is about not sending it to the wrong place.
Set the habit up before you are under contract
The Bureau's checklist is short because it has to be done early. Once the closing is tomorrow, every step that requires a calm phone call gets skipped.
Pick two people who can confirm payment instructions. The CFPB says to identify two trusted people, often your real estate agent and your settlement or closing agent. Talk with them in person or by phone, not by exchanging the details of the closing over ordinary email. Agree how wiring instructions will be delivered, and ask them what they would do if those instructions ever truly changed. Some buyers also agree on a code phrase that only those people know. A code phrase is optional. A saved phone number is not.
Write the numbers down from a source you chose. Use the purchase contract, a business card handed to you, or the company website you navigated to yourself. The CFPB's mortgage closing checklist includes a place to record those names and numbers. Do not harvest the number from an email signature you have not checked. Scammers copy signatures.
Decide where the money sits until that week. Keeping the down payment in an insured deposit account until you are ready to send it is a separate question from the scam, and it matters because the funds should not be in a volatile account in the same week someone is asking you to wire them. Our guide to where to keep a down payment covers that choice. The amount you are protecting is the down payment plus closing costs, not the down payment alone. The closing costs guide is the list of what else is in the wire.
The day you send the money
Treat any change as the red flag, not as a task to finish quickly. Title and escrow companies have a normal way to give you instructions. The CFPB's warning, and the industry teaching that sits beside it in the Bureau's own materials, is that a last-minute "our bank changed, use this account" message is the pattern, not a routine update. Stop.
Call your trusted contact at the number you saved. Read the account name, the account number, and the routing number. Ask them to confirm that those are the instructions they issued. If you are at the bank, ask the bank to confirm the name on the receiving account as well as the number. A matching number with a wrong name is not a match.
Do not use a phone number, link, or attachment from the email that announced the change. The Bureau says scammers copy the look of a real message, including a number you are invited to call "to verify." The person who answers that number can be the scammer. Forwarding a suspicious email to the real address you already know is safer than hitting reply, because reply can stay inside the fake thread.
Do not email your own account numbers, Social Security number, or photos of checks. The CFPB's instruction is that email is not a secure way to send financial information. That includes a helpful-looking request to "confirm your wiring details" by sending them back.
After you send the wire, call the saved number again and ask whether the money arrived. The point of the second call is time. A recall has a better chance if the bank and the title company know the same day, not the next morning when someone notices the closing account is short. The Bureau tells victims to contact the bank or wire service immediately and ask for a wire recall, and says that reporting quickly can raise the chance of recovery. Recovery is not guaranteed. The recall is still the first move, and it cannot start until you know the money is missing.
If you think it already happened
Do these in order, the same day.
- Call your bank or the company that sent the wire. Say you need a recall. Give them the transaction reference, the time, and the account you sent it to.
- File a report with the FBI's Internet Crime Complaint Center at ic3.gov. Include the emails, the account information you were given, and the wire details.
- Call your real estate agent, your settlement agent, and your lender, using the numbers you saved, not the numbers in the bad email. They may need to protect their own accounts, and they are the people who know whether the closing can still be completed.
- Keep the messages, including headers if you know how to view them, plus a note of who you called and when. Do not delete the thread because it is upsetting. It is the record.
Then tell us only if a page on this site was misused in the scam, for example a fake message that pretends to be DownPayment Desk. We will never ask you to wire money, and we will never ask for a routing number. Our contact page is for that report. It is not a recovery service. The bank and ic3.gov are.
What this is not
A careful buyer can still close. The scam depends on urgency plus trust in email. It does not depend on you avoiding wires forever. Many closings are completed safely with a wire that was confirmed by phone on a known number, sent a little earlier than the last possible hour, and confirmed received. Ask the closing agent whether a cashier's check is an option for part of the funds if their process allows it. Ask them once, on the saved number, not in a reply to a surprise email.
A HUD-approved housing counselor will not be the person who gives you the title company's account number. They also will not be the person in the urgent email. If you want a human who is not selling you the loan to talk through the closing timeline, HUD's counselor search is the public list: hud.gov/findacounselor, or 800-569-4287. Counseling is independent of the lender. It does not replace the phone call to the settlement agent about the wire.
Practical takeaways
- The CFPB's description of the scam is a convincing, last-minute change to wiring instructions.
- The Bureau's figures for 2015 through 2017 are a warning about scale in those years, not a live counter.
- Save two phone numbers before you need them. Confirm every wire on a saved number. Confirm that the money arrived.
- Do not use contact details that arrived in the message you are trying to verify.
- If the money went to the wrong place, call the bank for a recall and file at ic3.gov the same day.
Sources
- CFPB: Mortgage closing scams and how to protect your closing funds
- CFPB: Beware of mortgage closing scams
- CFPB: Mortgage closing checklist (PDF)
- CFPB: Closing Disclosure explainer
- FBI Internet Crime Complaint Center
Closing procedures vary by state and by settlement company. The loss figures above are the CFPB's, cited to the FBI, for 2015–2017. This article is for education only and is not legal or financial advice.
