Real estate wire fraud: a Canadian buyer's prevention guide

Section 01Why Canadian buyers are a high-risk profile

This guide applies to any Canadian who will wire funds to a US title company, settlement agent, or escrow account in connection with a Florida real estate purchase. That includes financed buyers wiring the cash to close, cash buyers wiring the full purchase price, and buyers wiring the earnest money deposit early in the transaction. The risk is highest at the cash-to-close stage because the dollar amount is largest.

This guide does not directly apply to Canadian buyers who fund through a US bank account they already control (for example, an existing Florida-based account with RBC Bank US, BMO Harris, or Natbank). In that scenario the buyer is moving funds within their own US footprint and the cross-border wire vector does not apply. The verification protocol still applies to the disbursement instructions but the cross-border recovery dynamics are different.

Three structural features make the Canadian-buyer profile attractive to fraudsters. First, Canadians wiring from a Quebec or Ontario bank to a Florida title company go through the SWIFT network or a correspondent-bank chain, which can compress the operational reversibility window from hours to minutes. Second, the Canadian originating bank has no easy way to validate the receiving Florida account against the title company's actual operating account; the bank only confirms that the routing number and account number reach a US depository institution, not that the account belongs to who the buyer thinks it belongs to. Third, the closing is happening in a different time zone with the buyer often signing remotely, which creates urgency and reduces the buyer's normal habit of phone-checking before acting.

Takeaway: the Canadian-from-Canada scenario is the exact buyer profile where every protective default of a domestic transaction has been weakened or removed. Compensate by running the manual verification protocol with extra discipline.

Section 02How real estate wire fraud actually works

The dominant attack pattern, repeatedly confirmed by IC3 case files, is business email compromise. The mechanics, in sequence:

Step 1: Reconnaissance. The criminal gains email access to one party in the transaction. The target is most often a title-company employee, a real estate attorney's paralegal, or the buyer's Realtor. Access is typically obtained through a phishing email weeks before the closing, harvesting login credentials, and silently monitoring the email account thereafter.

Step 2: Thread monitoring. The criminal reads inbound and outbound emails on the compromised account, identifying upcoming closings, the buyer, the loan amount, the closing date, and the language patterns used by the legitimate sender.

Step 3: Lookalike domain or thread injection. Two patterns occur. In the first, the criminal registers a lookalike domain (titlecompany-fl.com instead of titlecompany.com, with a single-character substitution) and sends the fraudulent instructions from there. In the second, the criminal sends the fraudulent instructions directly from the compromised account (no domain forging needed) and immediately deletes the message from the sent folder so the legitimate user never sees it.

Step 4: The wire-instruction email. The fraudulent email arrives at the buyer's inbox at the moment the buyer is expecting wire instructions: the day or hour the closing is finalized. The instructions look correct in every visible respect: title company logo, professional language, the closing date, the loan number, the cash-to-close amount. The only altered field is the receiving bank's routing and account number.

Step 5: The wire. The buyer initiates the wire through their Canadian bank, often online, often under time pressure. The Canadian bank confirms the wire has been sent. Settlement of the wire at the receiving US bank typically completes within an hour for SWIFT and within minutes for direct correspondent routing.

Step 6: Drain. The criminal moves the funds out of the receiving account, often into multiple downstream accounts, within hours. By the time the buyer learns the closing did not occur, the funds have left the originally-receiving bank.

The criminal exploits a structural weakness in real estate transactions: at the moment of cash to close, the buyer is expecting wire instructions, the seller is expecting funds, and the closing agent is busy. Everyone is primed to act, no one is primed to verify.

Takeaway: the fraud does not target a security flaw in any system. It targets the human moment of expecting an email and acting on it. That is the moment the protocol must intercept.

Section 03The verified threat numbers

Takeaway: the numbers are not hypothetical. Real estate wire fraud is the second-largest dollar-value cybercrime category in the United States, and freeze rates above 50 percent are achievable only when victims report within hours.

Section 04The five-step prevention protocol

The protocol is simple, deliberate, and non-negotiable. Run all five steps for every wire, including the earnest money deposit.

Step 1: Establish the verification phone number at the start of the transaction. When the title company or settlement agent is first identified, ask them in person or on a call already in progress: "What is the phone number I should call to verify wire instructions before sending funds?" Write that number on paper. Save it in your phone contacts under a name you will recognize. Do not rely on the signature block of any email. The signature block can be forged.

Step 2: Expect wire instructions only by secure portal or in-person, not by email. Many Florida title companies now use secure document-exchange platforms (Qualia, ResWare, Closinglock) for wire instructions. If your title company uses one, insist that wire instructions be delivered through it. If wire instructions arrive only by email, treat them with elevated suspicion regardless of how legitimate they look.

Step 3: Read the wire instructions carefully. Compare the receiving bank name, the routing number, the account number, and the beneficiary name to anything the title company has previously communicated in person or on the phone. Be alert to: (a) any change of bank from a previous communication, (b) a beneficiary name that does not exactly match the title company's legal name, (c) instructions to wire to an account at a non-Florida bank when your title company is Florida-based.

Step 4: Call the verification number from Step 1, not any number in the email. Phone the title company on the number you wrote down at the start of the transaction. Read the wire instructions back to them, line by line: bank name, routing number, account number, beneficiary name. Confirm each matches their records. Confirm the dollar amount. Confirm the closing date. Only after this call do you initiate the wire.

Step 5: Confirm receipt the same day. After your bank confirms the wire has been sent, call the title company again to confirm they have received the funds. If they have not, escalate within minutes, not hours. The first hour is the operational window where freeze action is most likely to succeed.

Takeaway: the protocol is a habit, not a gadget. Every wire, no exceptions, every time.

Section 05Red flags in the email thread

Six specific signals to flag and investigate before sending any wire.

Flag 1: Last-minute change of wire instructions. The single most common pattern. The buyer received initial wire instructions five days before closing. The day before closing, a second email arrives, often citing a "banking update" or "internal account change," with new instructions. This pattern is a fraud indicator until proven otherwise. Always call to verify.

Flag 2: Sender address that resembles but does not exactly match the legitimate domain. Look at the full address, not the display name. titlecompany.com is not the same as titlecompany-fl.com or titlecompany.co or titlecornpany.com (an "rn" substitution for "m"). Hover over the sender to see the actual address.

Flag 3: Urgency language not previously present in the thread. "Wire today by 3 pm to avoid delaying closing." "Lender requires the wire by end of day or interest rate will be lost." Legitimate closing emails are usually neutral in tone. Sudden urgency is a manipulation pattern.

Flag 4: Receiving bank in a state different from the title company's state of operation. A Florida title company normally wires to a Florida bank or a major national bank's domestic wire-clearing branch. Instructions to wire to a bank in a different state (Texas, California, New York) without prior explanation are worth questioning.

Flag 5: Beneficiary name that is not the title company's legal name. The beneficiary should match the title company's legal entity name. A third-party beneficiary, even one labeled "trustee" or "escrow holder," is a fraud indicator.

Flag 6: An attached PDF instead of inline instructions. PDFs are easier to spoof at scale than text in an email body. If wire instructions arrive only as a PDF attachment, treat them with elevated suspicion and call before acting.

Takeaway: none of these flags is a definitive proof of fraud. Each is an instruction to make a phone call. The cost of an unnecessary call is two minutes. The cost of an unverified wire is six figures.

Section 06What to do in the first hour after a fraudulent wire

The window for recovery is short and the action sequence matters. Run all four channels in parallel, not sequentially.

Channel 1: Your originating bank. Call your Canadian bank's fraud department immediately. Request a wire recall and ask for the SWIFT message ID of the outgoing wire. The recall is initiated through the SWIFT network and is sometimes successful if the receiving bank has not yet released funds. Provide the bank with the destination account details from your wire confirmation.

Channel 2: The receiving bank. If you can identify the US receiving bank from your wire confirmation, call its fraud department directly and report the wire as fraudulent. Some US banks will place a hold on the receiving account on a same-day fraud claim, even before the FBI process kicks in.

Channel 3: The FBI Internet Crime Complaint Center. File a complete complaint at ic3.gov. Include the date, time, dollar amount, sending bank, receiving bank, beneficiary name, account number, routing number, and SWIFT details. The IC3 Recovery Asset Team uses this information to initiate the Financial Fraud Kill Chain with the receiving US bank. The FFKC achieved a 58 percent freeze rate in 2025 but the median time-to-freeze decreases sharply after 72 hours.

Channel 4: The Canadian Anti-Fraud Centre. Report to antifraudcentre-centreantifraude.ca. The CAFC coordinates with US law enforcement and feeds intelligence to FINTRAC. This channel does not directly recover funds, but it is required to support a future legal claim and any insurance recovery.

Takeaway: every minute counts. The objective in hour one is not investigation. It is freezing the receiving account before the criminal moves the funds downstream.

Section 07Cross-border recovery: US and Canadian channels

The legal recovery path depends on whether the funds were frozen and on the willingness of the receiving bank to indemnify the originating bank. Several scenarios are common.

Scenario A: Funds frozen at the US receiving bank within hours. If the FFKC succeeds, the funds are typically returned to the originating Canadian bank within one to four weeks, after a US court order or a voluntary release by the receiving bank. The Canadian buyer receives the funds back, less any wire fees and any FX losses on the round trip. This is the best-case scenario and depends entirely on speed of reporting.

Scenario B: Funds moved out of the receiving account but traceable. The IC3 may be able to follow the money through downstream accounts and recover some portion. The Canadian buyer typically does not recover the full amount and may need to engage a private cybercrime investigation firm. Recovery times measure in months, not weeks.

Scenario C: Funds converted to cryptocurrency or moved internationally. Recovery probability drops sharply. The buyer's options narrow to a civil suit against the title company (alleging negligent email security) or an insurance claim under any cyber-fraud or wire-fraud rider on the buyer's homeowner's policy or the title company's E&O policy.

Title company E&O insurance. Most Florida title companies carry errors-and-omissions insurance that may cover wire fraud losses caused by a compromise of the title company's systems, but coverage varies and litigation is often required to access it. Some Florida courts have held that the title company is liable when the email compromise originated on the title company's side; other cases have allocated loss between buyer and title company. There is no standardized rule.

Honest scope statement. This guide does not constitute legal advice on recovery rights. A Canadian buyer who experiences wire fraud must engage a Florida-licensed real estate attorney within days, not weeks. Provincial cross-border counsel familiar with FINTRAC reporting may also be necessary.

Takeaway: recovery is possible but is never automatic. Every step of the cross-border recovery chain requires legal action, evidence preservation, and persistence.

Section 08Common mistakes

Five recurring traps that turn a near-miss into an actual loss.

1. Trusting the email signature block as the source of truth for the title company's phone number. The signature block is part of the email. If the email is fraudulent, so is the phone number. Call the number you wrote down at the start of the transaction, or a number from the title company's website obtained on a separate device.

2. Assuming a domain ending in .com is automatically legitimate. Lookalike domains in .com are routinely registered by criminals. Look at the full domain character by character. A single substituted letter is the most common attack.

3. Wiring on a Friday afternoon or before a holiday weekend. This is a known criminal preference. The attack window is maximized when banks are closed and the buyer cannot easily reach a fraud-investigation team. Schedule wires Monday through Thursday morning whenever possible.

4. Treating the earnest money deposit wire as low-risk. The earnest money deposit is often the first wire in the transaction and is sometimes 5 to 10 percent of the purchase price (30,000 to 60,000 USD on a typical 600,000 USD home). The same protocol applies. Some criminals target this earlier wire because the buyer's verification habits are not yet established.

5. Not reporting a fraud incident because of embarrassment. The IC3, the CAFC, and the receiving bank cannot freeze what they do not know about. Reporting within hours is the single highest-impact action a victim can take. Embarrassment is misplaced. The fraud is sophisticated and well-resourced; failure to detect it is not a personal failing.

Takeaway: the loss often happens not at the moment of the fraud itself but in the failure to act in the hours that follow.

Section 09Pre-wire checklist

Twelve items, in order, before initiating any wire over 10,000 USD to a US recipient.

1. The verification phone number for the title company is saved in your phone contacts and was obtained at the start of the transaction, not from the email containing wire instructions.
2. The wire instructions arrived through a secure portal or, if by email, the sender domain has been verified character-by-character.
3. The receiving bank name, routing number, account number, and beneficiary name have been read aloud to the title company by phone using the verified number.
4. The dollar amount on the wire instructions matches the cash-to-close figure on page 3 of the Closing Disclosure or page 1 of the ALTA Settlement Statement.
5. The closing date and the wire date are confirmed.
6. The beneficiary name on the wire instructions matches the title company's legal entity name exactly.
7. The receiving bank is in the same state as the title company, or a national money-center bank, with no unexplained out-of-state routing.
8. There has been no last-minute change of wire instructions in the 72 hours preceding the wire.
9. The wire is being initiated on a business day, ideally Monday through Thursday morning, not late Friday or before a holiday.
10. Your Canadian bank's fraud-department phone number is saved and accessible.
11. The IC3 URL (ic3.gov) and the CAFC URL (antifraudcentre-centreantifraude.ca) are saved in case of need.
12. After the wire is sent, you have a calendar reminder to call the title company within two hours to confirm receipt.

Takeaway: the checklist takes ten minutes. The wire takes six figures. The ratio is in your favour.

Section 10FAQ

Can my Canadian bank refuse to send a wire if I express concern about fraud? Some Canadian banks will pause a wire on a same-day fraud concern raised by the customer, but it depends on the bank, the relationship, and the wire amount. Raising a concern in writing creates a paper trail that may help in a later dispute.

Are domestic Canadian wires (CAD-to-CAD) safer than cross-border wires? Within Canada, the Interac e-Transfer or domestic wire systems have somewhat faster fraud-resolution channels, but the BEC attack pattern is identical. The risk reduction comes from the fact that most Florida title companies do not accept CAD wires, so this is rarely an option for Florida closings.

Should I use a wire-fraud insurance product? Several US private products exist (CertifID, Closinglock) that title companies can offer to buyers. These are insurance-like wrappers around a verification service. Their utility depends on the title company adopting the system. Ask the title company at the start of the transaction whether they use one.

My title company says they have never had a wire fraud incident. Does that change my protocol? No. The protocol is not about the title company's history. It is about the moment of the wire. A title company that has never had a fraud is at most slightly less likely to have a compromised email. The buyer's exposure does not change.

My Canadian bank requires me to give the wire instructions over the phone or in branch. Does that change anything? No, in either direction. The verification protocol applies before the bank receives the instructions, not after.

Is FINTRAC reporting required for a 600,000 USD wire from Canada to the US for a home purchase? Banks initiating international wires of 10,000 CAD or more are required to report them to FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. The reporting is automatic and is not a fraud-prevention mechanism; it is an AML data-collection mechanism. The buyer does not need to do anything beyond completing the bank's source-of-funds questionnaire honestly.

If the wire goes to the wrong account, can my Canadian bank simply reverse it? No. International wires are not reversible by the originating bank's unilateral action once they have settled at the receiving bank. The originating bank can request a recall through SWIFT, but the receiving bank must agree to return the funds. This is why the FFKC matters: it provides regulatory pressure on the receiving bank to freeze and return.