Real Estate Closing-Wire Laundering: The Money Arrived at a U.S. Bank First

Real estate business email compromise money laundering moves stolen closing funds through receiving accounts, onward transfers and conversion. The property transaction is real. An email impersonating someone involved in the closing redirects the payment, and a bank account receives money meant for someone else. If you work at the receiving bank, the closing-wire complaint may connect to account activity you already know: other suspicious payments, rapid withdrawals and an explanation that never matched the money.

A Real Closing, an Impersonated Participant

Real estate wire fraud exploits the large payments and communications that bring a closing together. In its March 2023 analysis announcement, the Financial Crimes Enforcement Network identified title companies, title agents, closing agents and escrow companies among the participants whose communications fraudsters exploit.

The payment request can look as though it comes from someone the recipient already trusts. The agency describes attackers gaining access to a key email account through computer intrusion or social engineering, then sending instructions that direct the funds into an account they control. The genuine transaction gives the false instruction its credibility. The buyer expects to send money, and the fraud changes where it goes.

Title and closing entities were the most frequently impersonated group in the study. The report distinguishes the party whose identity was used from the party that lost the funds: an attacker can impersonate one participant to defraud another. A title employee may recognize the instruction the company never authorized, while the purchaser knows which payment it induced.

The First Receiving Account Is Usually Domestic

The initial destination was usually a domestic depository institution in the Financial Crimes Enforcement Network’s study. That puts the receiving account’s history at the center of the laundering question:

For a bank employee, the useful connection is between the diverted closing payment and the customer relationship already documented inside the institution. Who opened the account, what activity the customer described and what happened after the wire arrived can explain how the account served the scheme.

The stolen payment arrived through the front door: an account at a U.S. institution. We look at what the bank knew about that customer and what it did when the complaint arrived.

The First Account Can Belong to a Mule

A romance-scam victim can supply the account used to receive somebody else’s stolen closing funds. The Financial Crimes Enforcement Network found that fraudsters recruited money mules through social media, dating sites and dating applications. Some victims described the fraudster to bank staff or law enforcement as a romantic partner, showing how completely they believed the relationship.

The report describes fraudsters directing romance-scam victims to open new bank accounts and send back the account information. Some victims used existing personal accounts. Others handed over online banking credentials, giving the fraudster direct access. The account then received funds diverted from the real estate transaction.

The report’s examples of instructions for moving the money included cash withdrawals, wires to another account, cashier’s checks, gift cards and convertible virtual currency. The account holder and the person directing those movements could occupy very different roles. A fake romance, a real closing. One deception supplied the account for another.

For an insider, the account holder’s explanation matters alongside the incoming wire. A customer describing a romantic relationship and a purchaser describing a closing payment may be explaining different ends of the same transfer. We connect those accounts with the payment records and instructions to understand who was directing the money.

One Account Can Receive More Than One Fraud’s Proceeds

The Financial Crimes Enforcement Network found that accounts associated with diverted closing funds could also receive proceeds from identity fraud, business email compromise in other industries and other cybercrime. A closing-wire complaint can therefore reveal a wider account pattern. The employee who knows the other incoming payments may see something the property buyer could never see.

The overlap also reached government money. The agency observed fraudulent unemployment assistance payments entering accounts associated with real estate business email compromise, and identified 137 incidents that also involved COVID-19 fraud. Those schemes included Paycheck Protection Program loan fraud. Buyers and taxpayers can be cheated through the same account.

This is where the account’s stated purpose becomes useful. Bank customer due diligence includes understanding the relationship, developing a customer risk profile and monitoring the activity. A personal account’s explanation, the incoming closing wire, the other payments and the destinations afterward belong in the same comparison. We examine how the institution understood that activity and what its staff did when the complaint brought the closing transaction into view.

From Bank Account to Payment Platform or Bitcoin

In several incidents the agency studied, the money quickly moved from bank accounts to online payment platforms or went into convertible virtual currency, most commonly bitcoin. Fraudsters sometimes instructed mules to buy virtual currency at U.S. or international exchanges. Conversion supplied another way to move the proceeds after the initial bank transfer.

The bank transfer and the exchange’s customer ledger can answer different questions about that movement. The bank records the payment, while the exchange ledger can identify the customer credited inside the platform. We connect those records to the instructions and the people controlling the funds.

Proceeds from investment scams also move through receiving accounts and conversion. Here, the payment begins with a genuine property closing, and the false instruction redirects it. That starting point gives the title, escrow or closing employee a specific contribution: what the payment was meant to accomplish and who was supposed to receive it.

What a Bank Insider Can Explain

A bank insider can connect a closing-wire complaint to the account’s earlier activity, its later transfers and the institution’s response. Customer-onboarding staff, payment operations employees, investigators and managers may each know a different part. We work with you to connect the customer explanation, the transactions and the decisions about them.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper Anti-Money Laundering: Opportunities for Improvement examines laundering channels through capacity, detection risk, simplicity, cost and speed. Applied to a closing wire, that framework gives us a practical question: what made the receiving account useful for moving the money onward?

An insider may know the warnings and monitoring decisions that accompanied the payments. That knowledge helps us examine both the account’s use and the controls around it.

The report on closing-wire fraud points to authentication of participants, authorization of transactions and verification of changed payment instructions as important controls. An employee who knows how the business actually handled those instructions can connect the written process to the payment that went through. We examine who received the complaint, what they learned about the receiving account and what action followed.

We assess the whistleblower program that fits the conduct with you, including the FinCEN whistleblower program. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. If government funds also passed through the account, speak with us about what you know of those payments and the bank’s response.

You Know What Happened After the Wire Arrived

If you work at a bank, title company or escrow business and know how diverted closing funds moved through an account, speak with our whistleblower experts about the payments and the response you saw. We build the case with you, connecting the closing instructions to the account history and the decisions inside the institution. We stay beside you throughout the case and bring in money laundering whistleblower lawyers who know bank and payment records.