Wire Transfer Fraud in Southern California Real Estate: How IT Security Stops BEC Attacks

A fraudulent change to wire instructions can divert a real estate closing payment in minutes. Business email compromise (BEC) can involve a spoofed address, a look-alike domain, or a real account that an attacker has taken over. Real estate, title, and escrow teams should combine technical controls with an independent verification process.

In brief: Confirm wire instructions using a trusted phone number obtained independently of the message, protect accounts with phishing-resistant MFA where possible, and monitor for suspicious sign-ins and forwarding rules. If a transfer may be fraudulent, contact the sending bank immediately and report it to the FBI's Internet Crime Complaint Center.

What does the FBI report?

The FBI reported approximately $2.9 billion in BEC losses across all sectors in 2023. Its earlier real estate BEC analysis reported approximately $446 million in real-estate-related BEC victim losses in 2022. These figures are based on reported complaints, not a complete count of all fraud. Neither establishes a Southern California ranking or a guaranteed recovery rate.

How can an attack unfold?

An attacker may steal credentials, monitor an inbox or transaction platform, and send altered payment instructions from a compromised account. Alternatively, the attacker may impersonate a participant using a look-alike domain or spoofed message. An authentic-looking thread is not proof that the instructions are legitimate.

Which controls reduce the risk?

1. Verify instructions independently. Call a known, previously verified number before sending funds or changing payment details. Do not use a number supplied only in the suspicious message.
2. Protect accounts. Require MFA, favor phishing-resistant methods where available, and review unusual sign-ins, session activity, and mailbox forwarding rules. MFA reduces risk but some methods can still be bypassed.
3. Authenticate email. Configure SPF, DKIM, and a suitable DMARC policy after identifying legitimate senders. DMARC helps receiving systems detect some domain spoofing; it cannot stop messages sent from an already compromised account or every look-alike domain.
4. Secure transaction platforms. Limit access, enable MFA, and review accounts and activity for services used to exchange closing documents.
5. Train and rehearse. Give staff a clear escalation path and practice verifying unusual payment requests, especially under deadline pressure.

Email filtering and sandboxing can help detect suspicious content, but no single control catches every attempt. The FBI's guidance recommends using a separate channel to verify changes in account information.

What should we do after a suspected fraudulent wire?

Contact the sending bank immediately and request a recall or other recovery action. Report the incident to the FBI at IC3 and follow the bank's and law enforcement's instructions. Preserve messages, transaction records, and relevant logs for investigation. Speed can matter, but recovery is not guaranteed.

Does antivirus or DMARC prevent account takeover?

No. Endpoint protection is useful against malware, but it does not by itself stop an attacker from using stolen credentials. DMARC addresses certain forms of domain spoofing, not the abuse of a legitimate mailbox. Layer account security, monitoring, and independent payment verification.

AdVran's cybersecurity services can help Southern California businesses review email security, identity controls, monitoring, and incident response procedures. Contact us to discuss your environment.

Related reading

• Phishing defense strategy
• Real estate IT services
• Compliance and risk management