Wire Fraud in NC Real Estate Closings: How to Protect Yourself

The threat in plain terms

Wire fraud in real estate works like this: a criminal compromises an email account, usually the agent's, the lender's, or the buyer's, monitors a pending transaction, then sends fake wire instructions at exactly the right moment. The buyer wires hundreds of thousands of dollars to a fraudulent account. By the time anyone notices, the money is gone.

The FBI's Internet Crime Complaint Center reports billions in losses from real estate wire fraud over the past several years. North Carolina is not immune.

Why NC's structure helps, but isn't enough

North Carolina's attorney closing system, combined with the Good Funds Settlement Act and IOLTA trust account rules, adds friction that frustrates fraudsters:

• Funds move to a regulated attorney trust account, not a generic escrow company
• Attorneys are State Bar-regulated with audited trust accounts
• Disbursement only happens after recording

But none of that protects you if you wire to the wrong account in the first place. Once funds leave your bank, recovery is rare.

How fraudsters actually attack NC files

1. Email compromise of an agent, lender, or buyer (often via a phishing link).
2. Quiet observation of the email thread, they read everything for days or weeks.
3. A spoofed email at the critical moment, often the day before closing, with "updated" wire instructions.
4. A copycat domain (rhythmlctitle.com vs. rhythmictitle.com) so signatures look real.
5. A follow-up call from a spoofed phone number to "confirm" the new wire.

The verification rules that actually work

1. Get wire instructions only from the closing attorney's office

Not from your agent. Not from your lender. The attorney is the one who controls the trust account. Wire instructions should come from them, and you should expect them.

2. Verify by phone using a number you find independently

Do not call the number on the email. Look up the firm's number on their website (typed by hand) or on a previous document, and call to verbally confirm the bank, routing number, and account number digit-by-digit.

3. Be suspicious of any "change" to wire instructions

Legitimate firms almost never change wire instructions mid-transaction. Treat any "updated wire info" email as fraudulent until proven otherwise, and call to verify.

4. Send a small test wire, when possible

Some buyers send a $1 test wire first, then confirm receipt by phone before sending the rest. It's a small cost for a massive safeguard.

5. Lock down email

Enable two-factor authentication on every email account in the transaction. Most wire fraud starts with a compromised email, usually one that lacked 2FA.

What to do if you suspect fraud

If you wired to the wrong account:

1. Call your bank immediately, request a wire recall.
2. Call the receiving bank if you can identify it.
3. File with the FBI's IC3 at ic3.gov within 72 hours, the FBI's Financial Fraud Kill Chain has recovered funds when reported quickly.
4. Notify the closing attorney and your local FBI field office.

Speed is everything. Funds wired domestically can sometimes be frozen within hours; international wires almost never.

Our standing rule

At Rhythmic, our wire instructions for any given file are issued once, in writing, from the closing attorney's office, and we expect every buyer to verbally verify them by phone before sending. If you ever receive an email from "us" changing wire instructions, assume it's fraud and call us.