# How to Verify Wire Instructions: A Callback Procedure for Title Companies URL: https://limehawk.io/reports/how-to-verify-wire-instructions Published: 2026-10-01 Author: Corey Watson, Managing Member Topic: Guides Read time: 6 min Call the payee at a number you had before the instructions arrived, never one from the email. Treat any emailed change as fraud until that call is done. > **TL;DR** You verify wire instructions with a phone call to a number you already had before the instructions showed up. The original contract, the order, your own file. Never the number in the email. A second person signs off before the wire goes. Any change to instructions that arrives by email is fraud until that call proves otherwise. Tell buyers all of this at contract, in writing, before anyone is in a hurry. IT makes the inbox harder to take over. It does not replace the call. The call is what stopped the loss in our own BEC case. - Lost in our BEC case: $0 ## How do you verify wire instructions? You call the payee at a phone number you got somewhere other than the message that delivered the instructions, and you confirm the account details out loud before any money moves. Not the number in the email signature. Not the number on the PDF. A number from the original contract, the order, or your own records from before this deal got urgent. That's the procedure. The [ALTA Outgoing Wire Preparation Checklist](https://www.alta.org/file/ALTA-Outgoing-Wire-Preparation-Checklist) puts it on two pages: where the instructions came from, how you verified them, and proof the money arrived. The line asking where you got the phone number carries a note in parentheses: "never use the phone number included in an email." Here is the version I write into a title agency's procedure: 1. **Record the source.** In person, mail, fax, email, or through a third party like the agent, attorney, or lender. Write it in the file. 2. **Get the number independently.** Use the contract, the order, or a number already on file. Write down where it came from. 3. **Call and confirm.** Payee name, bank, routing number, account number, amount. Write down who you spoke to and when. 4. **Second set of eyes.** One person prepares the wire, a different person authorizes it. ALTA's checklist has separate signature lines for the wire creator and the wire authorizer. 5. **Confirm receipt.** After it goes, call the payee and confirm it landed. Log the name and date. ## Is it safe to wire money to a title company? Yes, once you have confirmed the instructions by calling the title company at a number you got on your own. The wire isn't the weak spot. Email is. The FTC's [mortgage shopping guidance](https://consumer.ftc.gov/articles/shopping-mortgage-faqs) describes the scam exactly: "Scammers sometimes send emails impersonating your loan officer or another real estate professional, saying there's been a last-minute change." Their advice on wiring to the new account: "Don't do it — it's a scam." Real estate wire fraud isn't rare. The [FBI's 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) logged 24,768 business email compromise complaints and $3,046,598,558 in reported BEC losses for 2025. One case in that report: buyers closing on a home got an email impersonating their own attorneys and wired over $449,000 to the wrong bank. Title companies see it constantly. In [ALTA's 2025 cybercrime study](https://alta.org/news-and-publications/news/20250227-Title-Companies-Help-Mitigate-Risk-of-Wire-Fraud-ALTA-Cybercrime-Study-Shows) of 360 participants, more than 40% of title companies reported getting at least one email a month in 2023 trying to change wiring or payoff instructions. 13% said their customers had wired funds to a fraudulent account. ## What makes callback verification actually work? Where the phone number came from. That's it. A callback to the number in a fraudulent email reaches the attacker, and the attacker will happily confirm the account. The rules that make it hold: - **The number has to predate the request.** If it arrived in the same thread, it doesn't count. - **You place the call.** "Call me back at this number" is the attacker's line, not yours. - **Urgency is the tell.** "The closing moves today unless this goes out in an hour" is exactly when you slow down. - **Log it.** Who you called, which number, where the number came from, who answered. If it isn't in the file, it didn't happen. The call also covers the case your eyes can't. Checking the sender address only works when the email is spoofed. In [the BEC wire fraud case we responded to](/reports/bec-wire-fraud-incident-response), the attacker was inside the closer's real Google Workspace mailbox. The fraudulent instructions came from her actual account. The attacker also set filters to block mail from the firm's funding desk and a coworker who would have caught it, so any "are these new instructions real?" reply would never reach the people who could stop it. The address was right. Only a phone call to a known number would catch that. ## What should you tell buyers on day one? Tell them at contract, in writing, before anyone talks about money: we will never change wire instructions by email. If you get an email saying we did, it's fraud. Call us at this number before you send anything. The CFPB's [homebuyer one-pager on closing scams](https://files.consumerfinance.gov/f/documents/cfpb_mortgages-scams_one-pager.pdf) backs every part of that. It tells buyers to write down contact information for their real estate and settlement agents, to "Avoid using phone numbers or links in an email," and to "Beware of last-minute changes to the closing process." It even suggests choosing "a code phrase that only they will know." ALTA also publishes an unbranded [buyer rack card](https://www.alta.org/business-operations/marketing/unbranded/protect-your-money-from-closing-scams-when-buying-a-home-usa.pdf) you can hand out as-is. What I put on the buyer sheet: - Our main office number. Save it now. - The name of the person who will handle your closing. - We will never change wire instructions by email, text, or a phone call we start. - Before you wire, call us at the number above and confirm the instructions. - After you wire, call us again to confirm we got it. - If something seems wrong after you wire, call your bank right away and ask for a recall, then file a report at [ic3.gov](https://www.ic3.gov). ## What should happen when instructions "change"? Stop the wire and assume it's an attack until a callback says otherwise. 1. Don't reply to the email. If the mailbox is compromised, whoever sent it is reading the replies. 2. Call the payee at the number already in the file. 3. Bring in the second person who authorizes wires. 4. Tell your IT provider. Somebody's mailbox, yours or the other side's, may be compromised. If money already went out, move fast. The IC3 report says it plainly: "If you discover a fraudulent transfer, time is of the essence." Call your bank, ask for a recall, and file at ic3.gov with full transaction details. In 2025, the IC3 Recovery Asset Team worked 3,900 incidents and froze $679,013,183 of $1,163,919,846 in attempted theft, a 58% success rate. The [ALTA Rapid Response Plan for Wire Fraud Incidents](https://www.alta.org/file/ALTA-Rapid-Response-Plan-for-Wire-Fraud-Incidents.pdf) is worth filling out and printing before you need it. ## Where does IT help? The procedure catches the fraud that gets through. IT keeps less of it from getting through, and makes your own inboxes much harder to take over. The FBI's [BEC public service announcement](https://www.ic3.gov/PSA/2024/PSA240911) recommends using "secondary channels and/or two-factor authentication to verify requests for changes in account information." Here's what that looks like on the IT side: - **MFA enforced across the tenant, not just enrolled.** In our BEC case, the user had 2-Step Verification turned on, but the tenant didn't enforce it, and the attacker got in with the password alone. - **Hardware security keys for funding staff.** - **DMARC, SPF, and DKIM** so spoofing your domain gets harder. - **Email filtering** on every mailbox. - **Monitoring for new inbox rules, forwarding, and odd sign-ins.** These were the exact signs in our case. - **Training** for the closers who actually receive these emails. None of that replaces the call. Your filters can't see into the other side's mailbox. If the realtor or the lender gets compromised, the fake instructions come from a real address on a real thread. ## Key takeaways - Verification is only as good as where the phone number came from. If it came from the same email as the instructions, you called the attacker. - Every emailed change to wire instructions is fraud until a callback to a known number says otherwise. - Two people on every outgoing wire: one prepares it, one authorizes it. - Tell buyers at contract that you will never change wire instructions by email, and give them the number to call. - If money moves to the wrong account, call the bank for a recall and file at ic3.gov the same hour. Time is the whole game. ## What this looks like when we do it For the [title companies](/industries/title-companies) we support, the wire procedure is written down and the IT underneath it is set up to match. That means a documented callback-to-a-known-number rule before funds move, two people on every outgoing wire, and MFA enforced across the tenant. Funding staff get hardware keys. We set up DMARC, SPF, and DKIM and monitor for the mailbox rules and forwarding that show up when an account is compromised. And it's all documented for ALTA and underwriter review. When it went wrong for a client, the phone call made the difference. We called the opposite-side closer out-of-band with the correct details before the wire moved, and the firm lost $0. The full story is in [our BEC wire fraud incident report](/reports/bec-wire-fraud-incident-response). More on how we run [IT for title companies](/industries/title-companies) is on that page. If you want a second set of eyes on your wire procedure or your email security before your next closing, [book fifteen minutes with me](/contact).