How closing attorneys stop wire fraud before the money moves

In South Carolina a lawyer has to oversee a residential closing, so the attorney's office is where earnest money, closing funds and payoffs move. That makes a closing firm's email address one of the most valuable things a scammer can borrow. Business email compromise, where a criminal poses as someone the victim already trusts and asks for a payment, is consistently among the costliest crimes reported to the FBI's Internet Crime Complaint Center, and real estate is one of its favorite targets.

Nothing below needs new software. Most of it is a few DNS records, one sentence on your website, and a rule your staff already half follows.

How the scam usually goes

1. They find the dealListings, recorded documents and social posts tell anyone which homes are under contract and roughly when they close. Sometimes the criminal is already inside a real mailbox: the buyer's, the agent's, or someone's at the firm, after a phished password.
2. They wait for the right momentThe email arrives a day or two before closing, when the buyer is expecting instructions and is anxious to get it right. It reads like every other email in the thread.
3. They change one detailThe message says the bank account changed, or the wire has to go out today because of a deadline. It comes from your real address, a near copy of it (one letter off), or the hacked mailbox of someone in the thread.
4. The money leavesA wire is hard to pull back once it lands. By the time anyone calls the firm to ask where the funds are, they've often moved on to a second account.

What we found on eight local law firm sites

In October 2026 we audited eight Grand Strand law firm websites, using only public pages and public DNS records. Four of the eight have no DMARC record at all, so nothing tells Gmail or Outlook to stop mail forged from the firm's domain. One more has DMARC set to p=none, which means watch it and deliver it anyway. Three send forged mail to spam. None reject it.

We also looked for the sentence every closing firm should print: that the firm will never send or change wiring instructions by email. Not one of the eight had it on any page we reviewed, including the firms that handle closings.

We aren't naming the firms. You can check your own domain in a few seconds with our free email forgery check.

Six fixes, in the order we'd do them

• Make your domain impossible to forge. Turn on DKIM at your email provider, make sure SPF lists every service that sends for you, then set DMARC to p=quarantine and, after a couple of quiet weeks, p=reject. That's what stops a message from your exact address arriving in a buyer's inbox when you didn't send it. Check yours here.
• Print the warning everywhere a client looks. On the earnest-money page, in your email signature, in the engagement letter and on the closing checklist. The wording is below. A buyer who has read it three times is much harder to fool.
• Never take a change of instructions by email, in either direction. If anyone emails new bank details, for a payoff, a seller's proceeds or a commission, call them at a number you already had before the email arrived. Write that rule down and train everyone who handles money on it, including the newest paralegal.
• Protect the mailboxes themselves. DMARC can't help when a criminal logs into a real account. Two-step sign-in on every mailbox at the firm closes most of that door. Once a month, look for forwarding rules nobody set up: a hidden rule that copies every email about closings to an outside address is a common sign someone is already in.
• Register the obvious look-alikes. The common misspellings of your domain and the other common endings (.net, .co) cost about $15 a year each. Point them at your real site, and you've taken them off the table.
• Send instructions through something other than email. A secure client portal, or a wire verification service that checks the account belongs to the person before money moves, means the instructions never sit in an inbox where they can be copied or altered.

The warning, ready to paste

Our firm will never send you new wiring instructions or change them by email, text or phone call. Before you wire any money, call us at [your main number] using a number from our website or your closing documents, not one from an email, and confirm the instructions with a person. If you receive an email asking you to wire money somewhere new, it is a scam. Call us right away.

Put your real number in the brackets, or use our fraud warning kit, which fills in your firm's name and number and gives you versions for your email signature and engagement letter too. Keep the line short enough that a client actually reads it, and put it near the button or link they use to send money, not only in the footer.

If a wire already went to the wrong account

1. Call the sending bank immediatelyAsk for the fraud department and request a wire recall. Give them the amount, the time it was sent and the receiving account. Every hour matters.
2. File with the FBI the same dayReport it at ic3.gov. The FBI works with banks to freeze stolen funds, and its chances fall quickly after the first day or two.
3. Preserve everythingDon't delete the email. Forward the full message, with its headers, to whoever investigates. Note every phone call and its time.
4. Find out how they got inCheck whether the email came from your real domain, a look-alike, or a hacked mailbox. The answer decides what to fix so it doesn't happen on the next closing.