The Single-Character Attack

Fraudsters register domains that are nearly identical to legitimate title companies: titlecompany.com → titiecompany.com (lowercase L replacing i) titlecompany.com → title-company.com (hyphen added) titlecompany.com → titlecomapny.com (transposed letters) atxclosingco.com → atxclosingco-secure.net (different TLD, added word) The display name in the email will show "Sarah Johnson, ATX Closing Co" — the fraudster has copied the legitimate agent's name and company exactly. Most email clients show the display name, not the domain, by default. The domain difference is only visible if the buyer clicks to see the full address. How the protocol defeats this: you call the number from the official website, not the email. It doesn't matter how convincing the email looks if you don't use it as your verification channel.

When the Email Is Real and Still Dangerous

In EAC attacks, the fraudster doesn't spoof anything. They hack the legitimate email account of a real party — most commonly the title company, real estate agent, or attorney. Then they send from that actual account. Your email filters see a legitimate sender. The domain is real. The previous email history appears in the thread. There is no technical indicator of fraud in the email itself. The email simply contains fraudulent wire instructions. How the protocol defeats this: the verification call is to a number from the official website — which the fraudster cannot intercept simply by controlling the email account. Even if the fraudster is sending from the real account, they cannot answer your call to the real office phone. This is why EAC attacks make the phone verification protocol not optional but absolutely required.

Inserting Into Your Real Email Thread

The most sophisticated BEC variant: the fraudster monitors your email thread, waits until a natural point of transition (title company confirms receipt of executed contract, or sends a status update), then sends a message that appears to be a reply in that thread from a spoofed address with virtually identical formatting. The email appears in the middle of a thread you trust, surrounded by legitimate communications. The context makes it look completely legitimate. The wire instructions are in a "P.S." or an attachment attached to an otherwise normal-looking email. How the protocol defeats this: any set of wire instructions, regardless of where they appear in the thread, triggers the same verification call to the independently-verified phone number. The protocol applies every time, unconditionally.

When the Phone Call Itself Is Faked

AI voice cloning technology allows fraudsters to clone a person's voice from as little as 3 seconds of audio (available on social media, voicemail recordings, or YouTube videos of agents, brokers, and title company staff). The attack sequence: (1) Buyer receives fraudulent email with fraudulent wire instructions. (2) Buyer calls to verify (smart). (3) Fraudster, who has compromised the title company's call routing or uses a spoofed number, answers or calls back with an AI-cloned voice of the legitimate agent or title officer. (4) The "verification call" appears to confirm the fraudulent instructions. (5) Buyer wires the money. The defense: you must call out, not receive a call back, using only the independently-verified number from the official website. Ask the person to confirm a specific transaction detail that only the legitimate party would have in their records: "Can you confirm the exact dollar amount and the property address in our file?" An AI voice impersonator who has not hacked the actual closing software cannot confirm those details accurately.

Creating Pressure to Bypass Verification

Even unsophisticated fraudsters can succeed if they create enough pressure to prevent the buyer from completing the verification protocol. Common urgency attacks: "If the wire is not received by 2pm today, your closing will be delayed" "The seller has indicated they will cancel if funds aren't confirmed by end of day" "Due to our banking partner change, funds sent to the old account will be returned, causing a 5-day delay" These messages are designed specifically to make the three-minute verification call feel like it would cost you the deal. The reality: legitimate title companies do not issue ultimatums over wire timing that would override standard verification practices. Any pressure to wire quickly without verification is itself a signal that something is wrong. The urgency is the attack.

“The question I get asked most by buyers who've heard about wire fraud: "Couldn't I just check the email address?" The honest answer: in 2026, no. Domain spoofing makes one-character differences almost invisible. Email account compromise means the real address sends the fraud. AI voice cloning means a callback can be faked. The only attack-proof verification is: call a number you obtained independently, before the attack happened, from a source the attacker cannot control. The title company's official website, obtained at contract signing, before any wire instructions arrive, is that source. Every other approach has a known attack vector. This one doesn't.”

— Ryan Brown, Principal Broker & CEO, Own Luxury Homes®

• Wire Fraud Hub
• Wire Verification Protocol
• Recovery Steps if Defrauded
• Closing Process Guide
• Buyer Closing Costs Guide

Own Luxury Homes® — wire fraud attack methods explained to every buyer before closing. 12-Point Agent Integrity Audit™. Request a verified buyer specialist ›