Wire Fraud and Fake Sellers: The Two Ways Money Disappears From a Colorado Closing

There are two very different crimes that agents lump together as "wire fraud," and confusing them is how people get hurt.

In the first one, the buyer's money gets stolen. Somebody is reading the email thread, and at the right moment they send new wiring instructions. The money goes out and it does not come back.

In the second one, the property gets stolen. The seller is not the seller. They are a stranger with a convincing ID and a plausible story about why they can only sign remotely, and they are trying to sell a lot in Falcon that belongs to somebody who has never heard of them.

Different mechanics, different defenses, and the second one has gotten dramatically worse in the last two years. Here is what both actually look like from the title side, and what you can do about them.

Part one: wire fraud, where the buyer's money goes

The FBI's Internet Crime Complaint Center logged 1,008,597 complaints and $20.9 billion in losses in 2025. Business email compromise — the category that captures most closing wire fraud — accounted for 24,768 complaints and just over $3 billion. Real estate and rental fraud added 12,368 complaints and $275 million.

Those are reported numbers. A lot of this never gets reported at all.

How it actually happens

Almost nobody hacks the title company's wire system. What happens is far more boring and far more effective:

1. Somebody gets into an email account somewhere in the transaction. Often it is the buyer's personal email. Sometimes it is an agent's. Occasionally a lender's or a small brokerage's.
2. They do not do anything. They read. For weeks, if necessary. They learn the closing date, the parties, the tone everyone writes in, and roughly what the buyer is bringing to the table.
3. Right before closing, the buyer receives an email that looks exactly like the ones they have been getting. Same signature block, same formatting, right file number, right property address. Sometimes the domain is off by one character. Sometimes it is a reply inside the real thread from a compromised account, in which case the domain is perfect.
4. The email says the wiring instructions have changed. It often says something about a banking update, a new escrow account, or a security precaution. There is usually urgency attached.
5. The buyer wires. By the time anyone notices — typically at the closing table, when the funds are not there — the money has been pulled out and moved on.

The reason real estate is such a good target is not sophistication. It is that a large, irreversible, one-time transfer to a party the buyer has never met in person is completely normal in our business. There is no baseline of "we always wire to the same place" to break.

Red flags to teach your buyers

What they see	What it means
Wiring instructions arrive by email, or a "corrected" set arrives after the first	Treat every set of instructions from email as unverified, including the first one
A change to the account, bank, or beneficiary name close to closing	Legitimate changes this late are rare. Assume fraud until a phone call proves otherwise
Urgency — "wire today to stay on schedule"	Manufactured time pressure is the whole play. Nobody at my office will ever rush a buyer into wiring
A reply-to address that differs from the sender, or a domain off by one letter	Classic spoof. On a phone, the display name is all most people see
A phone number in the email for "verification"	Never call a number provided in the same email. That number is part of the scam
Instructions asking for a different name on the beneficiary account	Funds should go to the title company's escrow account, not an individual or a third party

The one rule that actually works

Verify wiring instructions by voice, using a phone number you already had, before sending a dollar — every time, including when nothing looks wrong.

Not the number in the email. Not the number in the signature block. The number off the business card, the company website, or the one already in their phone from the last three weeks of this transaction.

And have this conversation at contract signing, not at closing. By the time your buyer is looking at a settlement statement, the fraudulent email may already be sitting in their inbox. Warning them then is a week late.

It is also worth knowing how closing money is supposed to move in Colorado in the first place — see what "good funds" actually means.

Part two: seller impersonation, where the property goes

This is the one that has exploded, and it is the one most agents are still underestimating.

ALTA surveyed 245 title professionals across 40 states in spring 2026. The findings:

Measure	2024	2025–26
Firms that experienced at least one seller impersonation attempt during the year	28%	59%
Firms reporting an attempt in a single recent month	19%	45% (April 2026)
Firms reporting three or more attempts in one month	4%	23%

Among firms that experienced attempts, a quarter also reported paid claims. Of those who disclosed the cost, half were over $100,000.

What the fraudster is shopping for

They are not picking properties at random. They are looking for a parcel nobody is watching, with no lender in the file and no reason for anyone to drive by.

Target characteristic	Share of title pros calling it a common target
Vacant land	82%
Absentee or out-of-state owner	72%
Owned free and clear, no mortgage	68%
Recently deceased owner	55%

Think about what those four have in common. No lender ordering an appraisal. No payoff to request, which means no servicer to call. No occupant to notice a sign in the yard. An owner who may not see county mail for months. Ownership records that are public and free to search, including the mailing address that tells the fraudster the owner lives somewhere else.

The vacant land angle should sound familiar if you read the ILC versus survey post — vacant land is already the file type where the fewest people physically look at the property. That is exactly why it is target number one.

The behavioral red flags

Here is what title professionals flagged most often, and every one of these is something the listing agent sees before I ever do:

Red flag	Flagged by
Seller avoids meetings or phone calls — email and text only	89%
Requests a mail-away signing or supplies their own notary	88%
Cash transaction, no financing	87%
Property has no mortgage on it	86%

Any one of these alone is just a transaction. A seller who contacted you by email out of nowhere, will not get on a video call, owns a free-and-clear lot in a county they do not live in, wants a quick cash sale, and has a notary in mind already — that is not four coincidences.

Two more patterns worth knowing: a listing price noticeably under market, because the goal is speed rather than maximum proceeds, and a seller who pushes for proceeds to go somewhere unusual — a different name, a third party, or a foreign account.

Where it gets caught

87% of firms that detected fraud caught it during the clearance and curative process — in other words, in the title work, before closing. That is the system working, and it is one more reason to open title early rather than a week before closing.

94% of firms now use multiple detection tools, averaging more than five: identity verification, direct contact with the seller at an independently sourced number, and multifactor authentication lead the list.

The Colorado notary piece

"I'll use my own notary" is the request that should stop you, and Colorado's remote notarization rules are worth knowing because of it.

Under Colorado law, a notary performing a remote online notarization must be physically located in Colorado, though the signer can be anywhere. Identity has to be established by personal knowledge, a credible witness, or a government ID subjected to credential analysis plus at least one additional method such as knowledge-based authentication by a trusted third party. The session has to be recorded, with the signer's express written consent, and the recording has to be securely stored for ten years.

That is a meaningful set of guardrails. A seller who wants to route around it — a loose mail-away, a notary they found, an out-of-state online service nobody has vetted — is asking you to skip the exact control that catches this. When a seller insists on their own notary, that is a reason to slow down, not a scheduling preference.

If a wire already went out

Speed is the only thing that matters. The FBI's Recovery Asset Team and Financial Fraud Kill Chain froze $679 million of $1.16 billion in attempted theft across roughly 3,900 incidents in 2025 — a 58% success rate. That number is only achievable when someone moves the same day.

1. Call the sending bank immediately and request a wire recall, citing fraud. Do this before anything else, including figuring out what happened.
2. Ask the bank to initiate the FBI's Financial Fraud Kill Chain. It has been applied to transfers generally of $50,000 or more, reported within 72 hours. Criteria have shifted over time, so ask them to escalate regardless of whether you think it qualifies.
3. Call the receiving bank and request a freeze on the account.
4. Call your closing agent. We will notify the other parties and run our own response.
5. File a complaint at IC3.gov with the transaction details, and contact the local FBI field office.
6. Contact local law enforcement and get a report number.
7. Lock down the compromised account — change passwords, turn on multifactor authentication, and have the device checked. The intruder may still be reading the mail.

The 72-hour window is not a suggestion. Past it, recovery odds fall off a cliff.

What to say, word for word

Two scripts. Steal them.

To a buyer, at contract signing:

"Before we go further, one thing I say to every buyer. You will get wiring instructions before closing. Someone may also send you fake ones that look identical to the real thing, including the right file number and property address. So here is our rule: you will not wire a dollar until you call the title company at the number I am giving you right now, from their website, and have a human read the account details back to you. Not a number from an email. If anyone ever tells you the instructions changed, that is the moment to call me and the title company, not the moment to hurry."

To a prospective seller you have never met in person:

"Standard for me on every listing — I do a quick video call with the owner and verify ID before I put a property in the MLS. It protects you as much as it protects me. When are you free?"

A real seller says fine. A fraudster goes quiet, gets offended, or finds a reason it cannot happen. You will know quickly.

Where I can help

• Open title early on cash and vacant land deals. Most of these get caught in the title work. Title work that starts a week before closing has no time to catch anything.
• Owner verification before you list. Send me the address and I will pull the vesting deed and the mailing address of record so you know who actually owns it and where the county thinks they live, before you spend money marketing it.
• Straight answers on a seller who feels wrong. Call me. I would much rather spend twenty minutes on a hunch than deal with what comes after.
• Verified wiring instructions and a real human on the phone to confirm them for your buyer, every time, no matter how many times they ask.
• A class for your office. This makes for a good thirty minutes at a sales meeting, and it is more useful than most of what we get pitched.

• Email: ben.gosz@ctt.com
• Phone: 719.602.9431

This article is general information for real estate professionals and consumers, not legal advice. Fraud tactics change constantly, and the figures cited come from the FBI's 2025 Internet Crime Report and ALTA's spring 2026 seller impersonation study. If you believe you are the victim of a fraudulent transfer, contact your bank and law enforcement immediately rather than waiting for advice.

Frequently asked questions

Can a fraudulent wire be recovered?

Sometimes, and it depends almost entirely on speed. The FBI's Financial Fraud Kill Chain froze about $679 million of $1.16 billion in attempted theft in 2025, a 58% success rate — but that program generally requires the transfer to be reported within 72 hours. Call the sending bank and request a recall before you do anything else, then file at IC3.gov. Waiting a day to "figure out what happened" is how the money leaves for good.

How do I verify wiring instructions safely?

Call the title company by voice at a number you obtained independently — from their website, a business card, or the number already in your phone from earlier in the transaction — and have someone read the account details back to you. Never use a phone number that appears in the email containing the instructions. Do this even when the instructions look perfect and even when nothing has changed, because the whole point of the scam is that it looks perfect.

What is seller impersonation fraud?

A fraudster poses as the owner of a property they do not own, lists it for sale, and tries to close a quick cash transaction and walk off with the proceeds. They target vacant land, absentee owners, free-and-clear property, and recently deceased owners — parcels where nobody is likely to notice. ALTA's spring 2026 study found 59% of title firms experienced at least one attempt during the year, up from 28% in 2024.

Why is vacant land targeted so heavily?

82% of title professionals identified vacant land as a common target, and the reasons are structural. There is no occupant to notice a listing, usually no mortgage and therefore no lender or servicer in the file, often an owner who lives out of state, and no reason for anyone to physically visit. Ownership and mailing address are public record. It is the lowest-friction target in real estate.

What should I do if a seller insists on using their own notary?

Slow down. 88% of title professionals flagged mail-away signing requests and seller-supplied notaries as a red flag. In Colorado, a remote online notarization requires the notary to be physically in the state, requires credential analysis plus an additional identity method, and requires the session to be recorded and stored for ten years. A seller steering around those controls is steering around the exact thing designed to catch impersonation. Route the signing through your title company instead.

Does title insurance cover forgery and impersonation?

Forgery and impersonation are among the covered risks in a standard owner's policy, which is a large part of why the policy exists. That said, coverage depends on the policy, the facts, and who suffered the loss — and an owner with no policy on a free-and-clear lot has no coverage at all. Coverage is also a remedy after the fact, not a substitute for catching the fraud before closing. The better outcome is always detection during the title work.

Am I liable as the agent if my client gets defrauded?

That is a question for your broker and your E&O carrier, and the answer turns on facts. What I can tell you practically is that documented warnings help and undocumented verbal ones do not. Put the wire fraud warning in writing at contract signing, keep a copy, and do not ever send or forward wiring instructions by email yourself. Let the title company deliver them, and let the buyer verify by phone.

How can I protect a client who owns vacant land they are not planning to sell?

Practical steps: make sure the mailing address on file with the county assessor is current so notices actually reach them, sign up for any recording notification service the county clerk and recorder offers, have someone lay eyes on the parcel occasionally, and keep an owner's title policy in place. If they own it free and clear and live out of state, they are in the highest-risk category in the country right now, and it costs nothing to check the county record once a year.

When should title be opened on a cash deal?

Immediately. 87% of firms that caught seller impersonation fraud caught it during clearance and curative — the title work itself. Cash deals are where people are most tempted to compress the timeline, and they are simultaneously the highest-risk file type. A short closing window is fine. A short title window is where fraud gets through.