Skip to main content
AAktoh Cyber
← Threat library

Business & household

Wire fraud at property closing

The largest single transfer most people ever make, redirected by an email that looks exactly like the one from the title company.

How it works

  1. 01Attackers monitor a compromised mailbox at a law firm, agency, or title company.
  2. 02Hours before closing, they send revised wiring instructions.
  3. 03Funds are moved through mule accounts within minutes of landing.

How to spot it

  • Verify wiring instructions by phone, using a number you sourced independently, every time.
  • Be most suspicious of last-minute changes — that timing is the whole plan.
  • Ask your bank about recall procedures before you send, not after.

How the fleet stops it

Plutus

Plutus flags changed wiring instructions and unverified beneficiaries before the transfer, and Psycher checks the sending thread for takeover signals. You get a plain verdict and a hold you can approve.