// first 10 minutes

wire fraud at closing · title escrow — quick-start

wire fraud at closing — first 10 minutes. call the bank before headers. print this, check boxes, then run the primary tools.

checklist

call the originating bank's wire fraud hotline NOW — recall window is typically 24–72 hours and closes fast.
call the receiving bank's fraud line with the routing and account number from the wire confirmation — even if the bank is unknown.
file a complaint at ic3.gov immediately — financial institutions respond faster to IC3-flagged cases.
preserve the fraudulent wire instructions email as a .eml file — do not forward (forwarding rewrites headers).
preserve the legitimate closing instructions email thread from the title company — same .eml format.
export M365 or Gmail mailbox rules for the buyer, seller, and title agent — rules are often added to intercept and delete corrections.
pull sign-in logs for the title company email account — compromised accounts often show unfamiliar IPs days before the wire change arrives.
record the wire transfer confirmation number, originating account, receiving routing/account, and amount.
note the first email that introduced or confirmed the changed wire instructions — that's patient zero.
begin the primary tool path below — email header analyzer and mailbox rule exporter.

// first 10 minutes

wire fraud at closing — first 10 minutes. call the bank before headers. print this, check boxes, then run the primary tools.

call the originating bank's wire fraud hotline NOW — recall window is typically 24–72 hours and closes fast.
call the receiving bank's fraud line with the routing and account number from the wire confirmation — even if the bank is unknown.
file a complaint at ic3.gov immediately — financial institutions respond faster to IC3-flagged cases.
preserve the fraudulent wire instructions email as a .eml file — do not forward (forwarding rewrites headers).
preserve the legitimate closing instructions email thread from the title company — same .eml format.
export M365 or Gmail mailbox rules for the buyer, seller, and title agent — rules are often added to intercept and delete corrections.
pull sign-in logs for the title company email account — compromised accounts often show unfamiliar IPs days before the wire change arrives.
record the wire transfer confirmation number, originating account, receiving routing/account, and amount.
note the first email that introduced or confirmed the changed wire instructions — that's patient zero.
begin the primary tool path below — email header analyzer and mailbox rule exporter.