Wire Fraud and Earnest Money in Northern Virginia Real Estate: Risk Profile and Prevention

By Alltech National Title — Northern Virginia Practice  Published: 2026-05-07 · 8-min read

Real estate wire fraud is not a hypothetical risk in Northern Virginia — it is an active, documented threat that has cost buyers in the region tens of thousands to hundreds of thousands of dollars per incident. The FBI’s Internet Crime Complaint Center (IC3) consistently reports that real estate transaction fraud is among the highest-dollar categories of cybercrime, and high-value DMV markets are disproportionately targeted. This guide explains how the attacks work, why earnest money deposits are a particularly vulnerable moment in the transaction, and what buyers, agents, and lenders can do to protect their clients.

---

How the Attack Works

The typical real estate wire fraud attack in the DMV market follows a predictable pattern:

Step 1: Email compromise. The attacker gains access to an email account belonging to one of the transaction parties — most often the buyer’s agent, the listing agent, or the title company. This is usually accomplished through phishing (a fake login page that captures credentials), credential stuffing (using username/password combinations leaked in prior breaches), or compromising a shared inbox at a smaller brokerage or title office.

Step 2: Surveillance. Once inside the email account, the attacker does not immediately send fraudulent instructions. Instead, they monitor the inbox — sometimes for days or weeks — reading transaction emails, learning the parties’ names and communication patterns, identifying when closings are scheduled, and waiting for the optimal moment to insert fraudulent instructions.

Step 3: Fraudulent wire instructions. At the moment when wire instructions would normally be sent — when the buyer needs to wire earnest money to the title company, or when closing funds are due — the attacker sends fake wire instructions from the compromised account (or from a lookalike domain that differs by one character). The instructions look exactly like legitimate title company wire instructions, right down to the company letterhead and bank name.

Step 4: The wire. The buyer wires funds to the attacker’s account. The account is typically a money mule account — a domestic account controlled by a third party who has been recruited (often unknowingly) to receive and quickly forward the funds internationally. Once the wire lands and is forwarded, recovery is extremely unlikely.

Step 5: Discovery. The real estate closing approaches and the legitimate title company asks about the earnest money. The buyer produces confirmation of the wire they sent. Nobody has the money.

---

Why Earnest Money Is the Highest-Risk Moment

Earnest money deposits are disproportionately targeted in wire fraud attacks for several reasons:

The timing window is short and stressful. Earnest money is typically due within 1–3 business days of contract ratification — a period when buyers are emotionally invested in the transaction, operating under time pressure, and sometimes making financial transfers larger than any they have made before. That combination of urgency and emotional engagement reduces the buyer’s inclination to slow down and verify wire instructions through independent channels.

The title company’s name is already in the contract. The ratified purchase contract names the settlement company holding the earnest money. An attacker who has compromised any party’s email can read the contract, know who the title company is, and craft fake wire instructions on fraudulent “Alltech National Title” or “[other title company name]” letterhead with a real account number replaced by a fake one. The buyer has no reason to suspect the instructions are fraudulent if they appear to come from the right party.

Wire reversals are rare. Unlike credit card fraud, wire transfers are generally irreversible once the funds leave the originating institution. A buyer who calls their bank within hours of a fraudulent wire may be able to request a recall — but only if the receiving institution has not yet forwarded the funds, which in these schemes typically happens within minutes to hours of the wire being received.

High transaction values in Northern Virginia. The median home price in Northern Virginia substantially exceeds the national median. A 1–3% earnest money deposit on a $700,000–$1,000,000 Northern Virginia purchase represents $7,000–$30,000 or more in a single wire. The same attack infrastructure that might yield $2,000–$3,000 in a lower-cost market yields five to ten times that amount in Fairfax, Loudoun, or Arlington County.

---

The ePay Solution: Eliminating Wire Instructions Entirely

The most reliable defense against wire fraud on earnest money deposits is to eliminate the wire entirely — replacing the buyer’s bank-to-bank wire with a verified, portal-based deposit system where wire instructions are never transmitted by email.

Alltech National Title uses ePay, a secure online earnest money platform that routes earnest money deposits through a verified portal rather than through email wire instructions. The buyer receives a direct link to the ePay portal — through verified channels, not email — and makes the earnest money deposit directly through the platform. There are no wire instructions to intercept, no PDF attachments to forge, and no opportunity for a fraudulent set of instructions to be inserted into the transaction.

For buyers and agents using title companies that transmit earnest money instructions by email: that practice is a fraud risk regardless of how trustworthy and professional the title company is. The vulnerability is in the email channel, not the title company. Switching to a portal-based earnest money deposit eliminates the attack surface.

---

Best Practices for Buyers, Agents, and Lenders

For buyers:

• Never wire money based solely on instructions received by email, even if those instructions appear to come from your title company, real estate agent, or attorney.
• Call the title company directly — using a phone number you looked up independently, not one in the email — to verbally confirm wire instructions before sending any funds.
• If you receive wire instructions that differ from instructions you received previously, treat that as a red flag and verify immediately.
• Ask your agent and title company whether they offer a portal-based earnest money deposit option that does not require a wire.

For real estate agents:

• Use unique, strong passwords for your email accounts and enable two-factor authentication. Compromised agent email accounts are the most common attack entry point in DMV market fraud cases.
• Never forward wire instructions on behalf of the title company. If your buyer asks where to send the earnest money, direct them to call the title company directly rather than relaying instructions through your email.
• Inform buyers about wire fraud risk at the time of contract ratification — before earnest money is due — so they are prepared to verify independently rather than react under pressure.
• Work with title companies that have portal-based earnest money systems so the wire instruction vulnerability is eliminated for your buyers.

For lenders:

• Maintain verified, pre-established wire instructions for your settlement attorney and communicate those instructions through secure channels — not email.
• Implement a call-back verification protocol: before sending any large wire to a settlement attorney, call a verified phone number to confirm the wire details.
• Educate borrowers about wire fraud risk as part of your pre-closing communications. The same buyer who would not wire money to a stranger will wire earnest money without verification if they believe they are following instructions from a trusted party.

---

What to Do If You Suspect Fraud

If you believe you have sent a wire to a fraudulent account:

1. Call your bank immediately. Request a wire recall and ask about the status of the receiving account. Time is critical — the faster you act, the higher the chance the receiving institution can place a hold on the funds before they are forwarded.
2. File a complaint with the FBI’s IC3. Go to ic3.gov and file a complaint immediately. Include all wire details, the fraudulent instructions, and any email correspondence with the attacker’s account. The FBI’s financial crimes unit has a wire fraud recovery team (Operation Wire Cutter) that has recovered funds in some cases when notified quickly.
3. Contact your state’s real estate regulatory agency. If a real estate agent’s email was compromised, the Virginia Department of Professional and Occupational Regulation (DPOR) should be notified.
4. Consult legal counsel. Wire fraud victims may have claims against the financial institution that held the mule account, against agents whose email security failures enabled the fraud, or under other theories. Legal counsel with real estate fraud experience can help evaluate options.

Alltech National Title uses ePay for earnest money deposits on all transactions where buyers prefer a portal-based option — eliminating the wire instruction vulnerability for the earnest money transfer. For more information on our secure deposit process or to discuss a Northern Virginia transaction, reach us at (703) 934-2100 or info@alltechnational.com.

---

ATG Title is Alltech National Title’s DMV operating brand, serving Northern Virginia, Maryland, and the District of Columbia from offices in Haymarket and Fredericksburg, Virginia.