How do wire fraud scams targeting real estate deposits usually work in Ontario?

Most real estate wire fraud starts with a compromised email account, either the buyer's, the seller's, or one of the lawyers', giving the fraudster a front-row view of an active transaction, including the names involved and roughly when a large transfer is expected. Armed with that information, the fraudster sends an email that looks like it comes from the lawyer, timed for right before a deposit or closing funds are due, containing new wire instructions that redirect the money to an account the fraudster controls.

Because the email often appears to come from a legitimate address, using a lookalike domain or an actually hacked account, and references real details about the transaction, it can look convincing enough that someone sends the wire before questioning it. Once the money lands in the fraudulent account, it is often moved out again within hours, which is why recovery becomes difficult very quickly. The defence that actually works is not spotting a fake-looking email, since sophisticated versions do not look fake, but verifying any wire instructions by phone, using a number obtained independently of the email, every single time.