How a Phone Call Stopped a Kitchener Closing-Funds Scam

The situation

James had spent four years putting money aside for a down payment, working shifts at a warehouse and living carefully. In the spring, he made an accepted offer on a modest freehold townhome in Kitchener, priced at roughly $345,000, from a seller named Fernanda who worked as an administrative assistant and was relocating for a new position. It was James's first purchase, made without a spouse or co-buyer, and he had never been through a real estate closing before.

He retained our team to act on the purchase shortly after the agreement of purchase and sale was signed. Closing was set for a date about six weeks out. In the weeks that followed, our office handled the usual steps: reviewing the agreement, ordering a title search, corresponding with the seller's lawyer, and preparing the statement of adjustments that shows exactly how much money James needed to bring to closing after his deposit and mortgage proceeds were applied. That figure came out to roughly $81,000, covering the balance of the purchase price, land transfer tax, and closing costs. James was told, as every client is told at the start of a file, that our trust account banking details would never change and would never be sent to him by email.

The fraud attempt

Two days before closing, James received an email that appeared to come from our office. It used a domain name that looked correct at a glance — one character had been altered, easy to miss on a phone screen — and it was signed by someone named Manuel, identified as a member of our accounting team. The email apologized for a last-minute change and provided new wire instructions for the closing funds, directing James to send the money to a different bank account than the one on file.

This is one of the most common frauds in Ontario real estate closings, and it is not unique to any one law firm, brokerage or lender. A residential purchase generates a long email chain touching a buyer, a seller, two real estate agents, two lawyers' offices, a mortgage broker and sometimes a lender directly. Criminals do not need to breach a law firm's own systems to run this scam — they only need to compromise or monitor the weakest link somewhere in that chain, learn that a closing date and a dollar figure are coming up, and then send a convincing, urgent message timed to arrive just before funds are due to move. The email is usually well written, references real details about the transaction, and creates time pressure to discourage the recipient from double-checking.

James later admitted he was close to acting on it. The email looked official, the amount matched what he had been told to expect, and closing was only two days away. What stopped him was a rule he had been given in writing at the start of the file: our trust account details are confirmed only by phone, using a number the client already has on file — never a number or link contained in the email itself. He called the office directly using the number from his signed retainer letter to confirm the new instructions before sending anything.

What we did

1. Confirmed immediately that the email was fraudulent. When James called to verify the new wire instructions, our team recognized at once that no such email had been sent from our office and that our trust account details had not changed. He was told clearly, in that same call, not to send funds anywhere other than the account already confirmed on his file.
2. Checked whether any money had already moved. The first priority in any suspected wire fraud is establishing whether funds have left the client's account. In James's case, none had — the phone call happened before he initiated the transfer, which is the outcome the verification rule exists to produce.
3. Reported the fraud attempt. We reported the incident to the Canadian Anti-Fraud Centre and advised James to do the same, along with notifying his bank of the attempted redirection so it could flag the destination account. Reporting does not usually recover money once it has moved, but it does help authorities track patterns and, occasionally, freeze accounts before further victims are affected.
4. Traced how the compromise likely happened. Because our own trust account details had not been altered and no request had gone out from our systems, the point of compromise was somewhere else in the transaction chain — most likely James's own email account, which on review showed signs of a prior phishing attempt he had not recognized as significant. We recommended he change his email password immediately, enable two-factor authentication, and review his sent and forwarded folders for anything unusual.
5. Arranged a safe path to send the actual closing funds. With two days left before closing, there was no time for uncertainty. We confirmed the genuine trust account details verbally by phone, had James's bank confirm the account name matched our firm precisely before releasing the transfer, and asked James to call our office again immediately after sending the funds so we could confirm receipt before closing day arrived.

The outcome

The closing proceeded on schedule. James's funds arrived in our trust account well ahead of the closing date, the transaction completed without delay, and he took possession of his new home on the date originally agreed with Fernanda. No money was lost to the fraud attempt, because the transfer that mattered — the one moving $81,000 out of James's account — never happened until the instructions had been confirmed by voice, from a number he already trusted, rather than from anything contained in an email.

The fraudulent account was reported to the bank that held it and to the Canadian Anti-Fraud Centre, though whoever was behind the email was never identified. That is typical of these schemes: the accounts used to receive stolen funds are often emptied and abandoned within hours, and the people operating them are difficult to trace even when a bank cooperates quickly. The realistic goal in a case like this is never recovery after the fact — it is preventing the transfer from happening in the first place, which is exactly what the phone call accomplished.

James closed on his home only a few days later than his original mental timeline, with no financial loss and no disruption to the transaction itself. The episode did cost him time and stress in the final week before closing, and it left him more cautious about email generally, which is a reasonable outcome given how close the attempt came to succeeding.

What made the difference in James's case was not luck or technical sophistication — it was a rule stated plainly at the outset of the file and followed under pressure. Many buyers only hear a warning like that once, in passing, weeks before it matters, and forget it by the time a convincing email actually arrives. James remembered it because it had been put in writing in his retainer letter and repeated verbally at the start of the transaction, so when the moment came, he had something concrete to act on rather than a vague sense that something felt off.

What you can learn from this