The Wire Instructions That Almost Weren't Ours

The situation

Deepa, a physiotherapist, and Kavya, a professional engineer, had been looking for a house in Ottawa for the better part of a year. When they finally had an accepted offer on a property priced around $950,000, they retained our team to handle the closing: reviewing the agreement of purchase and sale, searching title, satisfying the mortgage lender's conditions, and preparing the paperwork that would transfer ownership on closing day.

Their real estate agent, Bohdan, had worked with the couple through several rounds of offers before this one succeeded, and stayed involved through the closing process, forwarding documents and coordinating showings for the couple's final walk-through. Everything about the file was ordinary. Mortgage approval came through with routine conditions, the home inspection turned up nothing serious, and the closing date was set for a Friday, roughly six weeks out from the accepted offer.

As is standard practice, our office had already given Deepa and Kavya our trust account details in writing at the start of the retainer, along with a plain instruction that would matter more than either of them realized at the time: those details would never change by email, and if they ever received an email suggesting otherwise, they should not act on it without calling our office directly, using a phone number they looked up themselves rather than one provided in the email.

By the final weeks before closing, the couple's inbox had become busy with legitimate paperwork: mortgage discharge statements, a status certificate request (their new home was a freehold, so this particular document did not apply, but the mortgage lender still asked several routine questions), and a running list of conditions to satisfy before funds could be advanced. It was exactly the kind of crowded, deadline-driven inbox that closing fraud is designed to exploit, because one more official-looking email rarely stands out on its own.

The warning sign

Four days before closing, Kavya received an email that looked, at a glance, like it came from our office. It carried our firm's name in the sender field, referenced the correct property address and closing date, and explained that our trust account had recently changed banks. It asked that the couple's remaining closing funds, roughly $181,000 after their mortgage advance and deposit were applied against the purchase price, be wired to a new account before end of day.

This is a well-documented fraud pattern in Ontario real estate transactions, sometimes called closing funds fraud or wire interception fraud. It does not usually involve a law firm's systems being hacked. More often, a fraudster gains access to one party's email account somewhere in the chain, a buyer, a seller, an agent, and quietly monitors the correspondence for weeks, learning the property address, the closing date, the names involved and the tone of the emails already being exchanged. Near closing, when a large transfer is expected and everyone is moving quickly, the fraudster sends a convincing message with altered banking details, timed to arrive when there is little room to double-check before the deadline feels urgent.

In this case, the email address was one character off from our firm's real domain, easy to miss on a phone screen. The message itself was well written, free of the spelling mistakes and awkward phrasing that used to be a reliable warning sign, and it used the correct file reference number, which the couple had seen on genuine correspondence throughout the transaction. That detail alone told our team, once we were involved, that whoever sent it had been reading real emails from the file for some time before acting.

The couple did not know yet whether the compromise had happened in their own email, Bohdan's, or somewhere else in the chain, and at that point it did not matter. What mattered was that the funds had not moved, and Kavya, remembering the instruction from the retainer letter, called our office using the number saved from that same letter rather than replying to the email or calling any number it contained. It was a small habit, formed from a single sentence in a retainer letter weeks earlier, and it was the only thing standing between the couple and a wire transfer that could not be undone once sent.

What we did

1. Confirmed by phone that the email had not come from us. Our trust account had not changed. No one on the file had sent that message. This took a two-minute phone call and immediately removed any pressure to act quickly on unverified instructions.
2. Told the clients not to wire funds anywhere until they heard directly from us, verbally, with the correct account details read aloud. Ontario title insurers and law societies both recommend this practice for a reason: fraudulent instructions almost always arrive by email, and a phone call to a known, independently verified number is the simplest defence against them.
3. Preserved the fraudulent email and reported it. We kept a copy for the record and reported the incident to the Canadian Anti-Fraud Centre and to our own IT contacts, so the domain and pattern could be flagged. We also alerted the couple's bank, since large outgoing wires triggered by fraud are sometimes intercepted if the receiving bank is notified quickly, though there was no transfer to trace in this instance.
4. Checked whether the fraudster had visibility into the file, and where. We asked Deepa, Kavya and Bohdan to each independently check their email accounts for signs of compromise, such as unfamiliar forwarding rules or login activity from unrecognized locations. Bohdan found a forwarding rule in his account that he had not created, quietly copying his incoming mail to an outside address. He changed his password, enabled two-factor authentication, and removed the rule the same day.
5. Reconfirmed the real trust account details verbally before the actual transfer. When it came time for the couple's mortgage lender and the couple themselves to send funds for closing, we walked through the account details on a phone call rather than relying on any written instruction alone, closing the same gap the fraudster had tried to exploit.
6. Proceeded with closing on the scheduled date. Because the fraud attempt was caught early rather than discovered after a transfer, there was no need to delay closing while funds were traced or recovered. The transaction closed on the original Friday as planned.

The outcome

No money left the couple's account and none reached the fraudulent one. The roughly $181,000 in closing funds moved, once, to the correct trust account, verified by phone, and the purchase closed on schedule. Deepa and Kavya moved into their home without the weeks of stress, lost funds, and uncertain recovery odds that follow a successful closing fraud, where in many reported Ontario cases only a portion of diverted funds is ever recovered, and only if the receiving bank is alerted within hours of the transfer.

The near-miss also had a useful side effect. Bohdan's compromised email account was cleaned up before it could be used against a different couple on a different file, and he began reviewing his account's login activity and forwarding rules periodically rather than assuming a strong password alone was enough. The couple came away from their purchase with a habit that outlasted the transaction: they now confirm any request involving money, from anyone, by a phone call to a number they already trust, not one supplied in the message asking for the money.

This was, in the end, a clean file with one dangerous afternoon in the middle of it. The fraud did not succeed because of luck, and it did not succeed because the fraudulent email was obviously fake, it was not. It failed because the instruction from day one, that banking details never change by email, was followed exactly when it mattered, before anyone had time to feel rushed into skipping the phone call. That is the entire defence against this kind of fraud: not detecting a fake email on sight, but refusing to act on any financial instruction that arrives only in writing, no matter how convincing it looks or how urgent it sounds.

What you can learn from this