How a Pickering Downsizing Survived a Wire Fraud Attempt

The situation

Winnie and Herman had spent their careers as air traffic controllers, and they were applying the same discipline to retirement that had defined their working lives: sell the large family home, buy something smaller and easier to maintain, and keep a comfortable cushion in savings. They found a bungalow in Pickering listed at roughly $950,000 and made an offer that was accepted within days.

The numbers worked cleanly. The sale of their existing home was expected to close a week before the purchase, leaving enough proceeds to cover most of the new purchase price along with a mortgage discharge and the usual closing costs. A modest top-up of about $46,000 from their savings would cover the rest. Our team was retained to handle the purchase, and the file moved through the ordinary stages: title search, mortgage instructions from their lender, and a closing date set roughly five weeks out.

Nothing about the file was unusual until four days before closing, when Winnie received an email that appeared to come from our firm.

How the fraud unfolded

The email looked convincing. It used our firm's name, referenced the file by the correct property address, and explained that our trust account details had recently changed due to a "banking transition," with new wire instructions attached for the $46,000 top-up. The tone matched the kind of routine, slightly bureaucratic email a law firm might actually send. It did not come from us.

This is the most common form of real estate closing fraud in Ontario, and it works because it targets the one moment in a transaction when a client is expected to send a large sum of money to an account they cannot personally verify. Fraudsters monitor or guess at active real estate files — sometimes through compromised email accounts belonging to a real estate agent, a mortgage broker, or even a client — and time a spoofed instruction to arrive close to the closing date, when people are moving quickly and do not want to be the reason a deal is delayed.

Winnie, a careful person by training, did what our firm's intake materials ask every client to do: she did not use the phone number in the email or reply to it directly. Instead, she called our office using the number saved from her retainer letter, sent weeks earlier, to confirm the new instructions before sending anything.

That call is what kept this from becoming a complete loss. But it did not arrive in time to stop the first transfer. Two days earlier, believing the instructions were routine, Winnie had already wired the $46,000 top-up using the fraudulent details — a smaller amount than what a purchase deposit or full closing funds transfer would involve, but still a meaningful sum for a retired couple living on pension income and savings.

What we did

1. Confirmed the fraud immediately and stopped further exposure. Once Winnie's call reached us, we confirmed within minutes that our firm had never sent updated banking details and that no legitimate reason exists for trust account information to change by email mid-file. We immediately flagged the file so no further funds could move without a verified in-person or phone confirmation, and we alerted the couple's lender and real estate agent that the file may have been compromised somewhere in the email chain.
2. Contacted the sending bank's fraud department the same day. Time matters enormously in wire fraud. Banks can sometimes recall or freeze a wire if the receiving institution is notified before the fraudulent account is emptied. We had Winnie and Herman contact their bank's fraud line directly within hours of discovering the diversion, providing the transaction reference number, the receiving account details, and a written account of the fraudulent email.
3. Filed a report with the police and the Canadian Anti-Fraud Centre. A formal fraud report is often a precondition for banks to act on a recall request, and it also starts a paper trail that matters if any part of the loss is later disputed with a financial institution or insurer. We helped the couple prepare a clear, dated timeline of events to attach to the report.
4. Rebuilt the wire instructions through a verified channel. With four days left before closing, the couple still needed to send the $46,000 top-up through legitimate means. We arranged for Herman to attend our office in person to receive the trust account details directly, removing any reliance on email for the replacement transfer.
5. Negotiated with the sending bank over the unrecovered portion. Once it became clear that the receiving account had already been partially emptied before the freeze took effect, we corresponded with the bank on the couple's behalf. Banks are not legally obliged to reimburse a customer-authorized wire transfer, even a fraudulently induced one, but banks do sometimes offer a goodwill contribution where the customer acted quickly and followed reasonable verification steps — which Winnie had, once she caught the discrepancy. We put that case to the bank in writing.

The outcome

The bank's fraud department managed to freeze the receiving account before all of it could be withdrawn. Of the $46,000 diverted, roughly $29,000 was still sitting in the fraudulent account when the freeze took effect and was returned to the couple within about six weeks. The remaining $17,000 had already been withdrawn by the time the bank intervened and was not recoverable through the freeze.

Because Winnie had reported the fraud within hours of discovering it and had documented every step, the sending bank agreed to a goodwill payment of $9,000 toward the unrecovered balance — not an admission of liability, and not something the couple could have demanded as of right, but a negotiated result that reflected how quickly the fraud had been caught and reported. That left Winnie and Herman with an out-of-pocket loss of about $8,000 on a $46,000 transfer, absorbed from their savings rather than from the funds required to close.

The replacement wire, sent through a verified channel, arrived in our trust account with two days to spare, and the purchase closed on schedule. Winnie and Herman moved into their new bungalow without the closing itself being delayed by the fraud at all — the damage was financial, not procedural.

It was not the clean outcome anyone would have wanted. An $8,000 loss on a retirement budget is not trivial, and no amount of good process afterward changes what already left the account before the alarm was raised. But the alternative — if Winnie had not called to verify, or had called using the number printed in the fraudulent email itself — was a full $46,000 loss with essentially no path to recovery. The couple's instinct to verify through a channel they controlled, rather than one the email provided, is what turned a total loss into a partial one.

Winnie and Herman were candid afterward about how close the call had been. They had handled complex, high-pressure work throughout their careers, and neither considered themselves careless with money. What caught them off guard was how ordinary the fraudulent email looked next to the dozens of legitimate emails that pass through a real estate file — the file numbers, the property address, even the tone of routine administrative correspondence, all copied convincingly from earlier, genuine messages in the same transaction.

What you can learn from this