Beck Owen & Murray

04/30/2026

Report: 1 in 5 Homebuyers Receive Suspicious or Fraudulent Communication During Closing
April 28, 2026

A new report from CertifID shows that fraud has moved from a behind-the-scenes threat to a front-of-mind concern for homebuyers and sellers. The findings suggest that security is no longer an operational issue alone. It is now a core part of the customer experience.

The 2026 State of Wire Fraud Report draws on survey data from more than 1,400 consumers and real estate professionals, along with transaction-level insights. It paints a picture of an industry where fraud attempts are common and expectations around protection are rising quickly.

Nearly one in four homebuyers (22%) reported receiving a fraudulent or suspicious communication during their closing process. At the same time, consumer awareness has reached a tipping point. More than 80% of respondents said they are aware that criminals use artificial intelligence to impersonate trusted parties in real estate deals. As fraud tactics become more sophisticated, consumers are becoming more cautious and more selective.

That shift is changing behavior in ways that directly impact title and settlement professionals. According to the report, 68% of consumers said guaranteed protection from wire fraud strongly influences which provider they choose. In addition, 85% said they would be willing to pay more for that protection.

However, the data also reveals a troubling gap between awareness and action. Many consumers recognize suspicious activity but do not know how to respond effectively, leaving them vulnerable even when they sense something is wrong. A third of consumers who received suspicious communications either ignored them or took no action at all

The report also highlights the lasting damage caused by fraud incidents. More than half of consumers said they would not work with a title company or real estate firm again after experiencing wire fraud, even if their funds were fully recovered. This underscores that the impact extends beyond financial loss to long-term trust and reputation.

The report also points to the growing influence of artificial intelligence in fraud schemes. Attackers can now generate highly convincing emails, clone voices and mimic trusted parties with greater accuracy. As a result, traditional warning signs are becoming harder to detect. Last year, fraud analysts estimated 40% of business email compromise phishing emails were AI-generated. According to CertifID’s study, there has been a 1,760% year-over-year increase in business email compromise attacks since generative AI tools became widely available. For title professionals on the front lines, they see the change clearly. In survey, 72.6% report that fraud attempts are becoming more sophisticated, 60.1% say fraud attempts are increasing in frequency and 57.5% encounter suspicious activity quarterly or more frequently.

Verifying wire instructions through trusted channels, setting expectations with consumers early and reinforcing secure communication practices throughout the transaction are increasingly essential. The data suggests the industry is at an inflection point. Fraud is not only increasing in frequency and sophistication, but also shaping how consumers evaluate service providers. For title companies, that means security is no longer just about avoiding loss. It is about earning trust.

In its report, CertifID shared the story of Sarah Dombrowski, who has worked in title for 27 years. In March 2022, she opened her own company, Unique Title and Escrow. She thought she was protected: she had fraud prevention tools in place. Then came the phone call.

On Aug. 7, 2024, an employee told her a mortgage payoff wire hadn’t arrived. $311,785 was missing.

“I felt like I was dying, Dombrowski recalled. "My chest was tight, my heart was racing. It’s like hitting a Mack truck at 60 miles per hour.”

Her first concern was her clients. Then came the terrifying realization: her business, her livelihood and her team. Everything was in jeopardy. She barely slept for weeks. Insurance companies and attorneys offered no guidance.

The product she had trusted? They told her to call her bank.

CertifID Fraud Recovery Services eventually helped return most of the stolen funds, but the experience left a permanent mark. Dombrowski now operates differently with verified processes in place for every wire.

“I can close my eyes at night knowing I will not experience wire fraud again, she said. I don’t want to be in cybersecurity. I want to focus on title.”

04/15/2026

You list a property, and it sits vacant for a few weeks between tenants. The lawn gets mowed, the lights stay off, and nobody thinks twice. But someone else might be paying close attention to that empty house—not to buy it, but to steal from it.
Security researchers recently uncovered fraud tutorials on Telegram that teach criminals how to exploit vacant homes as “drop addresses” for intercepting mail. The playbook is simple. Criminals browse platforms like Zillow, filtering for recently listed rentals or homes sitting on the market. They’re not shopping for a home—they’re looking for an empty mailbox.
Once they find a vacant property, they sign up for USPS Informed Delivery at that address. This free postal service sends digital previews of incoming mail—letting criminals see financial statements, credit card offers, and tax documents on a phone screen. From there, they file a change-of-address request to reroute the homeowner’s mail to a location they control. The postal service has verification safeguards, but the tutorials suggest criminals view those controls as easy to work around.
What makes this especially relevant for the real estate industry is that criminals are using our tools against us. Listing platforms designed to connect buyers and sellers are being weaponized to find targets. A property between closings, a rental waiting for a new tenant, a home in probate—any vacant property with an active mailbox becomes a fraud staging ground. Intercepted mail fuels identity theft, unauthorized credit applications, and account takeovers.
This isn’t a high-tech hack. There’s no malware, no phishing email, no software exploit. It’s a criminal walking up to a mailbox at an empty house and helping themselves to someone’s financial life. And because every step abuses legitimate services—real estate platforms, postal forwarding, public listings—it’s hard to detect.
Takeaways
Secure the mailbox on vacant properties you manage. If you oversee listings or properties between transactions, consider locking the mailbox and placing a temporary hold on USPS mail delivery. An open mailbox at an empty house is an invitation.
Sign up for USPS Informed Delivery on your own address before someone else does. Only one account can register per address. If you register first, a criminal can’t. This is one of the easiest steps you can take to protect yourself.
Watch for unexpected USPS change-of-address confirmation letters. The postal service sends a validation notice whenever a forwarding request is filed. If you receive one you didn’t initiate, contact USPS and report it immediately.
Alert property owners about mail security during vacancies. If you work with sellers, landlords or estate representatives, remind them that a vacant property’s mailbox is a vulnerability. A simple heads-up could prevent a much bigger problem.
Freeze your credit if you haven’t already. Stolen mail is often used to open fraudulent accounts. A credit freeze with all three bureaus stops that path cold, and it’s free to set up and lift.
We spend a lot of time protecting ourselves from digital threats—phishing emails, fake websites and malware—but sometimes the most effective attack is the simplest one: a criminal, an empty house and an unlocked mailbox. In our industry, where properties regularly sit vacant, that’s a risk worth taking seriously.

04/13/2026

You receive a call from your bank’s fraud department.

You check the caller ID. They have your exact bank account number. They say there is fraudulent activity on your account and they need you to verify some transactions. What could possibly go wrong?

As it turns out — a lot.

The FBI and ALTA recently issued announcements warning of a scheme involving fraudsters impersonating bank fraud departments. This tactic is just one example of a much broader and ongoing threat: impersonation scams designed to gain access to and take over bank accounts.

The Bigger Picture: How Impersonation and Takeover Schemes Work

Industry leaders have similarly issued a warning about a fraud scheme where criminals gain control of bank accounts and then use various tactics to remove funds. This scam is effective because it looks and feels legitimate. The fraudsters use impersonation techniques to gain trust so they can steal login credentials and execute unauthorized wire transfers or payments from escrow or operating accounts. They do this by using a mixture of technology and social engineering which may include:

Impersonation of a Trusted Source: ID Spoofing to make the incoming calls appear to be from a real bank’s phone number.

Build Credibility: The fraudster may send fake bank text alerts or know partial account or personal details to build credibility.

Urgency and Familiarity: Often fraudsters pressure you to act quickly, especially during busy closing periods.

Ask for Access: Fraudsters often will ask for MFA codes, login credentials, wire approvals, or remote access to your computer.

What to Look Out For:

Was I expecting this message?
If you were not already dealing with or expecting communication from the bank, why would they contact you?

Is the message asking for any codes or authentication information?

Banks and fraud departments almost never ask for MFA codes via email or text. Never share this information. Fraudsters try to create urgency to cloud judgement.

If something feels off, contact your bank immediately!

If you believe you are a victim of account takeover, follow the FBI’s What To do in Case of an ATO Incident found here: Internet Crime Complaint Center (IC3) | Account Takeover Fraud via Impersonation of Financial Institution Support: https://www.ic3.gov/PSA/2025/PSA251125

Do not underestimate the risk. Account Takeover can signal a broader cybersecurity compromise within your organization.

The FBI warns of cyber criminals impersonating financial institutions to steal money or information in Account Takeover (ATO) fraud schemes. The cyber criminals target individuals, businesses, and organizations of varied sizes and across sectors. In ATO fraud, cyber criminals gain unauthorized acces...