October 7, 2026

Mortgage Wire Fraud Prevention: A Control Plan for Brokers and Lenders (2026)

Brian Thompson Mortgage, Real Estate, Scams, SMB

Mortgage wire fraud prevention: loan officer verifying borrower wire instructions by phone before closing

Mortgage wire fraud prevention usually gets treated as the title company’s job. The title company holds the escrow account, so the title company should worry about the wire. That logic breaks the moment a criminal gets into a loan officer’s mailbox. From there, they can see the closing date, the borrower’s name, the cash-to-close figure, and the tone your team uses with clients. Then they send the borrower “updated” wire instructions that look like they came from you.

Last Updated: October 2026

This guide is for owners, operations managers, and compliance leads at mortgage brokerages and independent lenders with roughly 10 to 150 employees. It covers what the numbers show, what the FTC Safeguards Rule may expect of your shop, and a mortgage wire fraud prevention plan your team can run without a full-time security hire.

Why mortgage wire fraud prevention starts with your shop

The FBI’s Internet Crime Complaint Center (IC3) logged 12,368 real estate fraud complaints in 2025, with $275.1 million in reported losses. That is up from $173.6 million in 2024, an increase of about 58% in one year. Source: the FBI IC3 2025 Internet Crime Report.

The broader category matters even more. Business email compromise (BEC), the scheme behind much of closing-day wire fraud, drew 24,768 complaints and more than $3 billion in reported losses in 2025. IC3 defines BEC as fraud against people who regularly make wire transfers, carried out by compromising email, phone numbers, or meeting apps. That describes a mortgage workflow almost exactly.

Real estate transactions give criminals three things they want:

Large, predictable wires. Earnest money, cash to close, and payoffs all move on a known schedule.
Many parties on one thread. Borrower, loan officer, processor, agent, title, and attorney all email each other. One weak mailbox exposes everyone.
Time pressure. Nobody wants to delay a closing. Urgency makes people skip the callback.

AI is making the impersonation better. IC3 notes that chat tools can quickly produce official-sounding emails, and voice cloning can be used to request a wire. Businesses reported more than $30 million in 2025 losses to BEC scams involving AI. The old advice to “look for typos” no longer holds.

Here is the uncomfortable part for a broker or lender. Your shop may never touch the closing funds. But your inbox holds the details that make a fake instruction convincing. If the breach starts with you, the borrower will remember whose email it came from. That is why mortgage wire fraud prevention has to start inside your own shop.

What the FTC Safeguards Rule may expect from your shop

Whether the FTC Safeguards Rule applies to you depends on your entity and your regulator. Confirm it with counsel. That said, the FTC’s own guidance names mortgage lenders and mortgage brokers among its examples of covered financial institutions. Lenders owned by or supervised as banks generally answer to their banking regulator instead. State mortgage regulators may add their own requirements on top.

For covered firms, the rule requires a written information security program. The FTC lists nine elements. Several map directly to mortgage wire fraud prevention:

A Qualified Individual who implements and supervises the program. This person needs real-world know-how, not a specific degree or title.
Multi-factor authentication for anyone accessing customer information on your systems.
Staff training, with regular refreshers.
Service provider oversight, including contracts that spell out security expectations and periodic reassessment.
A written incident response plan with clear roles, decision authority, and documentation steps.

There is also a reporting duty. If a security event involves the unauthorized acquisition of unencrypted information about at least 500 consumers, the rule requires notice to the FTC no later than 30 days after discovery. A compromised loan officer mailbox can hold far more borrower files than most owners expect.

Firms that keep customer information on fewer than 5,000 consumers are exempt from certain provisions, not the whole rule. Read the full guidance at the FTC’s Safeguards Rule page.

The practical point: the controls behind mortgage wire fraud prevention are largely the same controls the rule describes. You are not building two programs. You are building one and documenting it.

The mortgage wire fraud prevention control plan

None of these controls requires new software to start. Each one needs an owner and a record that it happened.

1. Name one owner for wire safety

Pick the person who decides what happens when something looks wrong. In a 25-person brokerage, that is often the operations manager or compliance lead. If the Safeguards Rule applies to you, this may be the same person as your Qualified Individual. Write the name down. When a suspicious email lands at 4:45 on a Friday, nobody should wonder whose call it is.

2. Set a callback rule your team cannot skip

Any change to payment instructions gets verified by phone, using a number from your file or a known directory. Never use the number in the email that requested the change. This applies to borrower payoffs, vendor invoices, and broker compensation. This one rule is the core of mortgage wire fraud prevention. Make it a written procedure, then train on it. A rule that lives only in someone’s head disappears during a rush close.

3. Warn borrowers early and more than once

Tell borrowers at application, again with disclosures, and again in the closing week. The message is short: your firm will never send new wire instructions by email alone, and they should call a known number before sending money. Put it in your email signatures and your portal. A borrower who expects the warning is far more likely to pause.

4. Review the title and settlement partners you send borrowers to

Your borrower’s money moves through partners you recommend. Ask each title, escrow, or settlement partner how they verify wire instructions and protect their own email. Record the answers and review them at least once a year. If the Safeguards Rule covers you and a partner receives borrower information from your firm, this also supports your service provider oversight requirement.

5. Lock down the mailboxes criminals want most

Loan officers, processors, and closers hold the most useful details. Require multi-factor authentication on every account. Check regularly for hidden forwarding rules, a common sign of a compromised mailbox. Remove access quickly when people leave. Then have staff practice spotting a spoofed closing email before a real one arrives.

The first hour after a misdirected wire

Speed decides how much money comes back. In 2025, the IC3 Recovery Asset Team ran its Financial Fraud Kill Chain on 3,900 incidents involving $1.16 billion in attempted theft. It helped freeze $679 million, a 58% success rate. One case involved a couple closing on a home who got an email impersonating their attorneys. They wired more than $449,000. After they filed with IC3, the receiving bank confirmed the full amount was still on hold.

Your written incident response plan should cover these steps in order:

Call the sending bank immediately. The borrower (or your firm, if your wire went out) requests a recall and asks the bank to contact the receiving bank.
File at ic3.gov regardless of the amount. Include full transaction details. IC3 states that time is of the essence.
Alert the title or settlement company using a known phone number, so they can stop any related disbursements.
Preserve the evidence. Do not delete the fraudulent email or wipe the affected account. Capture headers, forwarding rules, and login history.
Contain the mailbox. Reset credentials, revoke sessions, and confirm MFA on the affected account.
Decide on notifications. Your owner, with counsel, determines whether borrower information was exposed and whether FTC or state notice duties apply.
Write it down. Record what happened, who decided what, and what you changed afterward.

Most small shops lose the first hour to guessing. Who calls the bank? Does anyone call the borrower? Which person decides whether this is reportable? A plan written on a quiet afternoon answers those questions before anyone is panicking.

Turning mortgage wire fraud prevention into an operating rhythm

A one-time policy fades. A rhythm holds. Here is a simple cadence a 10 to 150 person shop can run:

Assess (annually): Inventory where borrower information lives, who can reach it, and which partners receive it.
Prioritize (annually): Rank the gaps. For most mortgage shops, missing MFA and an unwritten callback rule top the list.
Train (quarterly): Short refreshers on spoofed closing emails, payment changes, and phone impersonation.
Review vendors (annually, and at onboarding): Re-ask your title and settlement partners how they protect wires and email.
Prepare for an incident (twice a year): Walk through the first-hour steps as a tabletop exercise. Update the plan after each one.

Keep records of each step. When a lender partner, auditor, or examiner asks how you protect borrower information, you can show the work instead of describing it.

Mortgage wire fraud prevention FAQ

Does the FTC Safeguards Rule apply to mortgage brokers?

The FTC lists mortgage brokers and mortgage lenders among its examples of covered financial institutions. Coverage still depends on your activities and whether another regulator, such as a banking agency, supervises you. Confirm your status with counsel.

Who is responsible when a borrower wires money to a fraudster?

It depends on the facts, the contracts, and state law. Liability disputes can involve the lender, broker, agent, and title company. The safer question is whether your firm can show it trained staff, warned borrowers, and responded quickly.

Mortgage wire fraud prevention in practice

How fast do we need to act after a fraudulent wire?

Immediately. The FBI advises contacting your financial institution to request a recall and filing at ic3.gov regardless of the amount. Recovery odds fall as funds move to additional accounts.

What is the single most effective wire fraud control?

A mandatory callback to a known phone number before acting on any changed payment instructions. It is cheap, simple, and stops many email-based schemes. It only works if everyone follows it every time.

Do we have to report a compromised email account to the FTC?

Only if you are covered by the Safeguards Rule and the event involves unauthorized acquisition of unencrypted information about at least 500 consumers. Then notice is due within 30 days of discovery. State breach laws may also apply.

Does a small brokerage really need a written incident response plan?

If the Safeguards Rule covers you, a written plan is one of its required elements. Even if it does not, a short plan saves the first hour of a crisis, which is when recovery odds are highest.

What does mortgage wire fraud prevention look like for a small brokerage?

A named owner, a mandatory callback rule for changed payment instructions, repeated borrower warnings, documented reviews of title and settlement partners, multi-factor authentication on every mailbox, and a written incident response plan your team has practiced.

Put an owner and a record behind the plan

Most mortgage shops already know wire fraud is a risk. What they lack for real mortgage wire fraud prevention is a named owner, a training schedule, partner reviews on file, and an incident plan someone has actually practiced. defend-id gives smaller firms one place to assign that work and document it, with employee security training, vendor management, and 24/7 incident response and breach support. Your firm still owns its program. We help you run it and show the records when a lender, auditor, or examiner asks.