Fake Escrow Email: A $282,000 Down Payment Redirected
A single email with new wire instructions can redirect a home down payment. In this Indiana case, the story ended better than most.
By Siddharth ShankarUpdated October 11, 2026A Dallas woman was sentenced in April 2019 to 12 months for her part in an email-compromise scheme that obtained over $335,000 over two days in April 2017. In one instance an Indiana buyer wired $282,000 for a house down payment after a message impersonating the escrow officer gave false wire instructions. The Justice Department says all funds were recovered and returned to the victims. Verify wire details by phone on a number you already have.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
Few moments in a person's life involve as much money and as much email as a house purchase. That is why business email compromise, often shortened to BEC, targets closings. A 2019 Justice Department case from Indiana shows the pattern, and unusually, a good outcome.
What happened
The Justice Department announced that a Dallas, Texas, woman was sentenced to 12 months in prison and two years of supervised release for wire fraud. The scheme obtained more than $335,000 in April 2017 over two days.
According to the release, an Indiana victim wired $282,000 for a down payment on a home after the scheme impersonated the escrow officer's email and provided false wire instructions. A Texas victim wired nearly $25,000 for what appeared to be an invoice. A second Texas victim's bank account was compromised, and an unknown person wired money into her account. Homeland Security Investigations investigated.
How the scheme worked
The woman opened a bank account under a nonexistent business name to receive the fraudulent wires. The messages that sent the money there came from a spoofed or impersonated email. When a buyer receives what looks like a genuine message from the escrow officer, with the usual sign-off and a familiar thread, a changed account number can seem like a small update.
The risk is that wires are fast and difficult to reverse. After a few hours, funds can be moved again, which is why speed in reporting matters.
What was exposed
No personal database was stolen according to the release. What was exposed was a trusted relationship: a real transaction, real participants and a predictable moment when large sums move. The release does not say how the scheme learned the timing of the closing or the escrow officer's email details, and we have not guessed.
How it ended
The ending was unusually good. The Justice Department states that all funds were recovered and returned to the victims. That outcome is far from guaranteed in wire fraud cases. It usually depends on the bank freezing the funds quickly after the victim reports. The sentence itself was modest, but the recovery was the part that mattered most for victims.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Sentence: 12 months plus two years of supervised release
- Total obtained: more than $335,000, over two days in April 2017
- Indiana victim: $282,000 for a house down payment
- Texas victim: nearly $25,000 for an invoice
- Recovery: all funds recovered and returned
- Investigator: Homeland Security Investigations
How to protect a closing
1Call to verify every wire instruction
Use a phone number you already have for the title or escrow company, never one from the email.
2Treat changes as red flags
A change in account number or bank is exactly what a scammer wants. Check it by phone, even if the message looks right.
3Look closely at the sender address
Compare the full address, not just the display name, and look for a single changed letter.
4Report within hours
If you suspect a wire went to the wrong place, call your bank immediately and report it at IC3.gov.
What the release does not say
The release does not describe the technical method used to impersonate the escrow officer. It also does not say how many people were involved beyond the woman who was sentenced. For a similar case in Australia where most of the money came back, read about an $813,000 house payment recovered.
Why closings are a favorite target
A property purchase involves several parties, a tight timetable and a very large payment. Buyers expect emails with wiring details and often feel unfamiliar with the process, so they do what the email says. Scammers exploit that expectation. They need only one convincing message at the right moment. Buyers can reduce the risk before the process starts by asking their escrow or title company how wire instructions will be delivered and how changes will be handled. Agree on a phone number at the beginning, and treat any later change of bank details as a reason to call, not to reply.
Your own exposure is the part you can still change. These guides cover how to tell a real breach notice from a phishing message, how to prevent identity theft and what an exposed email address means. You can also try our free email exposure check.
Sources
- US Attorney's Office, Northern District of Indiana: Dallas woman sentenced in email compromise scheme (12 months, $335,000 over two days, $282,000 and $25,000 wires, funds recovered)
Frequently asked questions
What is business email compromise?
It is fraud in which a criminal impersonates a trusted party by email to redirect a payment, often during a property purchase or invoice.
Was the money recovered?
The Justice Department says all funds were recovered and returned to the victims.
How can I verify wire instructions?
Call the escrow or title company on a number you already know, and confirm the account details before sending anything.
What should I do if I sent money to the wrong account?
Call your bank straight away, ask for a wire recall and report the incident to IC3.gov and local police.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.