How do real estate funds prevent wire transfer fraud?

Real estate funds prevent wire transfer fraud by never trusting wire instructions that arrive only by email: every new payee and every change to bank details is confirmed by phone, on a number already on file, before money moves, and a second person approves each wire. When the bank holds a large wire and calls to verify it, an authorized person who actually checked the instructions takes that call. Most wire fraud against funds is not a hacked bank account. It is a convincing email that quietly changes where a legitimate payment goes.

Why fund wires are a target

A GP (general partner, or sponsor) running syndications and funds sends large, predictable wires: distributions and capital returns to LPs (limited partners, or investors), draw payments to contractors, acquisition deposits, loan payoffs and fees. Those payments follow a calendar, involve many outside parties, and are often arranged over email. That is exactly the pattern business email compromise (BEC) exploits. The FBI defines BEC as a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments, and in 2025 it received 24,768 BEC complaints with $3.05 billion in reported losses, up from $2.77 billion in 2024 (FBI IC3 2025 Annual Report).

The Federal Reserve describes BEC as a leading cause of fraudulent ACH and wire transfers from business deposit accounts, and groups the ways it happens into modifying existing payment information, taking over the account, or manipulating an authorized party (Federal Reserve Financial Services, December 2025). For a fund, the first and third are the ones to plan for: someone changes the instructions, or someone persuades your team to send the money.

How the fraud happens: a worked example

A sponsor is renovating a 120-unit multifamily property. The general contractor's draw for the month, $385,000, is approved and due Friday. On Wednesday the sponsor's controller receives an email that appears to come from the contractor's accounting manager: the company has moved banks, the old account is closing, and updated wire instructions are attached on the contractor's letterhead. The email quotes the real invoice number and the real draw amount, because the fraudster has been reading the contractor's mailbox for weeks. The sender's domain differs from the real one by a single letter.

Nothing in that email is unusual on its own. Vendors do change banks, and the invoice is genuine. What stops the payment is a rule rather than a judgment call:

1. Changed instructions trigger a call. The controller phones the contractor using the number in the vendor file from the original contract, not any number in the email or the attachment.
2. The contractor says nothing has changed. The new account belongs to the fraudster, and the email thread is reported to the contractor so they can secure their mailbox.
3. A second approver checks the payee. Even if the call had been skipped, a second person reviewing a $385,000 wire to a brand-new account has a reason to ask how it was verified.
4. The bank's verification is the last line. If the bank holds the wire and calls to confirm it, the person on the call is asked how the instructions were obtained and verified. "They came by email" is the answer that should stop the wire.

The same pattern hits distributions. An LP's email account is compromised, and the sponsor receives a polite request to send this quarter's distribution to a new account. Treat a change to an investor's bank details exactly like a change to a vendor's: confirm it with the investor directly, on a number you already have, before the next distribution runs.

Wire fraud prevention controls that work

The Federal Reserve's scam-prevention toolkit for organizations lists the controls that reduce the chance of a scam payment being sent, including dual approval, dollar limits by role, confirming changes to existing payment details for vendors through a separate contact or source, and confirming payee account details when a new payee is added (FedPayments Improvement, October 2025). For a fund, that translates into a short written policy:

• Verify instructions out of band. Confirm every new payee and every change to bank details by phone or in person, using contact details you already hold. Never use a phone number, link or attachment from the email that asked for the change.
• Require two people. One person sets up or edits the payment and a different person approves it. The approver checks how the instructions were verified, not only the amount.
• Set limits by role. Decide who can initiate wires, who can approve them, and above what amount a second approval is mandatory.
• Know who is authorized to confirm. Keep the list of authorized people on each fund and property bank account current, so the right person can take the bank's verification call when a large wire is held.
• Slow down for urgency. Last-minute changes, pressure to pay today and requests to keep a payment confidential are warning signs, not reasons to skip a step.
• Reconcile promptly. Compare outgoing payments against invoices and investor records so a misdirected wire is noticed in hours, not at month-end.

What a bank callback is, and what to expect on the call

Public guidance usually stops at "call back to verify". From the sender's side, a bank callback works the other way round: for some outgoing wires, typically large ones, the bank holds the payment and does not release it until an authorized representative of the account confirms it on a verification call. The callback protects you from your own email being the weak point. A fraudster who has fooled your team still has to get past a conversation in which a person on your account confirms the details.

Expect the call to confirm who you are and the details of the wire: the amount, the beneficiary and their account, and the purpose of the payment. Expect to be asked how you obtained the wire instructions and how you verified them. A good answer names a direct confirmation with the recipient, in person or by phone on a known number. Instructions received only by email are a common fraud risk, and on a callback, email alone is not enough.

Two decisions make callbacks go smoothly. First, decide in advance who takes the call: one of the account's authorized people, and ideally the person who verified the instructions or approved the wire, not whoever happens to answer the phone. Second, if you are about to take the call and realize the instructions were never confirmed outside email, stop and verify first. A held wire that arrives a day later is a much better outcome than a released wire to the wrong account.

Wire fraud in real estate closings

Search "wire fraud real estate" and most results are about homebuyers whose closing funds were redirected by a fake email from a title company or attorney. The mechanics are the same as BEC against a fund. The FBI's 2025 report describes a senior citizen closing on a property who received a compromised email from the "title company" containing wire instructions for over $1.3 million to a fraudulent bank account (FBI IC3 2025 Annual Report). Sponsors face the same risk when they wire acquisition deposits and closing funds: confirm the title or escrow company's instructions by phone with a contact you know before the closing, and treat any change after that as suspect.

What to do in the first hours after a fraudulent wire

Speed decides how much money comes back. The FBI's guidance is that if you discover a fraudulent transfer, time is of the essence: immediately contact your financial institution and request a recall of the funds, and regardless of the amount lost, file a complaint at ic3.gov with the full transaction details. In 2025 the IC3's Recovery Asset Team worked 3,900 incidents through its Financial Fraud Kill Chain and froze $679 million, a 58% success rate (FBI IC3 2025 Annual Report).

1. Call your bank and ask for a recall of the wire. Have the amount, date, beneficiary account and any reference number ready.
2. File a complaint at ic3.gov with the full transaction details, the same day.
3. Tell the real recipient, whether a vendor or an investor, so they can secure their email and watch for the funds.
4. Preserve the emails, headers and attachments, and review who in your organization changed or approved the payment.
5. Check the other payees on that inbox's thread for further changed instructions before your next payment run.

Doing this in Covercy

Covercy One is an investment management platform for GPs running syndications and funds, with built-in banking for fund and property accounts. Covercy is a financial technology company, and is not a bank. Banking services provided by Thread Bank, Member FDIC. When you send a wire from a Covercy bank account, the safeguards above are part of the payment itself:

• Each payment is reviewed on a summary screen and confirmed with a one-time verification code before it is sent.
• When the bank needs a verification call before it releases a wire, Covercy shows a notice on that wire with a guided verification call, right after you send it and again on the bank account and holding pages, so you can do it now or later.
• Before the call starts, Covercy reminds you that the call will ask how the wire instructions were obtained and verified, and that instructions received only by email are a common fraud risk. If you haven't confirmed them with the recipient, you can stop and verify first.
• You choose which of the account's authorized contacts takes the call, and the wire's details are on screen so they can follow along.
• Once the call is done, the wire shows that it is under bank review until the bank decides. Only the bank releases the wire.
• Covercy will never ask you to share your password, two-factor codes, or banking credentials by email, text, or phone.

To see how wires fit alongside ACH and other payment rails, read understanding wire payments in commercial real estate, or explore banking for commercial real estate.

Κλείστε demo (ανοίγει σε νέα καρτέλα)