|
Alert: New Fraud Scheme Targets Settlement Companies by Impersonating Bank Fraud Departments
December 31, 2025
Settlement companies and real estate law firms are facing a dangerous and increasingly sophisticated wire fraud scheme that exploits trust in banking institutions and multi-factor authentication (MFA) procedures.
Industry professionals have detected a growing number of incidents in which fraudsters pose as bank fraud departments in order to steal login credentials and execute unauthorized wire transfers from escrow and operating accounts.
If you are contacted by your bank for any reason—including possible fraud—and are asked for any part of your login credentials or MFA information, hang up immediately. Instead, companies should contact the bank’s fraud department directly using a known-safe phone number, such as one listed on official bank documentation or the institution’s verified website.
How the Scam Works
The scheme is notable not just for its potential effectiveness, but for how convincingly criminals may impersonate legitimate financial institutions. Here are the tactics:
- The “caller ID” phone number is often spoofed and will appear as the bank’s true phone number.
- In some cases, the call is preceded by a text message that looks like a legitimate bank fraud alert, reinforcing the credibility of the follow-up phone call.
- Fraudsters often possess partial but convincing internal information, such as the names of authorized account users, partial login credentials or even fragments of Social Security numbers.
- There appears to be a trend of targeting companies that bank with smaller or local financial institutions, but this could occur no matter what bank is used.
This combination of urgency, familiarity and apparent verification creates the perfect conditions for social engineering, particularly in busy closing environments where staff are accustomed to responding quickly to potential banking issues.
What to Do If an Incident Occurs
If a settlement company or law firm believes it has been targeted—or has already experienced unauthorized account activity—take these immediate steps:
-
Follow ALTA’s Wire Fraud Incident Response Protocol, available through ALTA’s Rapid Response Worksheet, and contact appropriate parties
- Preserve all communications, including call logs, texts and emails related to the incident
Fast response is critical. In some cases, prompt action may help limit losses or improve the chances of recovering funds.
“As wire fraud schemes continue to evolve, this latest tactic underscores a broader industry challenge,” said ALTA President David Townsend Esq, NTP. “The use of MFA and credential theft shows that fraudsters are adapting as companies strengthen traditional safeguards.
“For title agencies and real estate law firms, ongoing staff education, strict credential policies and clearly defined escalation procedures are essential. Everyone—from front-desk staff to escrow officers and attorneys—must understand that no legitimate bank inquiry requires sharing login or MFA information. Any such request should be treated as a red flag.”
Contact ALTA at 202-296-3671 or communications@alta.org.
| 
