Wiring Instructions Change at 4:47 PM. What Does Your Loan Team Do Next?

At 4:47 p.m., a buyer forwards an email that appears to come from the title company. The routing number has changed. The message looks polished, the closing is tomorrow, and the sender says the wire needs to go out now.

That’s exactly when a good loan team slows down. A late change may be legitimate, but urgency and familiarity are also what make business email compromise work. The answer isn’t asking the buyer to study the email more closely. It’s giving everyone a verification routine that doesn’t depend on the email at all.

The dangerous part is how normal the message looks

A spoofed message doesn’t have to be sloppy. It may use the right names, transaction details, signature block, and timing because a criminal has monitored an account or copied a familiar thread. Sometimes the only visible difference is one character in an address. Sometimes there’s no obvious clue for the buyer to catch.

The FBI’s 2025 Internet Crime Report recorded 12,368 complaints classified as real estate fraud and more than $275 million in reported losses. That category is broader than mortgage closings, but the scale explains why a payment change deserves a repeatable response rather than a judgment call made under deadline pressure.

The FBI’s current business email compromise guidance specifically warns about fake down-payment instructions. It recommends checking addresses carefully, using multifactor authentication, and verifying payment changes in person or by calling a trusted number.

Make one rule before closing week

A broker doesn’t control every communication among the buyer, title company, bank, agent, and settlement team. You can still establish one rule early: no wire instruction or payment change is acted on from email or text alone.

Explain the rule while the file is calm, then repeat it before the buyer expects final numbers. Give the borrower a known title or settlement contact and tell them where that phone number came from. A number inside the message being verified is not an independent channel.

“If anyone sends new or revised wire instructions, pause. Don’t reply, forward the message, or use the phone number inside it. Call the title or settlement contact using the number we confirmed earlier.”

The CFPB’s mortgage-closing scam warning makes the same point in plain language: scammers target buyers just days before closing. This brief conversation belongs in the closing-prep process, not in a dense disclosure the borrower may never revisit.

When the instructions change, the safest sequence is simple: pause, verify through a known channel, then escalate. IC3 is the Internet Crime Complaint Center

The 4:47 p.m. playbook

When a changed instruction lands, the person who notices it shouldn’t have to invent the next step. Use a short response that works even when the team is busy:

1. Pause the request. Do not forward the message to “check whether it’s real,” and don’t keep replying inside the same thread. Mark the file and tell the borrower not to send funds while verification is underway.

2. Verify out of band. Call the title or settlement contact using a number already saved in the file, obtained from an independently verified website, or confirmed earlier in the transaction. Ask whether any account or payment procedure changed.

3. Document and escalate. Record who called, which number was used, who answered, what was confirmed, and when. If anything remains inconsistent, involve title leadership, the lender, and the relevant bank security or fraud team.

4. Give the borrower one clear update. Tell the buyer whether to continue waiting or which verified party will provide the next instruction. Avoid sending a trail of competing emails that creates even more confusion.

This is one of those moments when speed means getting the right people on the phone, not moving the message through the inbox faster.

Put the safeguard where the work happens

A policy in a handbook won’t help if no one sees it during the file. Add the checkpoint to the transaction itself, alongside the other borrower reminders you use to prevent pre-closing credit surprises.

A practical closing-prep task can require the assigned owner to confirm four things before funds are expected:

• Known contact: The title or settlement contact and verified phone number are stored in the file.

• Borrower reminder: The buyer received the no-email-only rule in plain language.

• Change protocol: The team knows who pauses the file and who makes the verification call.

• Incident notes: The location for documenting a suspicious message, callback, and escalation is clear.

If your team works in ARIVE, EPC can help place that checkpoint into the workflow and train the people responsible for it through our assisted ARIVE setup and onboarding. ARIVE is recommended, not required; the same control can live in another LOS, CRM, or documented checklist. What matters is that it has an owner and appears at the right time.

If money has already moved

Treat it as urgent. The FBI advises contacting the financial institution immediately and asking it to contact the institution that received the transfer. Report the incident to IC3, preserve the original messages and headers, and follow the bank, title company, lender, insurer, legal, and compliance procedures that apply to the situation.

No checklist can promise recovery, and a broker shouldn’t improvise legal or cybersecurity advice. The team’s useful role is to recognize the event, stop additional movement, preserve information, and connect the affected parties quickly.

Take ten minutes to pressure-test the workflow

Ask a simple question at your next team meeting: if a borrower sent changed wire instructions five minutes from now, who would pause the file, which number would they call, and where would they document the answer? If those answers aren’t immediate, the workflow needs one more pass.

EPC helps brokers build practical processing controls around the moments that create last-minute risk. Review our contract mortgage processing services, or schedule an EPC workflow consultation to map a clear wire-change checkpoint into your file process.

What verification rule does your team use when payment instructions change? Continue the conversation with EPC on Facebook.

---

Educational note: This article provides general educational information, not legal, cybersecurity, banking, compliance, underwriting, or financial advice. Follow the requirements and incident-response procedures of the lender, settlement provider, financial institutions, insurers, regulators, and counsel involved in each transaction.