99% Authentic: How Wire Fraud and Lookalike Emails Fool Careful People

Imagine you are buying a home. You have saved for years, the mortgage is approved and closing is a few days away. An email arrives from your real estate agent’s address with updated wiring instructions. The contract matches the one in your hand. The signature block looks right. The details are 99 percent perfect. You begin the transfer, and your bank calls to ask if you are sure you want to send the money to an account in a country you have no connection to. The one percent that was wrong was a single letter in the email domain. This scenario, drawn from the original article, remains one of the most costly scams in the world, and it works on careful, intelligent people.

1. What business email compromise is

Business email compromise, or BEC, is a category of fraud in which a criminal impersonates a trusted person to redirect a payment or extract information. The impersonation may use a hacked account, a spoofed display name or a lookalike domain that differs from the real one by a character or two.

BEC targets individuals and organizations alike. Common victims include home buyers, small businesses paying invoices, employees who receive requests from an apparent boss and people sending funds to attorneys or contractors. The FBI’s Internet Crime Complaint Center, which received 1,008,597 complaints in 2025 with reported losses of $20.877 billion across all crime types, treats this as one of the major categories of financial cybercrime.

The reason it persists is that it is cheap and scalable. A scammer needs an email address, some research and a bank account that can receive funds.

2. The anatomy of a lookalike email

The weakness in the story above is a domain “slightly different from the actual one.” Common tricks include:

Trick	Example pattern	How to catch it
Letter swap	Replacing “m” with “rn” or “l” with “1”	Read slowly and zoom in
Added word	Adding “-legal” or “-title” to a real name	Compare to a known address
Different extension	Using .co instead of .com	Check the ending
Display-name spoofing	Name shows “Jane Smith” but the address differs	Tap the name to reveal the address
Compromised real account	The email genuinely comes from the agent’s address	Verify requests by phone, especially changes

The last one is the hardest. If the real account is hacked, every technical check passes. That is why the golden rule is to confirm payment instructions through a separate channel.

3. How criminals know your deal

Victims often ask how a stranger knew their closing date, the names of the parties or the amount. There are several sources.

A compromised mailbox. If an agent, lawyer or title company has been hacked, the criminal can read the thread and time the message.
Public filings and listings. Property sales, permits and business filings are public.
Social media. Announcements about moving or buying give criminals timing.
People-search sites. Profiles reveal names, addresses, phones and relatives, which help criminals build convincing impersonations. Read scammers finding personal information online and targeting homeowners for details.

Reducing what is public does not remove the risk of a hacked mailbox, but it makes research harder.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

4. A verification routine for any payment

Adopt a routine that you follow every time money is moving.

Treat changed instructions as suspicious. Any email that changes where to send funds deserves a phone call.
Call a number you already trust. Use the number on the agent’s website or from your first meeting, not one in the email.
Verify account details aloud. Confirm the bank name, the last digits of the account number and the recipient.
Delay if pressured. Real closings and invoices can survive a one-hour verification. Urgency is a tool of the scammer.
Use secure portals. Where an organization offers a portal or encrypted document exchange, use it instead of email.
Send a small test payment if the institution allows it, and confirm receipt before sending the rest.
Ask your bank about verification services for payee names or call-back confirmations.

These steps cost minutes. The alternative can cost a lifetime of savings.

5. If you have already sent money

Time is critical. Funds sent by wire can sometimes be recalled if the bank is contacted quickly, before the money is moved on.

Call your bank immediately and ask for a wire recall and a fraud investigation. Use the number on your bank’s official website or card.
File a report at the FBI’s Internet Crime Complaint Center at ic3.gov. Include account details, email headers and the timeline.
Report to local police and keep the report number.
Notify the other parties. Tell your agent, lawyer or title company that their email may be compromised.
Secure your accounts. Change passwords and check for forwarding rules or unknown logins in your email.
Watch for follow-up scams. Fraudsters sometimes pose as recovery services.
Report at IdentityTheft.gov or ReportFraud.ftc.gov as appropriate.

For a broader checklist, see steps to take after falling for a scam.

6. Protecting your email and your accounts

Because compromised mailboxes make impersonation possible, secure your own.

Use a unique password and multi-factor authentication on email.
Look for forwarding rules or filters you did not create.
Do not click links in unexpected messages. Our guide on phishing for personal info explains how hooks work.
Keep software updated, and use a separate email for financial activity.
Share deal information only with the people who need it.

The broader landscape of fraud is described in how to deal with online scams and scammers are getting sneakier.

7. Warning signs inside the message itself

Even a polished fraud email usually contains small tells if you look for them. The tone may be slightly off for the sender, with unusual phrasing or a sudden rush. The message may ask you to keep the matter confidential or avoid calling. The reply-to address may differ from the sender, so that your answer goes to the criminal. The attachment may be a revised invoice rather than the original, and the account details may point to a different bank, city or country than previous payments. Train yourself to notice any one of these and treat it as enough reason to pause.

8. What organizations can do to protect clients

If you work for a real estate, legal, financial or small business, you can reduce the chance that your clients become victims. Send wiring instructions through a secure portal rather than a plain email, tell clients early that your instructions never change by email and give them a phone number to confirm. Use multi-factor authentication on every mailbox, review forwarding rules regularly and train staff to recognize spoofed domains. Register common misspellings of your own domain where practical, so criminals cannot easily use them. Warn clients in writing at the start of a transaction, because the warning is most effective before the pressure of closing begins. The FBI offers current guidance and a reporting channel through ic3.gov.

9. Three scenarios

Scenario 1: A vendor emails new bank details. Do not pay. Call the vendor at a number from an earlier invoice or their official site and ask them to confirm the change. If they did not send it, notify them and your bank.

Scenario 2: You are moving and receive a message from “your title company.” Verify with the title company by phone, using the number on your contract, before acting on any instruction.

Scenario 3: A message from your “boss” asks for gift cards. Real executives do not demand gift cards by email. Call or message through a verified channel.

10. What to expect: a realistic timeline

Event	Typical timing
Verification call	5 to 10 minutes
Bank wire recall window	Hours; the sooner the better
IC3 report	20 to 30 minutes to file
Investigation outcome	Weeks to months, with uncertain recovery

11. Common mistakes

Trusting an email because the contract looks identical.
Calling the number provided in the suspicious message.
Waiting until the next business day to tell the bank.
Assuming a legitimate sender’s account cannot be hacked.
Posting about a purchase or move before it closes.

12. How Wiperts reduces the material scammers use

Impersonators succeed when they know details about you. Wiperts scans more than 100 data brokers and people-search sites for your name, address and phone number, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so that relisted data is removed again. It cannot stop a hacked email account, but it takes away some of the free research that makes scams convincing.

See what a scammer could find about you.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

13. Key takeaways

Lookalike domains and hacked mailboxes make fraudulent emails look genuine.
Verify any payment or change of instructions by calling a trusted number.
If you sent funds, call your bank immediately and file at ic3.gov.
Reduce the public details criminals use to craft convincing messages.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

14. Frequently Asked Questions

What is business email compromise?

It is a fraud in which criminals use a spoofed, lookalike or hacked email account to impersonate a trusted party, such as an agent, lawyer, vendor or executive, and trick someone into sending money or sensitive data.

How do I spot a lookalike domain?

Read the sender’s address character by character. Fraudsters swap letters, add words or change the ending, such as using a similar name with a different extension. Hover over links and verify through a separate channel.

How should I verify wire instructions?

Call the sender at a phone number you already know or find independently, not one from the email. Confirm account details out loud, and never accept a last-minute change by email alone.

What if I already sent the money?

Call your bank immediately and ask for a wire recall or fraud hold. Then file a report at ic3.gov and with local police. Speed matters, since funds are often moved within hours.

Why do these scams work on careful people?

The documents often look genuine, the timing fits a real transaction and the scammer has researched details. The urgency of a closing date or payment deadline discourages double-checking.

How do criminals know about my transaction?

They may have compromised an email account, monitored public listings and filings or used personal information from people-search sites to identify parties and timing.

Sources

ic3.gov

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing