How exactly does the Business Email Compromise scam work in a property transaction?

The attack has several variations, but the most common pattern in real estate transactions works as follows: The attacker either compromises the email account of someone involved in the transaction (notario, escrow agent, real estate agent, or their office email server) or creates a spoofed email address that looks nearly identical to the legitimate one (e.g., jorge.notario@firm-mx.com becomes jorge.notario@firm-mx.co — one character difference). The attacker monitors email communications, waiting for the right moment: typically 24–72 hours before closing when wire instructions are being confirmed. They then send an email appearing to be from a trusted party — often with the exact same email thread, signature, and formatting as previous communications — stating that the wire instructions have changed due to a bank account issue, company restructuring, or simply 'updated details.' The new wire instructions send the money to an account controlled by the attacker, often in a different country than the legitimate account. By the time the buyer discovers the fraud — usually when the actual closing party says they haven't received funds — the money has been moved through several accounts and is largely unrecoverable.

What should I do if I receive an email saying the wire instructions have changed?

Stop. Do not click any links in the email. Do not call any phone number in the email. Do not reply to the email until you have verified the change is legitimate. Your verification process: (1) Open your address book, phone contacts, or business card — find the phone number for the notario, escrow company, or agent that you established before this communication arrived. (2) Call that number. Do not use a number from the suspicious email — scammers often include a fake phone number so that even your 'verification call' goes to them. (3) Speak directly with the person who is supposed to have sent the email. Ask them to confirm, verbally, the account number they want you to wire to. (4) Have them email you the wire instructions again from within the original email chain if you need written confirmation — then verify the email came from the same address as all previous communications. (5) If you cannot reach the person by phone, do not wire until you can. Delaying a wire by one day is far better than losing your entire purchase price.

How do I establish the 'verified phone number' before closing?

At the start of the closing process, when you first engage with your notario, escrow company, or closing attorney, ask them directly: 'What phone number should I use if I ever need to verify wire instructions or closing details with you?' Get this number in writing (via email from their verified address) and save it in your phone contacts labeled clearly, e.g., 'Notario Garcia VERIFIED.' When you first call them at the start of the process, note the callback number from the call. In Mexico, your notario's office will have a direct phone line and possibly a WhatsApp number — confirm both. For escrow companies, their main office number (found on their verified website) is your backup. The critical discipline is this: never call a number that arrives in a suspicious email, even if the email looks entirely legitimate. Your verification number was established days or weeks ago — use that one.

If I've already wired money to the wrong account, what should I do immediately?

Act within hours — every minute matters. (1) Call your bank immediately — tell them you believe you are a victim of wire fraud and need an urgent wire recall. Ask for an immediate recall request (also called a SWIFT gpi recall). Provide the exact wire details: amount, date, receiving bank, account number. (2) File a police report in Canada with your local police service. This creates a legal record required by your bank. (3) Contact the FBI's IC3 (ic3.gov) if the receiving account was in the US, or RCMP if relevant. (4) Contact the receiving bank directly through their official customer service — ask for their fraud department and inform them of the fraudulent receipt. Some banks can freeze the receiving account before funds are moved if notified quickly. (5) Contact your notario or closing attorney and inform them of the fraud — they may have additional contacts with local law enforcement or banking regulators in the destination country. Recovery is not guaranteed, but acting within the first 24–48 hours significantly improves the odds of a successful recall.

Does this scam happen specifically in Mexico, or everywhere?

BEC real estate fraud occurs globally and has been documented extensively in the United States, Canada, Australia, the United Kingdom, and throughout Europe. Mexico is not uniquely targeted — but Canadian buyers purchasing in Mexico are at elevated risk for several structural reasons: they are wiring large amounts (often $200K–$500K+ USD) internationally for the first time, to an unfamiliar foreign banking system, in a language they may not fully understand, under time pressure from a closing process they cannot physically attend. The combination of high transaction value, geographic distance, language barrier, and unfamiliarity with local banking creates maximum vulnerability. The same vigilance is required for any international property purchase — Mexico, Portugal, Costa Rica, Dubai, Thailand — wherever you are wiring a significant amount.

Should I use an escrow service for my Mexican property purchase?

Yes — for large transactions, a reputable Mexican escrow service adds a layer of protection. Mexican escrow (custodia) keeps your funds in a segregated account held by a licensed fiduciary until both parties confirm all closing conditions are satisfied. Major Mexican escrow providers include Stewart Title Latin America, First American Title, and several others with Canadian buyer experience. The escrow company's wire instructions should be verified using the same protocol as notario wire instructions — call using a number established before the closing process. Even with escrow, the wire verification protocol applies: the escrow company's account details must be verified by voice before your first transfer. The advantage of escrow is that the money is held neutrally until both parties confirm receipt and conditions are met — reducing the risk of sending funds to a notario's account that may itself be compromised.

How exactly does the Business Email Compromise scam work in a property transaction?

The attack has several variations, but the most common pattern in real estate transactions works as follows: The attacker either compromises the email account of someone involved in the transaction (notario, escrow agent, real estate agent, or their office email server) or creates a spoofed email address that looks nearly identical to the legitimate one (e.g., jorge.notario@firm-mx.com becomes jorge.notario@firm-mx.co — one character difference). The attacker monitors email communications, waiting for the right moment: typically 24–72 hours before closing when wire instructions are being confirmed. They then send an email appearing to be from a trusted party — often with the exact same email thread, signature, and formatting as previous communications — stating that the wire instructions have changed due to a bank account issue, company restructuring, or simply 'updated details.' The new wire instructions send the money to an account controlled by the attacker, often in a different country than the legitimate account. By the time the buyer discovers the fraud — usually when the actual closing party says they haven't received funds — the money has been moved through several accounts and is largely unrecoverable.

What should I do if I receive an email saying the wire instructions have changed?

Stop. Do not click any links in the email. Do not call any phone number in the email. Do not reply to the email until you have verified the change is legitimate. Your verification process: (1) Open your address book, phone contacts, or business card — find the phone number for the notario, escrow company, or agent that you established before this communication arrived. (2) Call that number. Do not use a number from the suspicious email — scammers often include a fake phone number so that even your 'verification call' goes to them. (3) Speak directly with the person who is supposed to have sent the email. Ask them to confirm, verbally, the account number they want you to wire to. (4) Have them email you the wire instructions again from within the original email chain if you need written confirmation — then verify the email came from the same address as all previous communications. (5) If you cannot reach the person by phone, do not wire until you can. Delaying a wire by one day is far better than losing your entire purchase price.

How do I establish the 'verified phone number' before closing?

At the start of the closing process, when you first engage with your notario, escrow company, or closing attorney, ask them directly: 'What phone number should I use if I ever need to verify wire instructions or closing details with you?' Get this number in writing (via email from their verified address) and save it in your phone contacts labeled clearly, e.g., 'Notario Garcia VERIFIED.' When you first call them at the start of the process, note the callback number from the call. In Mexico, your notario's office will have a direct phone line and possibly a WhatsApp number — confirm both. For escrow companies, their main office number (found on their verified website) is your backup. The critical discipline is this: never call a number that arrives in a suspicious email, even if the email looks entirely legitimate. Your verification number was established days or weeks ago — use that one.

If I've already wired money to the wrong account, what should I do immediately?

Act within hours — every minute matters. (1) Call your bank immediately — tell them you believe you are a victim of wire fraud and need an urgent wire recall. Ask for an immediate recall request (also called a SWIFT gpi recall). Provide the exact wire details: amount, date, receiving bank, account number. (2) File a police report in Canada with your local police service. This creates a legal record required by your bank. (3) Contact the FBI's IC3 (ic3.gov) if the receiving account was in the US, or RCMP if relevant. (4) Contact the receiving bank directly through their official customer service — ask for their fraud department and inform them of the fraudulent receipt. Some banks can freeze the receiving account before funds are moved if notified quickly. (5) Contact your notario or closing attorney and inform them of the fraud — they may have additional contacts with local law enforcement or banking regulators in the destination country. Recovery is not guaranteed, but acting within the first 24–48 hours significantly improves the odds of a successful recall.

Does this scam happen specifically in Mexico, or everywhere?

BEC real estate fraud occurs globally and has been documented extensively in the United States, Canada, Australia, the United Kingdom, and throughout Europe. Mexico is not uniquely targeted — but Canadian buyers purchasing in Mexico are at elevated risk for several structural reasons: they are wiring large amounts (often $200K–$500K+ USD) internationally for the first time, to an unfamiliar foreign banking system, in a language they may not fully understand, under time pressure from a closing process they cannot physically attend. The combination of high transaction value, geographic distance, language barrier, and unfamiliarity with local banking creates maximum vulnerability. The same vigilance is required for any international property purchase — Mexico, Portugal, Costa Rica, Dubai, Thailand — wherever you are wiring a significant amount.

Should I use an escrow service for my Mexican property purchase?

Yes — for large transactions, a reputable Mexican escrow service adds a layer of protection. Mexican escrow (custodia) keeps your funds in a segregated account held by a licensed fiduciary until both parties confirm all closing conditions are satisfied. Major Mexican escrow providers include Stewart Title Latin America, First American Title, and several others with Canadian buyer experience. The escrow company's wire instructions should be verified using the same protocol as notario wire instructions — call using a number established before the closing process. Even with escrow, the wire verification protocol applies: the escrow company's account details must be verified by voice before your first transfer. The advantage of escrow is that the money is held neutrally until both parties confirm receipt and conditions are met — reducing the risk of sending funds to a notario's account that may itself be compromised.

The Wire Transfer Scam Targeting Foreign Property Buyers | Compass Abroad

Reviewed on March 2026 by the Compass Abroad editorial team

Business Email Compromise (BEC) real estate fraud intercepts or spoofs email communications near closing and sends fake wire instructions to the buyer. The scam works because it arrives from a convincing email address, uses the right terminology, creates urgency, and exploits the legitimate complexity of international closing. The defense is simple and absolute: NEVER change wire instructions based on email alone. Call the notario directly using a phone number you established before this email arrived.

The FBI reported over $446 million in BEC real estate losses in 2022 alone — and that is only in the United States. Recovery rates are low because international wires clear quickly and funds move through multiple accounts. Canadian buyers purchasing in Mexico, Portugal, Costa Rica, or Dubai are exactly the high-value targets this fraud is designed for: large amounts, unfamiliar foreign banking, geographic distance, and time pressure.

Key Takeaways

Business Email Compromise (BEC) real estate fraud works by intercepting or spoofing email communications near closing, then sending fake wire instructions to the buyer.
The scam typically arrives as a last-minute email — often appearing to be from the notario, escrow company, or your agent — with 'updated' banking details. The urgency is manufactured.
NEVER change wire instructions based on email alone. Call the notario, escrow company, or agent directly using a phone number you established before the closing process began.
Never call a phone number included in a suspicious email — the scammer may also provide a fake phone number. Use numbers from your existing contacts, business cards, or the company's verified website.
Wire transfers are essentially irreversible once sent. Banks can attempt a recall, but recovery rates are low — especially for international transfers to foreign accounts.
Canadian buyers are particularly vulnerable because they are wiring large amounts ($200K–$500K+ USD) internationally, often for the first time, to an unfamiliar foreign banking system.
The scam exploits the legitimate complexity of international closings — wire instructions do change legitimately, which is why the fraudulent version is convincing.
If wire instructions change at any point during the process, your verification call should follow the same protocol used for the original instructions — regardless of how routine the change seems.

Wire Transfer Fraud: Key Facts for International Buyers

Annual BEC real estate losses (USA): Over $446 million USD in 2022 (FBI IC3 Report)(FBI Internet Crime Complaint Center (IC3) 2022)
How the scam typically starts: Attacker compromises the email of notario, escrow company, agent, or their infrastructure(FBI / cyber security research)
Timing: Most commonly triggered 24–72 hours before closing — when urgency is real and buyers are distracted(Industry pattern)
Recovery rate: Very low for international wires — the FBI estimates less than 25% of losses are recovered(FBI IC3)
The one defense that works: Voice verification using a phone number established before the closing process — never a number from the suspicious email(FBI / cybersecurity best practice)
SWIFT recall window: 24–48 hours is critical; after 72 hours, international wire recalls become very difficult(Banking practice)
Most targeted buyer profile: Foreign buyers wiring large amounts to unfamiliar foreign banking systems — exactly the profile of a Canadian buying in Mexico(Industry pattern)
Most common delivery method: Spoofed email addresses that look identical to legitimate contacts — check the actual From address, not just the display name(Cybersecurity research)

How the Scam Works: A Step-by-Step Account

Imagine this scenario. You’ve been working with your bilingual agent in Puerto Vallarta for two months. Your notario has been conducting due diligence. Closing is in 3 days. You receive an email from “your notario,” complete with their signature, professional email footer, and the same warm tone as all previous communications. The email says:

“Due to our bank’s recent system change, please note our trust account has been updated. Please use the following wire instructions for your closing transfer: [account number, SWIFT, routing]. This is urgent as your closing date is approaching. Please confirm receipt of these updated instructions.”

The email address looks right. The signature looks right. The context — bank system changes, closing urgency — sounds plausible. You wire $285,000 USD. The actual notario calls you the next day to confirm when you’re sending funds. The money is gone.

What actually happened: the attacker either compromised the notario’s email account (or a member of their staff’s account), or spoofed an email address that looked nearly identical — differing by one character, using a different top-level domain (e.g., .com vs .com.mx), or using a display name that matched the notario while the actual sending address was different. The attacker was monitoring the email thread, waiting for the moment when wire instructions would be expected.

The defense that prevents this, without exception: call the person who supposedly sent the email using a phone number you already had before this email arrived.

The Wire Verification Protocol: Apply This to Every International Transfer

These steps apply to every wire transfer in a foreign property purchase — original instructions AND any subsequent changes:

Establish verified phone numbers early. At first contact with your notario, escrow company, and agent — before any wire discussion — ask for and record their direct phone numbers. Confirm by calling them once from those numbers. Save the numbers in your contacts clearly labeled.
For every wire transfer, call to verify BEFORE sending.Whether it’s the first wire or a change to previous instructions — call using your pre-established number, ask the person to verbally confirm the exact account number and bank. Write it down during the call.
Never use a phone number from a suspicious email.Attackers sometimes include a fake phone number in the fraudulent email so that your “verification call” goes to them. Your only safe numbers are ones you established before this closing process.
Check the actual From address, not just the display name.In most email clients, the display name (e.g., “García Notario”) is separate from the actual sending address. Click or hover to see the real address. Compare it character-by-character to previous emails.
If you cannot reach them by phone, do not wire. Missing a same-day deadline is recoverable. Losing $300,000 is not. Wait until you have voice confirmation.
Report any suspicious email to your agent and the notario immediately— even if you haven’t acted on it. They may have had their email compromised and not know it yet.

Why Canadian Buyers Are a High-Value Target

This scam targets all international real estate buyers, but Canadian buyers in Mexico and other popular destinations share a vulnerability profile that makes them particularly attractive targets:

High transaction values: Most Canadian buyers are purchasing properties in the $250,000–$600,000 USD range — a single successful fraud pays well.
Geographic distance: Canadian buyers are typically managing the closing from thousands of kilometres away, making in-person verification impossible.
Unfamiliar banking systems: A Canadian sending funds to a Mexican notario’s trust account for the first time is less likely to notice if the routing details differ from expectations.
Language barrier: Even buyers working with bilingual agents are navigating some Spanish-language documentation — this creates additional cognitive load that scammers exploit.
Time pressure: Foreign closings often have real timing constraints (the notario’s schedule, SRE permit expiry, promissory agreement closing date) — attackers exploit the genuine urgency.
First-time international wires: Many Canadian buyers are wiring internationally for the first time. The unfamiliarity with the process makes the attacker’s fake instructions less suspicious.

If You've Already Sent Money to the Wrong Account: Act Immediately

Recovery is difficult but not impossible within the first 24–48 hours. The moment you suspect fraud:

Call your bank immediately. Tell them you are a victim of wire fraud and need an urgent SWIFT recall. Provide the exact wire details. Every minute matters.
Request the bank contact the receiving bank directly via SWIFT to freeze the account. Some banks have direct fraud desk contacts with common receiving banks.
File a report with your local police — this is required documentation for your bank’s fraud claim.
Report to the Canadian Anti-Fraud Centre (CAFC) at antifraudcentre.ca — they coordinate with international law enforcement.
Contact the receiving bank directly through their official fraud department line — not the number from the fraudulent email.
Notify your notario and agent — the attacker may have compromised their systems and other clients may be at risk.

Wire fraud is not a Canadian consumer protection issue with recourse like credit card fraud. Banks are not liable for authorized wire transfers that prove fraudulent — you authorized the transfer, making recovery a law enforcement matter, not a banking dispute.

Work With Agents Who Take Security Seriously

Compass Abroad-vetted agents know the wire verification protocol and help Canadian buyers establish secure closing communications from day one. Your first phone call to any agent in our network is the number you use to verify any wire instruction for the entire transaction.

Get Matched With a Vetted Agent

The Wire Transfer Scam Targeting Foreign Property Buyers