The fake email doesn't have typos anymore. It has your closing instructions

TL;DR

• On September 22, Microsoft took down EvilTokens, a service that got into real email accounts and used AI to hunt through them for payment conversations. Real estate is one of the sectors Microsoft named.
• When the email comes from the title company's actual account, checking the sender tells you nothing. The sender is real.
• A closing has a lot of parties, a date that doesn't move and one large wire that goes out once. That's where a changed account number does the most damage.
• You can lock down your own inbox. The other inboxes on the thread are out of your hands.
• The rule: any email that changes where the money goes gets confirmed through a path you had before that email arrived. No confirmation, no wire, and no exception for "we've worked with them for years."
• What you'll do today: name the person who makes that call, and write down, for every open closing, the number they call.

The short answer. Real estate wire fraud happens when someone sends the buyer, the agent or the title company altered payment instructions so the money lands in a different account. What changed is that the email can now come from one party's real account. Reading the message more carefully won't catch it. What catches it is confirming every account change by calling a number you already had on file.

First, what this page is not saying. It isn't saying you should stop using email to close deals, and it isn't telling you to hire a security firm. We aren't one either. What follows is an office habit, and it costs one phone call.

On Monday we covered how EvilTokens got in: a code typed into Microsoft's genuine sign-in page. Today is about what happens next, once the account has fallen and the person writing from inside it isn't the owner anymore.

1. The email comes from the real account, and the AI has already read the thread

Microsoft announced on September 22 that, with authorization from a federal court in the Eastern District of Virginia, it had taken down the infrastructure behind EvilTokens, seizing 50 websites and disabling more than 150 domains. By the company's count, the service is linked to more than 12,000 compromised inboxes at over 10,000 organizations, in sectors that include construction, financial services and real estate.

For a brokerage, the part that matters is what the service did once it was inside. According to Microsoft, as reported by Axios, an AI assistant combed the mailbox for payment conversations and worked out who controls the money, who they trust and who's worth impersonating. The Hacker News adds that it shipped with ready-made prompts for finding wire-transfer threads and vendor invoices. Then, from that same account, it wrote to the victim's contacts inside and outside the company.

Checking the sender stops working when the sender is genuine

Picture it on a real file. The email lands in the same thread where the title company sent last week's draft closing statement, with the same signature and the same tone. If whoever wrote it read that thread, they can name the property and the closing date without a slip: Axios reports the service used what it found in the inbox to make the fraud more convincing. However carefully you read that email, there's nothing off in it to catch.

2. A closing is where a changed account number hurts the most

Count the people on one closing thread: two agents, the title or escrow company, the lender, sometimes an attorney, the buyer and the seller. Everyone sends documents by email, everyone is in a hurry, and everyone is waiting on a large wire on a date that won't move.

The FBI uses this exact case on its own page about the scheme: a homebuyer gets a message from his title company with instructions for wiring the down payment, and the message is fake. Back in 2018, the FBI's Internet Crime Complaint Center (IC3) was already reporting complaints from every seat at the table: title companies, law firms, agents, buyers and sellers. Most described the same thing, an email asking to change the payment method or the receiving account.

The closing-day rush is what the fake email is counting on

Nobody wants to be the one who holds up a closing. That's why the most dangerous sentence in the business is "we need the funds today, and the account changed." The FBI puts it plainly: be especially wary when the person asking is pushing you to act fast.

3. You can lock your own inbox. The title company's isn't yours to lock

In July we published five moves to lock down an office, and its lockdown guide still holds up: two-factor on email and banking, a properly configured domain, knowing who has access to what. If you haven't done it, do it. Lock your door.

That guide protects your account, though. In a closing, the account that falls can belong to any of the other parties, and you don't configure theirs. An office can have everything in order and still get an email from its usual title company that someone else wrote.

What is up to you is what happens to an email that asks to move money

That decision fits in one sentence: in your office, no email, however real it looks, is enough on its own to change where the money goes.

4. Wednesday's rule, now with money on the line

Yesterday, in the piece on the assistant that calls on your customer's behalf, an appointment requested by a machine stayed pending until the customer confirmed it from their own phone. Today's rule is the same one, made stricter because the stakes are a wire: only a number you already had counts here.

Any email that changes where the money goes gets confirmed through a path you had before that email arrived. No confirmation, no wire.

The idea isn't ours, and that's a point in its favor. Back in 2018 the IC3 was already telling real estate parties to set up "a secondary means of communication for verification purposes," and the FBI's page says to look the number up yourself and skip the one in the message. What we add is the order and the habit.

"A path you had before" means the phone number in the contract, the file or your contacts from before this email showed up. The one in the email signature doesn't count, since the same email could have swapped it, and neither does one behind a link. And you place the call. An incoming call saying "yes, that's right" confirms nothing, because the same 2018 IC3 notice reported scammers phoning to "confirm" the change themselves.

The vendor you've always used is exactly the account they'll use

Everyone wants the same exception: "but we've worked with this title company for years." That is precisely the account a machine would pick, because what it was looking for in the mailbox was who you trust. A rule that waves through your regulars protects you from strangers, and strangers rarely write.

5. The second path: four questions before a single dollar moves

On most closings, the big wire doesn't leave your office. Your buyer sends it, to the account the title company gives them. So for your office the rule kicks in at three moments: when you forward or walk a client through payment instructions, when your office sends or holds a deposit, and when someone asks the title company to change the account your commission is paid to. Everywhere else it protects your client, as long as they hear it in time. That's step 3 below. Each question is a yes or a no, and every no comes with its fix.

1. Does this email change where the money goes? A new account, "we've updated our payment details," wire instructions that differ from the ones you had, or a payment that was going by check and now "needs to be a wire," which the IC3 lists as a warning sign. Fix: if yes, flag it, and nothing gets paid from that email today. Replying to the same email to ask doesn't count as confirming.

2. Do you have a number for that person or company from before this email? From the contract, the file, your contacts, the first meeting. Fix: if not, pull it yourself from an earlier document, or from the company's official site with the address typed into your browser by hand. Never from the signature or a link in the email.

3. Did you call that number yourself, and did someone you already know confirm the change? Fix: if the confirmation came on a call you received, or as a reply on the same thread, hang up and dial out yourself.

4. Is it written down who confirmed, at what number and at what time? Fix: one line in the file. If anyone asks tomorrow, the answer doesn't live in someone's memory.

None of the four gets skipped because it's the usual vendor, or because the closing is today.

It applies to us, too. If you ever get an email from Hub365 AI saying we've changed the account you pay us at, run all four on us. We'd rather you did.

The awkward-call conversation

Todd: Here's something the rule doesn't say out loud. If the title company's account was taken over, they're often the last to know. Whoever got in can hide the emails they send from that inbox.

Naty: Which changes how that call feels. Real estate is one of the businesses I've run, and this is the call everybody puts off. Asking your usual title company "did you really send this?" can feel like telling them you've stopped trusting them.

Todd: Picture it from their end. You may be the first one telling them something is wrong on their side. And a wire that's already gone often doesn't come back.

Naty: So you open with that. "Something came in under your name, and I wanted you to know." That's a call people are glad to get.

What you'll do today

One thing: write down who calls, and what number they call, for every closing you have open. Fifteen minutes.

1. Name one person in the office who makes the confirmation call whenever an email touches payment. If that person is out, the payment waits, and the other parties hear why that same day.
2. For every open closing, record today the phone numbers for the title company, the lender and the client, taken from the contract or the file, not from an email. A sheet or a CRM field works, as long as it's one place.
3. Write the rule in one line and tell every client when the file opens: "If you get an email that changes where to send the money, from anyone, even the title company, don't send anything. Call us at this number first."

Frequently asked questions

What do I do if I already sent a wire and think the account was fake? Call your bank right away and ask them to try to recall the wire: in the real estate section of its 2018 notice, the FBI's IC3 stresses that time matters more than anything else. Then report it to the FBI and at ic3.gov. This isn't legal advice; what your office owes the other parties to the closing is a question for your attorney.

Can I confirm by text instead of calling? The path matters more than the device: a number you had before the email, and you start the conversation. Still, a call where you hear someone you already know is stronger confirmation than a text. And a message that shows up asking you to "confirm" doesn't count, whatever channel it arrives on.

What if the number in the signature matches the one I have on file? Then call the one on file, which is the same number, and you've followed the rule. What doesn't count is using the signature's number because it looks right. The email could have changed it.

Is this a service you sell? No. We're not a cybersecurity firm, and nobody sells this rule. You agree on it as an office and you stick to it. If your office needs a technical review of its email or systems, that's work for a specialist.

What if my business isn't real estate? It still works. It applies to any business that pays vendors or gets paid by wire: accountants, contractors, distributors, law firms. Today's examples come from closings because one wire weighs more there, and because Microsoft named the sector among those hit.

To close

What this week leaves a brokerage fits on one sheet: the name of the person who makes the call, and next to every open closing, the numbers you had before any email showed up.

The rest is habit. Clients hear it on day one, someone calls every time an email touches the money, and a line goes in the file.

The well-written fake could land tomorrow. In your office, on its own, it no longer moves a dollar.

Want to walk through how payments get confirmed in your office today? A 30-minute call, free, no strings.

And if you want one practical AI move a week, no hype: subscribe to The AI Edge.

Thanks for reading this far. If you write one number into one file today, that closing is already safer than it was this morning.

Keep reading

• Your next customer won't call. They'll send their assistant - Wednesday's piece, with the same rule applied to appointments
• The email and the phone call stopped proving who's there - Monday's roundup, with how EvilTokens got in
• Hacking your business now costs $50 and a machine does it - the five moves to lock down your own office
• Turning that setting off doesn't erase what you already typed - what client data never goes into an AI chat
• Business Email Compromise, FBI - the FBI's page on this fraud, including how to verify an account change

Sources

• Microsoft disrupts AI-powered cybercrime service, Axios, Sam Sabin, September 22, 2026 - https://www.axios.com/2026/09/22/microsoft-eviltokens-court-takedown
• Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises, The Hacker News, Ravie Lakshmanan, September 22, 2026 - https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html
• Disrupting EvilTokens: the AI chatbot built for cybercrime, Microsoft, September 22, 2026 - https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/
• Business Email Compromise, FBI, page updated April 8, 2026 - https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise
• Business E-mail Compromise: The 12 Billion Dollar Scam, FBI IC3, notice I-071218-PSA, July 12, 2018 - https://www.ic3.gov/PSA/2018/PSA180712