They wired their down payment — then the email turned out to be fake. Lynette and Scott say the mistake nearly cost them hundreds of thousands of dollars. Now they're warning other homebuyers to double-check every payment detail.

How a one-letter trick cost them time and money

Lynette and Scott were exchanging messages with their mortgage broker when an email arrived that looked exactly like previous correspondence. It matched tone, layout and subject lines — except for a tiny change in the sender's address. "It was identical, but for one keystroke," Scott told Aaron Katersky, ABC News correspondent.

The typo was subtle: the fraudster used two V's where a W should have been, turning "escrow.com" into "escrovv.com." Lynette said the altered address felt like a near-exact duplicate of the broker's domain, and that convinced them to follow wiring instructions that arrived with the fake message.

They wired the funds and then contacted their broker to confirm receipt. The broker had no record of getting the payment. Reality set in fast. "We literally stopped and we prayed, and then we called the police," Scott said.

Many buyers worry about making mistakes after months of work on a home purchase. But few imagine criminals crafting emails that look exactly like the real ones.

Why timing made the case urgent

Orange County has one of Southern California's few dedicated cyber-crime investigative units, and investigators told the couple speed is critical. Sheriff Don Barnes of the Orange County Sheriff's Office said acting fast matters because fraudsters move funds quickly and sometimes convert them into hard-to-trace assets.

"The quicker you recognize it and then take immediate action is key," Barnes said. "The likelihood of recovering that money is almost zero after about 72 hours."

Tracing where the money went

Investigators were able to follow the electronic trail, and they found that most of the money didn't stay in plain bank accounts. A portion was reportedly moved into cryptocurrency — Bitcoin — which investigators told the buyers was effectively unrecoverable once swapped and dispersed.

Still, the Orange County team tracked transactions and worked with banks. After months of investigation, Lynette and Scott said they got back roughly 90% of what they'd wired. Scott described the recovery as "like a dream," while noting about 10% had been converted to Bitcoin and was gone for good.

What kind of scam was it?

The Federal Housing Finance Agency, which monitors risks tied to home financing, lists business email compromise — BEC — as a common scheme that targets mortgage and escrow transactions. In a BEC attack, fraudsters spoof or hijack legitimate email accounts to send payment instructions that steer buyers to accounts the criminals control.

These scams are meant to seem normal. They take advantage of the stress and tight deadlines near closing day. When buyers have to wire money last-minute, that's when scammers strike.

How buyers and brokers can reduce risk

The National Association of Mortgage Brokers urges buyers to verify payment instructions directly over the phone before wiring any money. That means calling a known number for your broker, escrow officer or lender rather than replying to an email thread. Confirm the account number and routing information by voice and log the name of the person you spoke with.

Email domains can be faked easily, and typos are tiny. Just one wrong letter can send a big wire payment to scammers. Always double-check the sender’s domain and never trust payment links without verifying them yourself.

Other simple steps the FHFA and law enforcement recommend include enabling multi-factor authentication on accounts, using secure portals provided by your lender or title company instead of free email for transfer instructions, and treating any urgent payment request as suspect until verified. If you do get an odd instruction, call the company using the phone number on an official statement or your loan documents.

What banks and escrow companies are doing

Some lenders and escrow companies now warn about wire fraud in emails and offer secure portals for verifying wiring info. But not everyone uses these tools, and smaller firms often still rely on email. That leaves buyers at risk, especially when they’re rushed by deadlines.

Banks team up with law enforcement after fraud to try freezing or reversing transfers. The sooner they’re notified, the better the chance of getting money back—especially before it moves into crypto or overseas accounts.

When recovery is possible — and when it's not

Speed is the best hope for getting funds back. Barnes told ABC News that after about 72 hours the odds of retrieving money drop sharply. That timeline reflects both how fast fraudsters move funds and how wire systems are built for speed, not reversals.

Even with rapid response, some money can vanish. Cryptocurrency exchanges and layered transfers across multiple institutions make full recovery difficult. Lynette and Scott found that out: they recovered most of their down payment, but a chunk that moved into Bitcoin didn't come back.

Why this matters for the housing market

This kind of mortgage fraud hurts more than just buyers. It can slow down closings, damage trust, and raise costs if lenders or title companies add new security steps. For buyers already squeezed by high prices and rates, losing down payment money is a big blow.

Frankly, it's also a reminder that fraudsters follow the flow of money. As more homebuyers use wires and as crypto tools make instant transfers possible, attackers adapt fast.

Advice buyers can use right now

Before wiring funds, call a verified number and ask to confirm the recipient and account. Keep copies of all messages and note the time you called and who you spoke with. If anything looks off, pause the transfer. If you're already the victim, report it to local law enforcement, your bank and the FBI's Internet Crime Complaint Center.

And don't assume tech savviness is enough. "We consider ourselves technologically literate," Scott said, "but we knew at that moment that we were over our head."

Related Articles

"The likelihood of recovering that money is almost zero after about 72 hours," said Don Barnes, Orange County Sheriff.