What the FBI's 2025 Cyber Crime Numbers Mean for Your Next Wire Transfer

The Federal Bureau of Investigation's Internet Crime Complaint Center published its 2025 annual report. The number small landlords should pull from it is not the 20.8 billion dollar headline. It is the 275.1 million dollars in losses from real estate fraud, split across 12,368 complaints — the largest line item most owners never see on their closing disclosure, and the one most owner's title policies will not pay out.

Yesterday's brief covered the paper side of property fraud: forged quitclaim deeds, county recorders, chain of title. Today's brief covers the cyber side, and the two together describe the same attack surface from different angles. A fraudster who can fool a recorder into accepting a forged deed has crossed the trust threshold of the land records system. A fraudster who can fool a buyer or seller into sending a closing wire to the wrong account has crossed the trust threshold of the closing table. Both attacks work because each side assumes the other is doing the verification. Most of the time, neither is.

Section 1: Today's Lens — what the FBI's 2025 numbers actually say about your closing

The 2025 Internet Crime Report is the Federal Bureau of Investigation's fifteenth annual accounting of cyber-enabled crime reported to the Internet Crime Complaint Center. The headline number — 20.8 billion dollars in losses across 1,008,597 complaints, a 26 percent year over year increase — captures how broad the attack surface has become. The number that matters for a small real estate owner is narrower.

Real estate fraud. The FBI received 12,368 real estate fraud complaints in 2025, with reported losses of 275.1 million dollars. HousingWire's summary of the FBI's report put the per-complaint average at just over 22,000 dollars — consistent with what we know about the median wire at closing on a single-family or small multifamily property. That is not the loss from institutional commercial real estate transactions; that is the loss from the kind of closing an independent owner actually runs.

Business email compromise. BEC moved into the second-largest loss category at 3.04 billion dollars across 24,768 complaints, up from 2.77 billion in 2024. BEC is the umbrella term for the attack pattern most often used at real estate closings: an attacker compromises or impersonates an email account belonging to a buyer, seller, attorney, title agent, or escrow officer, then sends revised wire instructions that redirect the closing funds to an attacker-controlled account. The average BEC loss is far higher than the average real estate fraud loss because the dollar value of a single closing wire is high and the attack is one-shot.

AI-assisted schemes. The 2025 report documented more than 22,000 complaints referencing artificial intelligence, with adjusted losses exceeding 893 million dollars. The FBI's own examples were specific: chat generators producing official-sounding emails that mimic a company officer's writing style, and voice cloning that lets an attacker impersonate a known counterparty on a phone call. Both attack patterns apply directly to real estate closings, where the buyer or seller has often been in email and phone contact with the same title officer or attorney for weeks.

Elder fraud. Adults aged 60 and over filed 201,266 reports in 2025 with 7.75 billion dollars in losses, a 37 percent increase in complaint volume and 59 percent increase in dollar losses from 2024. The long-tail of real estate BEC disproportionately hits older owners and trusts because the wire instruction typically goes to the older party and the verification chain is shorter.

What the numbers do not say is just as important. IC3 only counts reported complaints. The American Land Title Association's 2026 Claims Guide notes that many wire fraud attempts are never reported to the FBI at all. The real loss number for real estate wire fraud in 2025 is almost certainly several times the 275.1 million dollar figure.

The coverage gap most owners do not know about

Here is the part that breaks the assumption most owners make about closing protection. A standard owner's title insurance policy, whether issued on an admitted carrier or through the surplus lines market, covers defects in the title to the property itself — forgeries in the chain of title, recording errors, missing heirs, undisclosed liens. It does not cover losses from wire fraud, even when the wire fraud is what allowed the underlying defect to occur.

Lender's title policies are similarly narrow. They protect the lender against title defects that affect the lender's lien position, not the borrower against a misdirected wire.

The American Land Title Association issued the ALTA 49 endorsement to close part of this gap. ALTA 49 is an optional endorsement to an owner's policy that adds coverage for losses caused by post-closing forgery and seller impersonation fraud — the specific scenarios that the FBI's real estate fraud complaint data documents. It is not free, and not every title agent offers it, but it is now the closest thing the title industry has to a wire fraud coverage backstop on a standard residential closing.

Cyber insurance, by contrast, is its own line. Standalone cyber policies and the social engineering fraud endorsements on a commercial package policy can cover wire fraud, but the sublimit is often capped at 50,000 to 250,000 dollars even on a 1 million dollar cyber tower. Read the sublimit, not the tower limit, before you assume a policy covers the next closing wire.

What a closing should look like in 2026

The mitigation playbook is well established at this point, but most owners still skip one or more steps. The closing protocol should be:

1. Insist on a phone call to a known number — not a number from the email containing the new wire instructions — to verify any change in wire instructions, no matter how plausible the email looks. If the title agent says they sent the wire instructions twice and the second one is different from the first, treat the second as untrusted until you have called.
2. Use a wire verification service like Closinglock, CertifID, or Fundsend. These services generate a one-time code or QR that the title side and the buyer side both have to enter, and they have become table stakes for any title operation that has processed more than a few hundred closings.
3. Ask your title agent in writing before closing whether they carry ALTA 49 and whether you can add it to your owner's policy for this transaction. If the answer is no, ask whether they will accept a cyber endorsement on your existing commercial package for this specific closing.
4. Decline any last-minute wire instruction change, even if it comes from a familiar email address. Treat the change request as the attack, not the verification.

Section 2: One Market, One Metric — Maricopa County, Arizona

The FBI's IC3 2025 report ranks states by total cyber crime losses, but the more useful number for an independent owner evaluating a market is per-capita loss rate. Arizona, and the Phoenix metropolitan area in particular, has consistently placed near the top for both per-capita complaints and per-capita dollar losses in recent IC3 annual reports.

The FBI's reported loss per 100,000 residents in Arizona in 2025 was well above the national median. Maricopa County, which contains the city of Phoenix and accounts for roughly 60 percent of Arizona's population, drove the majority of the state's complaint volume. The pattern is consistent with what Maricopa County Recorder's Office data shows about land records fraud filings: the county has documented a steady year-over-year increase in suspected deed fraud filings since 2023, with a particularly sharp uptick in filings that reference out-of-state owners of vacant or rental residential parcels.

What makes Maricopa County a useful one-metric reference for an independent owner thinking about any Sun Belt market is the convergence of three risk factors. The county has high transaction volume, which gives attackers more opportunities. The county has a large stock of rental property owned by out-of-state individual investors and small LLCs, which gives attackers more thinly monitored targets. And the county's recorder operation has been running a public awareness campaign since 2024 specifically because the trend lines are bad enough to require one.

For an owner with property in Maricopa County, or any county with comparable demographic exposure, the practical implication is that both halves of the property fraud attack surface are active in the same market: deed fraud at the recorder and wire fraud at the closing. The two defenses are different. The recorder check is monthly and paper-based. The wire fraud check is per-closing and protocol-based. Neither is optional in 2026.

Today's 5-Minute Action

Before your next closing or refinance, send a one-line email to your title agent or closing attorney with this exact text: "Please confirm in writing whether my owner's title policy for this transaction includes the ALTA 49 endorsement, and if not, what the additional premium would be. Please also confirm which wire verification service your operation uses for incoming wires." Save the response. If the answer is "we do not offer ALTA 49" or "we do not use a wire verification service," that is the answer you needed before sending any wire to that operation. Take the five minutes now, not at the closing table.