Wire Fraud Protection
Check a closing email before you wire the money
Forward a closing email to your private check address and see what looks wrong before you wire.
Included with Shield Pro. Free for 7 days, then $14.99/mo, or $107.99/yr ($9/mo). Cancel anytime before it renews. No mailbox access, ever.
On a computer? Scan with your phone to install FendLand.
Why closing wire fraud works
You are days from closing, you know wire instructions are coming, and you are waiting for this exact message. Most scams have to invent a reason to contact you. This one arrives when an email from the title company is expected, so it does not look out of place.
Whoever sends it usually knows the closing date, the property, and the name of your title company, because a real-estate transaction touches a lot of inboxes and only one of them needs to have been compromised.
A wire is close to irreversible. Once sent, the money is usually moved and withdrawn within hours, so the check has to happen before you send it.
The closing window, step by step
Under contract
Add your closing
Your closing date and property address. You get back a private check address that belongs only to this transaction. Save your escrow contact's real phone number and the domain their mail comes from.
Before closing
Forward anything about money
Wire instructions usually arrive in the last days. Send every email about funds to your check address, or have your mail provider forward closing mail on its own.
Before you send
Read the reply
The sender, the domain and every link are checked, and the answer comes back as an email. An example is below.
Closing day
Call, then wire
Call your escrow contact on the number you saved, not one in the email, and confirm the instructions out loud. Only then send the money.
Step 3, the reply
From FendLand <verify@fendland.com>
Do not wire money, this email fails verification
Do not click, do not wire
Dana, this looks like wire fraud
We checked the email you forwarded and it did not pass. The sender's domain imitates the one you said your closing mail comes from (near-identical spelling). The sender was acmetltle.com. Do not click any link in it and do not wire any money.
Call your title company on a number from your closing documents (not one from the email) before sending any funds.
What was flagged
The sender's domain, acmetltle.com, is one letter off acmetitle.com, the domain this buyer said their closing mail comes from.
What a reply never says
That an email is safe to act on. Every reply ends with the phone call.
Example reply. The buyer and domain are invented.
A missing flag is never an all-clear
Every email you forward gets a reply. When something is wrong, the reply is a warning. When nothing trips a flag, the reply says FendLand could not confirm the email and tells you to verify by phone. That is not a verdict and must never be read as one. A careful fraudster can send a message that produces nothing to flag, and if a green check mark existed here it would eventually be shown on that email.
FendLand is built this way on purpose. If it misses a flag, you still make the phone call you were going to make anyway. If it showed a false all-clear, you could lose the wire.
Call your title or escrow contact on a number you already had, and confirm the instructions out loud, every time.
FendLand is a check before that call. It does not replace the call, and it is never authorization to send money. Even with a verified title-company partner, where a genuine email from them can come back as “appears to be from” them, the reply still tells you to call.
What FendLand checks in a closing email
The lookalike domain
acmetitle.com becomes acmetitle-closings.com, or acmetltle.com. It reads correctly at a glance, especially on a phone, and it is the mechanism behind most closing wire fraud. Name the domain you expect and near-misses get flagged.
Who sent it
The real sending address behind the display name, which is often nothing like the company the message appears to be from.
Where the links go
The address a link truly resolves to, rather than the text printed over it.
What the message asks for
The wording of a redirected-wire email: an updated set of wire instructions, a new account number, and pressure to send it today.
Then call a number you already trust. Save your escrow contact and it is one tap away inside the alert, so you verify on a line the email could not have chosen for you.
Where your title company is a verified FendLand partner, their real domain and phone numbers are already known, which makes a lookalike stand out immediately. That trust is granted after review, never self-asserted by whoever signs up.
No mailbox access, at any point
FendLand never connects to your email account, never asks for your password, and has no standing feed from your provider. Nothing is watching your inbox.
What exists is a private check address for your closing. Mail reaches it only because you forwarded it, or because you set your own provider to forward closing mail once. You decide what arrives, and you can stop it at your end whenever you want.
The check address belongs to that transaction and is only used for that closing.
Other protections around a closing
A transaction puts your name, address and phone into a dozen systems at once, and the exposure does not stop when it closes.
- Phone ProtectionShield ProYour number is how the title company reaches you, which makes it worth hijacking during a closing.
- Title WatchShield ProAfter closing, many counties will email you free when something is recorded against the property. FendLand gets you enrolled.
- Removal CenterFree and Pro tiersThe spam that starts weeks after a purchase comes from brokers that bought the new record.
Background reading: how to avoid wire fraud at closing. Title company or lender? See the partner program.
What buyers ask before closing
Does FendLand read my email?
No. It has no access to your mailbox and never asks for your email password. You get a private check address and you decide what reaches it, either by forwarding a message yourself or by setting your own mail provider to auto-forward closing mail once. Nothing arrives that you did not send.
Will it tell me an email is safe?
Not on a closing you add yourself, and that is deliberate. Every email you forward gets a reply. When something looks wrong the reply is a warning; when nothing does, it says FendLand could not confirm the email and tells you to verify by phone. That is not an all-clear, because a fraudster who does everything carefully may produce nothing to flag. The one difference is a closing run through a verified title-company partner: FendLand knows their real domain, so a genuine message from it can come back as "appears to be from" them, and even then the reply tells you to confirm the amount and account by phone. The rule that keeps you safe is the one that has always worked: confirm wire instructions by phone, on a number you already had, before sending anything.
What does it check?
The sending address and the domain behind it, whether that domain is a near-miss of one you told us to expect, the links in the message and where they go, and the hallmarks of a redirected-wire message. Where your title company is a verified FendLand partner, their real domain and phone numbers are known, which makes a lookalike stand out immediately.
What is a lookalike domain?
The trick behind most closing wire fraud. Your title company is acmetitle.com and the email arrives from acmetitle-closings.com, or acmetltle.com. It reads correctly at a glance, especially on a phone. Tell FendLand the domain your closing mail comes from and near-misses of it get flagged. That check only ever raises a flag; it is never used to mark a message safe.
What do I do when something is flagged?
Do not reply to the email and do not call a number printed in it, because both lead back to whoever sent it. Call your title or escrow contact on the number you already had. If you saved that contact in FendLand it is one tap away inside the alert, which is the point: you verify on a line the email could not have chosen for you.
When should I set this up?
As soon as you are under contract. The fraud lands in the last days before closing, when the wire is imminent and you are expecting instructions, so it needs to be running before that window rather than started once something already looks wrong.
Do I need the app?
No. You can add your closing from the web and forward email from any mail client. The app adds push alerts, which matter here because the warning is only useful if it reaches you before you send the wire.
Set it up before the wire instructions arrive
Add your closing, get your private check address, and forward anything that mentions wire instructions. Do it as soon as you are under contract.
Included with Shield Pro. Free for 7 days, then $14.99/mo, or $107.99/yr ($9/mo). Cancel anytime before it renews. No mailbox access, ever.
On a computer? Scan with your phone to install FendLand.