Late Wire Instruction Changes: How to Review a Changed Account Without Blowing the Closing
The email lands the afternoon before funding: the seller closed her old account, here is the new one, please update before the wire goes out.
The email lands the afternoon before funding: the seller closed her old account, here is the new one, please update before the wire goes out.
A wire instruction that changes late in the file is the single most reliable fraud signal in escrow, and, often, completely legitimate. Sellers really do switch banks mid-transaction. Payoff loans really do get sold to new servicers. Your job isn't to refuse all changes or accept all changes. It's to run a specific review the moment a change lands, document it before acting, and make the go/no-go call a named office decision.
One rule anchors everything here: nothing inside the change request can verify the change request. Not the phone number in the signature block, not the "call me to confirm" line, not the matching logo. Everything below is that rule, applied.
Who this guide is for
Independent California escrow offices, officers, processors, and the owners backing them up, on resale, refi, and payoff files where instructions can change days or hours before funding. Especially offices where agents and sellers apply real pressure to "just update it and fund."
What this guide helps you do
- Treat every late change as a defined review trigger, not a judgment call made under pressure.
- Verify a changed account without relying on anything the change request supplied.
- Spot the compromise patterns that ride along with legitimate-looking changes.
- Hold the line against urgency without damaging the relationship.
- Get the review into the file before the wire, so the record shows diligence instead of reconstruction.
1. Define the trigger, what counts as a "change"
If only a full new instruction sheet counts as a change, you'll miss the ones that matter: a new account number in an email body, a "corrected" routing number, a different bank mentioned on a call. A one-line email, "use this account instead", never gets treated as a formal change, never triggers review, and becomes the funding instruction by inertia.
Check: adopt a bright line. Any modification to beneficiary name, bank, routing, account, or delivery method, any channel, any time after the original was verified, is a change, and the review starts now. A verbal relay from an agent counts. The relay is the event; don't wait for paperwork.
Record: the change exactly as received, email, portal message, or call note, with date, time, channel, and apparent sender.
2. Verify outside the request
The classic failure: the officer calls the number in the new instruction, reaches a confederate, gets a confident confirmation, and funds. The callback happened. The verification didn't.
Check: call the party at a number sourced independently, the opening package, a previously verified call, the listing agreement, the lender's public main line. For a changed payoff, confirm through the lender's portal or public number, never the demand document. And make the party do the work: have them tell you the new bank's name before you read anything to them.
Record: where the number came from, the time, who you reached, what was confirmed, your name. If you can't reach the party, record every attempt.
Don't assume a reply email confirming the change is verification, if the mailbox is compromised, the fraudster answers the reply. A correct name and file number prove nothing either; both are sitting in the thread the attacker is reading.
3. New urgency: the tell that travels with the change
Fraudulent changes almost never arrive alone. They come bundled with a reason you can't verify and a deadline you can't miss, a family emergency, a bank "closing the account today," an overseas trip, a threat to cancel. The urgency reframes your review as the obstacle, and the officer compresses verification to be helpful. Helpfulness funds the fraud.
Check: whether the urgency itself survives the independent channel. A real seller with a real bank change confirms it on a callback without friction. Manufactured urgency tends to evaporate, or escalate to anger, when you insist on the process.
Record: the urgency claim, verbatim where you can, and your response. If the party resisted verification, record that too. It's material.
Don't assume anger proves legitimacy, "a fraudster would be polite" is a myth. Real clients and real fraudsters both get angry. The process is identical either way.
4. Agent pressure: sympathetic, motivated, and not the party
When a change threatens the timeline, the pressure usually arrives through the agent, "the seller confirmed it to me, just update it", and the agent is sincere. But look at what actually happened: the agent talked to the seller yesterday about the closing; the account change came by email overnight. The agent has verified nothing.
Check: whether your own verification with the actual party is complete. The agent's confidence is context, never a control.
Record: the agent's communication, plus a note that verification was completed directly with the party.
Don't assume the process costs the relationship. Agents remember the office that caught a diverted proceeds wire far longer than the one that funded two hours faster. One line ends most pushback: "Our process on any account change is a direct callback, it protects your client and your commission."
5. Seller pressure, or seller impersonation
When the "seller" personally pushes by email or text, you may be talking to the attacker in real time. A convincing back-and-forth builds false familiarity: the tone matches, the details match, because the attacker is reading the real thread.
Check: voice contact at the independently sourced number is still the control. If the seller says a call is impossible, offer anything that breaks the email channel, video call, in-person, verification through their attorney of record. Genuine sellers can almost always satisfy one of these. The inability to leave the email channel is itself a finding.
Record: every channel attempted, the responses, and the standing status: unverified / verified / rejected.
Don't assume text beats email. A ported or spoofed number reads identically to the real one.
6. Whose mailbox is burned?
A fraudulent change means one of three mailboxes is likely compromised: the party's, an agent's, or, least often, most seriously, your own. Treat the change as an isolated event and you miss the ongoing exposure: the same thread keeps producing instructions, on this file and others.
Check: where the change most plausibly originated. Office-side signs: parties receiving emails you didn't send, unfamiliar sent items, forwarding rules nobody created. Party-side signs: the party is unaware of emails "they" sent. Then sweep your other open files with the same parties, agent, or domain.
Record: the origin assessment, labeled honestly, fact, interpretation, or unknown, plus any warning given to the affected party to secure their account.
Don't assume rejecting the change ends it. Warn the party, or the same attacker just moves to the buyer's side of the file.
7. Document before action, the sequence is the protection
Under pressure, the natural order inverts: act first, paper later. But an office that made all the right calls and wrote it up from memory two days after the loss has a fraction of the evidence of an office that documented as it went.
Check: the review record is complete before the wire is built against the new instruction. Change received → funding paused → review run → verification documented → decision named → then action.
Record: the change-review note below, completed in the moment, plus the approver on the decision.
Don't assume "we'll memo the file Friday" is equivalent. Contemporaneous and reconstructed are not the same evidence.
Change-review checklist table
| Step | Action | Done |
|---|---|---|
| 1 | Change filed as received (channel, date, time, sender) | ☐ |
| 2 | Funding paused on this file | ☐ |
| 3 | Independent number sourced (opening package / prior call / public line) | ☐ |
| 4 | Voice verification with the actual party completed | ☐ |
| 5 | Urgency claim and any resistance noted | ☐ |
| 6 | Agent relays recorded as context, not verification | ☐ |
| 7 | Origin assessed (party / agent / office / unknown) | ☐ |
| 8 | Other open files with same parties/agent/domain checked | ☐ |
| 9 | Decision named: accept / reject / hold | ☐ |
| 10 | Owner approval on any accepted late change | ☐ |
| 11 | Review record completed before wire is built | ☐ |
Risk / what to check / what to record
| Risk | What to check | What to record |
|---|---|---|
| Diverted beneficiary | Callback to independently sourced number | Number source, time, party reached, items confirmed |
| Manufactured urgency | Does urgency survive the independent channel | Claim verbatim; party's reaction to process |
| Agent-relayed change | Your own verification, independent of the relay | Agent message + direct verification note |
| Seller impersonation | Voice/video/in-person outside email | Channels attempted; standing status |
| Ongoing compromise | Origin of the change; other open files | Origin assessment; cross-file sweep note |
| Post-hoc reconstruction | Record complete before action | Timestamped change-review note |
Callback script, changed account
"Hi [name], this is [officer] at [office] on file [number]. We received a request to change your wire instructions, and as we told you at opening, we verify every change by phone before acting. Did you send us a change? [If yes:] Tell me the name of the new bank, I won't read it to you first. [Compare against the request; confirm last four and payee.] [If no:] Don't respond to any emails about your instructions. Your proceeds stay on your original verified instruction, and I'm noting this call in your file."
Change-review note template
Wire Instruction Change Review, File [number] Received: [date/time] via [channel] from [apparent sender] Change: beneficiary / bank / routing / account / delivery Urgency or pressure stated: ____ Independent number source: ____ Call: [date/time], reached ____, confirmed ____ Origin: party / agent / office / unknown (fact vs. interpretation noted) Decision: accept / reject / hold, by [officer], approved by [owner/manager] Open item retained: ____ Status: ____ Record completed before action: Y
Common mistakes
- Verifying the change using contact details the change supplied.
- Accepting a reply email or a text as confirmation of an email-delivered change.
- Letting the agent's certainty stand in for the party's voice.
- Rejecting the fraudulent change but never warning the party their mailbox is compromised.
- Writing the memo after funding, from memory.
What to save in the file
The original verified instruction. The change request exactly as received. The change-review note. The callback record with the source of the number. Agent communications. The named decision and approval. Any rejection notice sent to the party. And if the change was accepted, the re-verified instruction you funded against. A file with these items answers the only question that matters later: a late change came in, the office reviewed it before acting, and here's what it did.
When to escalate
Owner or manager on every accepted late change, every failed verification, and every party who resists the process. Your bank immediately if any funds moved against a suspect instruction. On a confirmed fraudulent change: warn the affected party to secure their email, consider carrier notice per your policy terms, get counsel before written statements to parties, and consider an IC3 report. If office-side compromise is plausible, get IT involved the same day. Policy terms and counsel govern; this is operational guidance, not legal advice.
How Veto fits
A late change is exactly the moment a review record earns its keep. In Veto, the change lands as a source row, and the record shows what changed, what was checked and against which source, what stayed open, who reviewed, what the office did, accept, reject, or held pending owner exception, in the reviewer's name.
The office decides and acts. The record shows the review came first.
Printable checklist
LATE WIRE CHANGE REVIEW, FILE #____ Date: ____ Officer: ____
[ ] Change filed as received, channel: ____ time: ____
[ ] Funding paused on this file
[ ] Independent number sourced from: ____
[ ] Voice verification, time: ____ reached: ____
[ ] Party said bank name first; matched request: Y / N
[ ] Last four / payee / amount range confirmed
[ ] Urgency or resistance noted: ____
[ ] Agent relay (if any) recorded as context only
[ ] Origin: party / agent / office / unknown
[ ] Other open files with same parties/agent checked
[ ] Decision: ACCEPT / REJECT / HOLD, by: ____
[ ] Owner approval (accepted changes): ____
[ ] Party warned re: rejection / mailbox risk (if applicable)
[ ] Review record completed BEFORE wire built: YOne page in the file before money moves.
Your office decides. Veto records what was reviewed, what stayed open, and who reviewed it.