§ 01The brief
The client was buying an established dental practice. Final escrow instructions arrived from the broker's real email address. The client wired $1,475,000. The real escrow agent called the next morning to ask when the funds would arrive.
§ 02What I did
- 1.
Had the client's bank start a recall within an hour, and called the receiving bank's fraud team with the bank on the line.
- 2.
Built an evidence pack showing the forwarding rule the attacker had added to the broker's mailbox.
- 3.
Filed the CCS report and helped the broker's firm notify its insurer.
§ 03The outcome
The receiving bank returned $1,290,000. The broker's errors-and-omissions insurer paid the remainder and the purchase closed two weeks late.