Somewhere between agreeing on a price and signing at the notary, real money has to move, often hundreds of thousands of euros, wired across an ocean to a bank account we’ve only ever seen typed in an email. That single moment is exactly where wire fraud when buying property in Spain does its damage and it cost American buyers $275 million in 2025 alone.
It has nothing to do with someone hacking an account or stealing a password. It’s about someone convincing you to send the money yourself, to the wrong place, at the one moment you’re not expecting to double-check.
We touched on this briefly in our post on deposit protection and card liability and we knew it needed its own post.
How the Scam Actually Works
It happens often enough that it has a name: business email compromise, or BEC.
Somewhere in the chain of people involved in a property purchase, an email account gets compromised, often a lawyer’s, a notary’s or an agent’s. The scammer doesn’t act right away. They sit quietly inside that inbox, sometimes for weeks, reading your correspondence and learning everything about your transaction: the closing date, the amounts, the names, the tone everyone uses with each other.
Right before money is due to move, they send new wiring instructions from what looks like a completely legitimate, familiar email thread.
Because the fraudster has been reading the actual conversation, the message often gets the property address right, the amount right, the names right, sometimes even referencing something that was genuinely discussed the week before.
That accuracy is exactly what makes it convincing, and exactly why “it looked legitimate” isn’t a defense.
The buyer wires the money to the new account, and within hours it’s been moved through a chain of other accounts, often across multiple countries, before anyone notices anything is wrong.
The Real Numbers
According to the FBI’s Internet Crime Complaint Center (IC3), Americans reported $275.1 million in real estate fraud losses in 2025, across 12,368 complaints, up from about $173 million the year before. Business email compromise specifically, the mechanism behind most of this, accounted for $3.04 billion in losses across all sectors last year.
The FBI’s Recovery Asset Team, which works to freeze fraudulent wires before they disappear, opened 3,900 cases in 2025 and recovered $679 million out of $1.16 billion in attempted theft, a 58% success rate. Flip that number around and it’s a coin flip you don’t want to be on the wrong side of: for every $100 wired to a fraudulent account, roughly $42 is gone for good.
The same report flagged something worth taking seriously going forward: more than 22,000 complaints in 2025 referenced AI in some way, with over $893 million in associated losses. Generative AI now makes it trivial to produce a scam email with correct grammar, professional tone and no obvious tells, the kind of writing quality that used to be a red flag on its own. That makes the verification habit below more important, not less.
Why Spain Has Even Less Protection Than the US
In the US, the closing process usually runs through a title company or closing attorney who acts as a central point for verifying wire instructions, and the industry has spent real money building fraud-detection habits into that role. Spain, unfortunately, doesn’t have an equivalent. There’s no US-style title insurance industry in Spain.
Buyer protection instead comes from registering the deed at the Registro de la Propiedad, which gives you strong legal certainty once it’s done, but that’s a protection against someone else claiming the property later, not a safeguard against fraud during the transaction itself.
The notario, similarly, isn’t playing the role an American buyer might expect. A Spanish notary is a neutral public official who confirms the paperwork is formally correct and everyone’s identity checks out. They don’t investigate the property, they don’t represent your interests and they aren’t verifying that the bank account you’re about to wire money to is actually your lawyer’s or the seller’s.
Spain also doesn’t have a standardized, regulated escrow system the way the US does. Funds usually move directly, often at the notary’s office on closing day or beforehand into a lawyer’s or gestoría’s client account, which functions somewhat like an escrow but isn’t a regulated escrow product with the same oversight. Some buyers pay for a dedicated private escrow service specifically to protect a deposit if a seller breaches the contract, but that’s a different kind of protection: it guards against the seller backing out not against a wire going to the wrong account in the first place.
This means the responsibility for catching a fraudulent wire change falls almost entirely on you and your own lawyer, with no title company checking behind you as in the US. Ask directly how your lawyer or gestoria will communicate any change to payment instructions and agree in advance on a verification step that doesn’t rely just on an email.
The Verification Protocol
Your entire defense against this scam comes down to one habit repeated every time money is about to move.
Never wire money based on instructions that arrived only by email, no matter how legitimate they look or how much urgency they convey.
Before sending anything, call the person or firm using a phone number you already had on file from before the transaction started. It’s important not to use a number pulled from the email itself, since a spoofed email can just as easily include a spoofed callback number.
Confirm by phone or in person the beneficiary name, account number, and routing or IBAN details you receive in any new instructions you might receive. If anything differs from what you were originally told, even slightly, treat that as a reason to immediately stop and re-verify.
Another safeguard worth adopting for any large transfer: send a small test amount first. Before wiring the full sum, send a nominal amount, even just a few euros, to the account you’ve been given. Then call the recipient and confirm by phone that it arrived and that the details match on their end. Only send the remainder once that’s confirmed. It costs almost nothing and catches a wrong account before your real money is at risk, rather than after.
Red Flags To Watch For
A few patterns show up often enough to be worth naming specifically:
The urgency itself is worth treating with particular suspicion, because it usually cuts against how legitimate transfers actually work.
Spanish notaries are required to verify the origin of large funds and genuine cross-border wires routinely involve bank compliance holds and anti-money-laundering checks that take real time to clear.
A fraudster pushing for an urgent, same-day wire is frequently asking for something a real transaction wouldn’t even be capable of moving that fast.
If Suspect You’ve Sent a Bad Wire
The first hour is critical. Speed is the name of the game here.
Funds that are still sitting in the receiving account can sometimes be frozen; funds that have already moved on usually can’t be recovered at all.
If the wire originated from a US account, call your bank’s wire transfer department directly. Do not call the general customer service line and request an immediate recall.
Banks can sometimes pull a wire back within the first 24 to 72 hours if it hasn’t cleared the receiving bank yet. At the same time, file a complaint at ic3.gov. The FBI’s Recovery Asset Team can initiate what’s called a Financial Fraud Kill Chain, a rapid request to freeze the funds at the receiving bank before they move again and it only works if it happens fast.
If the wire is crossing into or within the Spanish banking system, the equivalent mechanism is a SWIFT recall request (an MT192 message) sent bank to bank, asking the receiving institution to return the funds before they’re withdrawn or forwarded. Success depends heavily on how quickly it’s initiated and whether the money is still sitting in that account.
In parallel, report the fraud to Spain’s Policía Nacional through their Unidad de Investigación Tecnológica, either online through the Denuncias Telemáticas portal or in person, or to the Guardia Civil’s Grupo de Delitos Telemáticos.
INCIBE, Spain’s national cybersecurity institute, also runs a citizen helpline (017) that can advise on next steps, though it isn’t a law enforcement body itself.
Either way, notify your lawyer, notary, and agent immediately so they can alert everyone else in the transaction chain and preserve the email evidence. Don’t delete or alter anything in the compromised thread, since it becomes evidence for the investigation.
Another variant worth knowing about targets a step most closing-instruction warnings don’t cover.
International buyers routinely use a dedicated currency transfer service, rather than a standard bank wire to move large sums cross-border at a better exchange rate. Think companies like Wise, Currencies Direct, Moneycorp and others.
Scammers have started targeting that step directly: either impersonating a real transfer company with a cloned website and a similar looking email or cold-contacting a buyer mid-transaction with an unsolicited “better rate” offer timed suspiciously well. The money goes to the fraudster instead of the real provider and it’s gone the same way as any other fraudulent wire.
The same verification habit below applies here, too. Confirm you’re dealing with the actual company not a link or number in an email or unsolicited message.
Safety First!
This isn’t a reason to be afraid of wiring money for a Spanish property purchase. It’s a reason to build one specific habit before you need it: agree with your lawyer, gestor, notary and real estate agent early in the process before any money is scheduled to move. Confirm that any change to payment instructions will always be confirmed by phone using an agreed upon number you’ve all agreed upon.