In 2024, the FBI's Internet Crime Complaint Center reported over $400 million in losses from real estate wire fraud. The schemes are well-documented: compromised email accounts, spoofed wiring instructions, misdirected closing funds. The title industry knows the risk exists. What it hasn't internalized is that reconciliation alone doesn't catch it.
Reconciliation answers one question: does the money at the bank match the money in your books? If a fraudulent wire was sent and recorded in your system as a legitimate disbursement, the three-way match will balance perfectly. The fraud doesn't create a variance — it creates a correctly recorded transaction that shouldn't exist.
Catching that requires something different from matching. It requires anomaly detection.
What matching catches vs. what it misses
Transaction matching is designed to identify discrepancies between ledgers. It's excellent at catching:
- A check that cleared for a different amount than recorded
- A deposit that posted to the bank but wasn't booked
- A wire fee that was deducted but not recorded
- A transaction in the books with no corresponding bank activity
These are accounting discrepancies. They produce a variance in the three-way match, and any reconciliation tool — manual or automated — will surface them.
What matching does not catch:
- A wire sent to the correct amount but the wrong recipient
- A duplicate wire sent four minutes after the first one
- A legitimate-looking disbursement with no corresponding open file
- An incoming wire from an entity that has never transacted with your agency
- A pattern of small debits that individually fall below any review threshold
These don't produce variances. The books balance. The three-way match passes. The reconciliation is “clean.” But the transaction is wrong — and without a system watching for behavioral anomalies, it won't be caught until someone notices the money is gone.
Duplicate wire detection
The most common wire fraud pattern in escrow accounts isn't a sophisticated hack — it's a duplicate payment. A payoff wire gets sent twice. A closing disbursement gets processed once by the closer and once by the bookkeeper. Two wires for $186,500 go to the same lender within minutes of each other.
In a manual reconciliation process, this might not surface for days or weeks. The first wire matches the expected disbursement. The second wire also matches — because it's the same amount to the same payee. A human reviewer scrolling through a bank statement might not notice the duplicate, especially on a high-volume day with dozens of wires.
Automated detection is straightforward: flag any outgoing wire where the same amount is sent to the same payee within a configurable time window. This should be a real-time alert, not a monthly discovery. The difference between catching a duplicate wire in four minutes and catching it in four weeks is the difference between a same-day recall and a potential loss.
Unauthorized disbursements
A wire goes out for $247,000 to an account you've never sent money to before. It matches no pending payoff, no expected disbursement, no open file. In the books, it's recorded as a payoff on file #42891 — but the disbursing officer didn't initiate it.
This is the scenario every agency owner fears. And it won't show up in reconciliation — because the transaction was recorded. The books balance. The three-way match passes.
What catches it is a system that cross-references every outgoing wire against the expected disbursement schedule. If there's an outgoing wire with no matching pending payoff or expected disbursement in any open file, that's a critical alert — not an exception, not a variance, but a signal that something happened outside normal operations.
Unknown counterparties
Over time, every trust account develops a pattern of counterparties — the lenders you regularly wire payoffs to, the title companies you receive funds from, the recording offices you send checks to. These patterns are consistent and predictable.
When a wire arrives from an entity your agency has never transacted with before, that's not necessarily fraud — but it's worth noting. When an outgoing wire goes to a new recipient that doesn't match any lender or vendor in your open files, that's worth more than noting — it's worth immediate verification.
A system that maintains a rolling baseline of normal counterparties can flag first-time entities automatically. The alert isn't “this is fraud” — it's “this is new, and you should verify it.” The difference matters. Most new counterparties are legitimate. But the ones that aren't are catastrophic.
Transaction velocity anomalies
Your agency typically processes 8 to 12 wires per day. On Tuesday, 31 wires go out. The total amounts match expected disbursements. The books balance. Nothing is technically wrong.
But the velocity is anomalous. Something is different about today — maybe it's a legitimate end-of-month rush, or maybe someone is running transactions through the account that shouldn't be there. A system that tracks daily transaction velocity against a rolling baseline can surface this as a signal without generating false alarms on every busy day. The threshold isn't fixed — it's relative to your agency's own pattern.
The distinction that matters
Reconciliation and anomaly detection are complementary but different capabilities. Reconciliation ensures the math is right. Anomaly detection ensures the behavior is right. You need both.
An agency that reconciles daily but doesn't monitor for anomalies will catch every accounting error and miss every behavioral signal. An agency that monitors for anomalies but doesn't reconcile will catch unusual patterns but miss straightforward discrepancies. The complete picture requires both — matching to verify the numbers and behavioral monitoring to verify the intent.