Quick answer: When assignment fee wire instructions changed unexpectedly, pause the payment process and independently verify the request with the settlement provider. DispoKey recommends three actions: preserve the message, use a previously verified contact channel and confirm the approved instructions. If money already moved, contact the originating financial institution immediately and report suspected fraud.
- Do not reply with banking details or approve an unexpected change.
- Confirm through a contact method established before the incident.
- Preserve evidence and escalate if a transfer already occurred.
A familiar email thread is not proof that a last-minute change is genuine. A compromised account can make a fraudulent message look like part of a normal closing conversation. This guide covers the unexpected-change incident affecting an assignment-fee disbursement. It does not explain fee entitlement, replace the settlement provider's controls or promise recovery. Use earnest-money planning for deposit questions; this is a different payment stage.
Pause an unexpected disbursement change
Ask the settlement provider to pause processing of the changed instructions while their authenticity is checked. Do not treat urgency, familiarity or a matching display name as verification.
Record when the request arrived, what changed and who received it. Avoid copying additional parties into a message containing full bank details. If the request claims a changed account, a replacement recipient or an emergency, identify that specific claim for the verifier. The FBI describes business email compromise involving legitimate-looking requests and real-estate transactions. [1] The lesson is to verify the change, not merely inspect whether the message looks professional.
Why not use the contact details in the changed message?
The message can contain the attacker's verification channel as well as the altered payment details. Use an independently established contact, not the number or link supplied with the change.
Retrieve the contact through records obtained before the incident or another trusted independent process. Tell the settlement provider exactly which instructions you are checking. Do not paste banking information into a casual group chat to seek reassurance. If the known contact cannot confirm the request, leave the change unapproved and follow the provider's escalation procedure.
Use a short incident checklist
A clear checklist keeps people from assuming somebody else performed the callback. Assign a verifier and preserve the outcome before processing resumes.
Open the changed-instructions checklist
- Has processing of the changed request paused?
- Who owns independent verification?
- Where did the trusted contact details come from?
- What exactly did the authorized party confirm?
- Has the settlement provider recorded the approved version?
The callback should establish more than whether a person recognizes your name. Ask the provider to verify the actual authorized request under their procedure. Record the time, the verified party and the decision without spreading sensitive data unnecessarily. A “looks fine” reply from a colleague is not a replacement for the authorized payment-control process.
| Incident state | Immediate action | What not to assume |
|---|---|---|
| Change received, unpaid | Pause and independently verify | Familiar thread means authentic |
| Transfer already sent | Contact originating financial institution | Funds can definitely be recovered |
| Suspected compromise | Preserve and report evidence | Deleting the message resolves exposure |
If the transfer already happened, contact the bank immediately
Contact the originating financial institution promptly and explain the suspected fraud. Ask about recall or reversal procedures, then make the appropriate report; neither step guarantees recovery. [2]
Have the transfer details and incident timeline available through the institution's secure channel. Tell the settlement provider so they can activate their response procedure. Do not wait for an email reply from the suspected sender before raising the issue. If access to the mailbox may be compromised, follow the organization's security response and use a trustworthy communication channel.
Keep a record of the institution's case information, requested documents and next steps. A request for recall is not confirmation that funds have returned. Avoid telling a seller or partner that the incident is resolved until the responsible institution and settlement provider confirm the actual status. Maintain factual updates without sharing sensitive account data broadly.
Preserve the evidence without publishing it
Retain the original message, relevant headers, attachment details and transfer records for the authorized investigation. Screenshots can help explain the incident but may not contain all useful technical evidence.
Record the first suspicious contact, the changed details, the verification attempts and any payment action. Preserve originals instead of editing messages to make a neat packet. Keep access restricted to parties who need the records. IC3 guidance describes reporting suspected business email compromise and providing detailed information. [2] Its dated real-estate advisory is background evidence of the incident type, not a source for invented current loss rates. [3]
Does verifying the bank account establish entitlement to the fee?
No. Authentic payment instructions and contractual entitlement are different questions. The settlement provider and qualified advisers must resolve payment authority and transaction requirements.
Keep the signed documents, approved settlement figures and verified payment instructions in their appropriate places. An accurate bank account does not authorize a fee that is not payable. Likewise, a valid contract does not authenticate an unexpected message. If those issues conflict, obtain legal or settlement guidance rather than asking an incident checklist to decide the contract dispute.
A worked incident timeline with named responsibility
A brief timeline reveals missed handoffs without inventing a safe waiting period. The following scenario is an example, not an actual DispoKey transaction.
At 10:00, a coordinator receives a changed-account email. At 10:05, they notify the settlement provider that the changed request is unverified. At 10:15, the provider reaches the previously established authorized contact and records that no change was requested. The team keeps the fraudulent message and follows its reporting procedure. The example's minutes illustrate sequence, not a guaranteed response time or recovery window.
If the transfer had already been sent at 10:02, bank escalation would move to the front of the response. Do not finish every administrative checklist item before contacting the institution. The information-gain here is the split between unpaid and already-paid incidents: one prioritizes stopping approval, the other prioritizes financial escalation while preserving evidence.
When DispoKey may not be your best option
If you already have a strong buyer and a capable settlement team, a new disposition partner may not help. An active fraud incident needs the bank, settlement provider and appropriate authorities first.
For an eligible off-market contract needing buyers, review the wholesaler process and submit your deal. DispoKey offers a 72-hour buyer-match guarantee, a 60/40 fee split favoring the wholesaler and $0 upfront; on-market deals are not accepted. These commercial terms do not replace settlement verification. Use the MAO and JV calculators for labeled planning and JV preparation for responsibilities.
Who authorizes payment processing to resume?
The settlement provider should apply its authorized approval procedure after verification. A partner's reassuring message should not silently override the payment-control owner.
Record the approved version and the decision to resume without circulating the full account details. If separate parties hold conflicting instructions, resolve that conflict through the provider before moving funds. This final handoff closes the operational loop; it does not establish a universal legal duty or guarantee that every risk has disappeared.
Key takeaways
Pause unexpected changes, verify independently and keep a clear authorized version. If funds moved, contact the originating institution promptly and report suspected fraud. Preserve evidence without exposing banking details publicly. This incident workflow does not determine entitlement, impose provider obligations or guarantee recovered funds.
