Fake client emails: how contractors and agents spot overpayment and wire fraud scams

Updated

If you take quotes, listings or deposits by email, you will get fake client emails. The ones that work on people look a lot like real work. This guide covers the common patterns, the red flags in the first message, how to check safely, and where to report. It is general information, not legal advice, and scammers change their scripts often.

Three patterns to know

These three descriptions are ours, based on how these scams are usually reported. Only the first is described in detail by an official source we link below.

1. The overpayment

A "customer" hires you or buys something and sends a check for too much. Then they ask you to refund the difference, often by wire, gift card or crypto. The Federal Trade Commission describes exactly this: people send a check for too much, "accidentally," and ask you to refund the balance, and the FTC's plain verdict is that it is a scam. Its fake check guidance adds that "fake checks can take weeks to be discovered and untangled," and that seeing the funds in your account does not mean the check is good.

For a contractor this can arrive as a deposit for a job: a bigger check than the quote, plus a request to pay a "materials supplier" or "movers" out of the extra.

2. The fake invoice

A bill arrives for something you never ordered, or a vendor you do use "has new bank details." In a May 2026 small business alert, the FTC says scammers send fake invoices to businesses for products or services they never ordered, and advises checking invoices closely and knowing who you are dealing with. Read the full FTC alert.

3. The changed wire instructions

This one hits real estate. Someone posing as the title company, the agent or the closing attorney emails new wiring instructions shortly before closing. The National Association of Realtors says the highest reported real estate fraud in 2020 was business email compromise or email account compromise, where fraudsters assume the identity of the title company, agent or closing attorney and forge that person's email. See the NAR wire fraud page.

The FBI's Internet Crime Complaint Center defines business email compromise as a sophisticated scam that targets businesses and individuals who perform legitimate transfer-of-funds requests, carried out by compromising legitimate email accounts. That matters for the next section: the email can come from a real, hacked account.

Red flags in the first email

  • Urgency with money in it. "Send the refund today" or "wire before close of business."
  • A payment method you did not choose. Wire, gift cards, crypto, or a refund to a different account than the payer.
  • A check for more than the price. The FTC says not to accept a check for more than the selling price.
  • Vague detail. No street address for the job, no property address, no reason they picked you, or a generic greeting such as "Dear contractor."
  • Pressure to move off the normal channel. A new email address, a link to a "secure document," or a request to keep it between the two of you.
  • A change. New bank details, a new account number, or a new person who suddenly has authority.

One red flag is a reason to slow down. Two or more is a reason to stop and check.

How to verify safely

  1. Pause. Nothing in a legitimate job needs a refund or a wire in the next hour.
  2. Call a number you already have. For a title company or lender, use the number from your contract, your earlier paperwork or the company's own website that you typed in yourself. Never use a phone number from the suspicious email. The NAR gives the same advice: confirm by phone with a known number before transferring any funds, and do not email financial information.
  3. Check the sender, not just the name. Look at the full address, not the display name. Remember a hacked account can still look correct, so a phone call is the stronger check.
  4. Look at the property or the job. Does the address exist, and does the person who contacted you match the owner or the agent on record?
  5. Ask a second person. Your broker, bookkeeper or office manager. Scams depend on you deciding alone.
  6. Get funds that have cleared. The FTC's advice is not to rely on money from a check unless you know and trust the person you are dealing with.

What never to do

  • Never refund an overpayment from a check, even if your bank shows the money.
  • Never wire money based on an email alone, including one that looks like it came from someone you know.
  • Never click a link or open an attachment in a message you did not expect, and never enter your email password to "view" a document.
  • Never use the phone number or website listed in the suspicious message to verify it.

What a real business address does and does not prove

A professional address, on any domain, shows that you are organized and easy to reach. It does not prove that a person is honest, and it does not stop anyone from emailing you. Scammers can have tidy addresses too, and real accounts get hacked. We are a service that rents out addresses at Colorado city domains, and we make no claim that any address, ours included, protects you from fraud or makes the sender trustworthy.

The same goes for the sender's address: a good-looking domain is not verification. The phone call is.

If you already sent money

Act quickly and call your bank first, asking whether the transfer can be recalled. Then report it. IC3 says its reports can in some cases even help freeze stolen funds, and that it cannot respond directly to every submission, so report to more than one place and keep every email, check image and receipt.

Where to report

  • Federal Trade Commission: reportfraud.ftc.gov, for fake checks, fake invoices and other scams. The FTC also asks you to forward phishing emails to the Anti-Phishing Working Group at [email protected].
  • FBI Internet Crime Complaint Center: ic3.gov, the central hub for reporting cyber-enabled crime. It says to file even if you are unsure your complaint qualifies. IC3 states it will never directly contact you for information or money, and it does not work with law firms or crypto services to recover lost funds.
  • Colorado Attorney General: StopFraudColorado.gov, from the Consumer Protection Section. It has Business Fraud and Contractor Fraud sections, a complaint link, and a phone line at 1-800-222-4444.
  • For real estate wire fraud: the NAR wire fraud page has guidance for agents and clients.

The FTC fake check page also names the U.S. Postal Inspection Service and your state Attorney General as places to report.

A short routine to adopt

Write it down and share it with anyone who answers your mail: any request to move money, change payment details or refund a payment gets a phone call to a number you already had. Agents can tell clients the same thing at the start of the deal, in writing, so a later email with new wiring instructions stands out. No routine catches everything, but this removes the easiest openings.

Check a name or try the email address ideas tool.