A closer gets emailed updated wire instructions. What catches that before the money moves?

Walk the scenario. The message arrives mid-transaction, references the correct property and parties, and explains the change plausibly. Here is what should intervene:

• If it came from a lookalike domain, external sender marking and domain monitoring should make that visible
• If it came from the real party's compromised mailbox, nothing technical on your side will flag the sender, because the sender is genuine
• If it came from inside your own tenant, our monitoring should already have alerted on the compromise before this point

That middle case is the one that costs people money, and it is why procedure beats technology here. Instructions are verified by calling a number from your own file or from the original engagement, never a number contained in the email requesting the change. Changed instructions late in a transaction are treated as suspicious by default. Wire releases above a threshold require a second person.

We will help you build that into how your systems work: secure delivery of instructions rather than plain email, a documented verification step inside your workflow, and a written record that it was performed. Your underwriter will ask for that record, and so will your insurer if you ever file a claim.