Recent reports include a story that should send a chill down the spine of anyone buying real estate — especially investors wiring large sums of money.
Johanna Berkowitz was purchasing a luxury property in Dewey Beach, Delaware. Closing was scheduled for November 21, 2025. Two days before closing, she received what appeared to be a legitimate email from someone connected to the law firm handling the transaction.
The email contained wire instructions for her final payment: $2.2 million.
Everything looked real.
It wasn’t.
The email was a spoof. Fraudsters had impersonated the law firm and sent fraudulent wiring instructions. Berkowitz followed the instructions and wired $2.2 million to a Truist Bank account controlled by criminals. Truist later confirmed the money was received — and then withdrawn.
Gone.
The Lawsuit
Berkowitz has filed suit against “John Doe” defendants because the actual perpetrators are not yet known. She is seeking to identify them through banking records, IP address tracing, and other investigative tools available through the court system.
She is asking for at least $2.2 million in damages, plus additional relief that could include punitive damages and recovery of any property tied to the fraud. The lawsuit alleges violations of federal law, including the Computer Fraud and Abuse Act and the Stored Communications Act, along with various state law claims.
Whether she ever recovers the money is uncertain.
But for investors, the legal theories are not the real lesson here.
The Real Lesson: Assume You Are a Target
If you are buying or selling real estate — especially in seven-figure transactions — you are a target.
Fraudsters monitor email traffic. They hack accounts. They sit quietly inside inboxes for weeks watching transactions develop. Then, at the moment of maximum financial movement — closing week — they strike.
They don’t need to fool you for long. They just need one wire.
In my nearly 40 years in the apartment business, I’ve wired millions of dollars for acquisitions, refinances, developments, and capital calls. I assume every wire instruction is fraudulent until proven otherwise.
That mindset has probably saved me more than once.
The Discipline Investors Must Adopt
Here are non-negotiables:
-
Never trust emailed wire instructions.
Not even if they look perfect. Not even if the signature block matches. Not even if the timing makes sense. -
Verify by voice using a known number.
Call a phone number you have previously used and independently verified. Not the number in the email. Not a number in the signature block. A number you already have in your contacts. -
Assume last-minute changes are fraud.
“Updated wiring instructions” two days before closing? That’s a five-alarm fire. -
Slow down.
Fraud feeds on urgency. Closing pressure. “We need the wire in the next hour.” Take a breath. Call. Confirm. -
Train your team.
If you have an accounting department, property managers, or asset managers who move funds — they must be trained to treat wires like radioactive material.
This Isn’t Just a Retail Buyer Problem
Many investors think, “That won’t happen to me. I’m too experienced.”
That’s dangerous thinking.
The more sophisticated the transaction, the more sophisticated the fraud attempt. Hackers don’t care if it’s a luxury beach house or a 218-unit apartment development. If money is moving, they’re interested.
In fact, investors are often better targets because we move larger sums and do so regularly.
The Bigger Principle
In my book, I talk about something called “The Reality Face Punch.” This is one of them.
The reality is this: cybersecurity risk is now part of real estate investing. It’s not optional. It’s not someone else’s problem. It’s part of your job description as a capital allocator.
You can do everything right on underwriting, financing, construction, and operations — and lose millions with one careless wire.
That’s not a market risk.
That’s an execution failure.
Be paranoid about wires. Build verification discipline into your process. Assume bad actors are watching.
Because sometimes, two days before closing, they are.