It’s Cybersecurity Awareness Month, which means most title shops are about to sit the staff down for the annual wire-fraud training. I’ve seen a lot of those decks. Nearly all of them are phishing-awareness training with a title-industry logo on the cover: hover over the link, check the sender’s domain, look for misspellings and urgency, don’t click. That curriculum is fine as far as it goes. The problem is that it trains a skill the people stealing wires stopped testing years ago. Simulated-phish click rates across the industry have been falling for a decade. Business email compromise losses have not. Those two facts together should tell you the training is measuring the wrong thing.

The Curriculum Teaches Tells

Classic phishing training is perceptual. It assumes the fraudulent message carries evidence of its own fraudulence — a lookalike domain, a mismatched display name, an odd turn of phrase, a sense of pressure — and that a careful reader can find it. For mass phishing, that’s still true. A million emails sent to strangers can’t be individually convincing, so they lean on volume and on the small fraction of people who aren’t paying attention. Teach people to pay attention and you win most of those.

Wire fraud against a title company is not mass phishing. It’s one message, aimed at one closer, on one file, written by someone who has been reading the thread.

The Message That Gets You Has No Tells

Here’s the attack that actually lands. A real estate agent’s mailbox gets compromised, usually weeks earlier and usually through a credential stolen somewhere else entirely. The attacker sits in it. They read the file. They learn the names, the file number, the closing date, who talks to whom and how. Then, two days out, they send updated wire instructions from the agent’s actual account, on the actual thread, in the agent’s actual voice — and increasingly, with a language model polishing the tone so it matches the eight prior messages. There is no lookalike domain because it’s the real domain. There is no mismatched sender because it’s the real sender. There is no urgency beyond the ordinary urgency of a closing happening Thursday.

Run that message through every check the training taught, and it passes every one. Worse, the closer who checks most carefully is the one most reassured by the result. She did what she was trained to do, found nothing wrong, and sent the wire. The training didn’t fail to prepare her. It actively certified the fraud.

Your Metric Is Lying to You

If your security vendor reports a 3% click rate on simulated phishing, that number measures your staff’s resistance to an attack you are not receiving. It says nothing about the one you are. I’d rather see a shop with a 15% click rate and a callback procedure that runs on every instruction change than a shop with a 2% click rate and a procedure that runs when somebody remembers. The first shop will lose a few minutes a month to fake emails. The second will eventually lose a file.

The metric worth tracking is procedural: of all the wire-instruction changes and payoff letters your office received this month, what percentage got an out-of-band verification to a number established before the transaction, and was that verification logged? That number is auditable. It’s also the number your cyber carrier is going to ask about after a loss — the August 25 post on cyber insurance covered why those endorsements make the verification a condition of coverage, not a suggestion. A click rate won’t help you with the claims adjuster. A log will.

Train the Trigger, Not the Tell

So change what the training teaches. The lesson isn’t “here is how to recognize a fraudulent message.” The lesson is “here are the events that run the procedure, every time, no matter how legitimate the message looks.” New or changed wire instructions. Any payoff letter, from anyone. Any request to expedite a disbursement. Any change to a file inside the last week. Those are triggers, and a trigger fires on the event, not on your opinion of the message that carried it.

This is the part people resist, because it feels insulting to the instinct. Of course the instructions look legitimate — they came from the lender’s real email address. But that’s exactly backwards. In the attack that actually happens, looking legitimate is the expected condition, not a reassuring one. “It came from the real account” is not evidence of anything. The May 14 post on closing checklists made the same point about aviation: a captain doesn’t skip the before-landing checklist because the approach feels normal. Normal is when the item gets missed.

Drill It Like You Mean It

Throw out the fake phishing email and replace it with a procedural drill. With a cooperating lender or agent’s consent, have a legitimate-looking instruction change arrive mid-file, from a real account, on a real thread. The test isn’t whether anyone spots it. Nobody is supposed to spot it. The test is whether the callback happens, to the right number, and gets written down. That is the only question that matters, and it’s the one the usual training never asks.

Then drill the hard cases, because the procedure rarely fails on perception. It fails on pressure. The instruction comes from the broker who sends you forty files a year. The seller is furious that the wire is late. The owner of the agency forwards the change personally and says just send it. Run those scenarios, and when the procedure breaks, make the debrief blameless. A shop where a closer gets chewed out for slowing a wire by twenty minutes is a shop where the control will die quietly, and you’ll find out which Friday it died on.

Where the Software Belongs in This

Training decays. Ninety days after the session, the trigger is a habit for some people and a memory for the rest, and volume erodes habits faster than anything. The durable fix is to put the trigger in the system rather than in the person. That’s what Sentinel does on the payoff side: every payoff letter is read before the money moves, the wire instructions are extracted and checked against the Federal Reserve directory and a library of verified lender fingerprints, and the file gets a PASS, REVIEW or FAIL with the reasons listed. The closer still makes the call. The system makes sure the call gets made on every file, not the ones somebody remembered, and it keeps the record that proves it.

If you run one wire-fraud training this October, make it the one that tells your closers to stop looking for tells. The message that beats them won’t have any.

See how Sentinel verifies every payoff before the wire →