You are three days out from clearing a balance. Maybe it is a consolidation closing. Maybe you are simply done after fourteen months of daily remits. A payoff letter lands in your inbox with the figure, the per diem, the good-through date, and the wire instructions. One wire and the file closes.
That week is the most exposed week in the life of the deal.
The exposure lives in the email thread. A payoff pulls three parties into one conversation: the merchant, the broker, and the company that holds the balance. One large figure, a hard deadline, and a stranger only needs to get into one of those inboxes once. Three versions of this cross my desk often enough that they are worth laying out side by side, because they look different on the surface and they are the same con underneath.
The payoff redirect.
A letter arrives that looks exactly like the one you were expecting. Same letterhead, same rep name. The figure matches what you discussed on the phone last week. The routing and account numbers are the only new thing on the page, and they are the only thing on the page most people never read twice. The crook either got into an inbox somewhere in the thread or registered a domain one character off from a real one, then sat quietly until payoff week.
The remittance change.
Mid-deal, an email announces that the company you owe has switched banks and the final payoff should go to a new account. Companies do switch banks. Rarely. And a real one will confirm the change on a call you place to the number printed in your original contract. A crook cannot survive that call. An email can say anything.
The closing-week intercept.
This one is timed. The crook knows a payoff is due at a closing and sends corrected instructions a few hours before the wire cuts. Sometimes the knowledge comes from a cracked inbox. Sometimes it comes from public paper. Everyone moves fast on closing day, and that speed is the whole play.
Worth pausing on how a stranger knows your payoff schedule at all. The lien filing recorded when your deal opened is public record, so the fact that your shop owes somebody, and roughly since when, is visible to anyone who looks. The same public trail that feeds the cold callers feeds this. Add one cracked inbox anywhere near the file and the crook can read quietly for weeks, waiting for the word payoff to show up in a subject line.
A trades file from this spring, told at pattern level because I see a version of it most quarters. Payoff letter arrives on a Tuesday. Thursday morning brings updated instructions, a new bank, a polite apology for the confusion. Closing is Friday. The owner does the responsible thing and calls to verify. Except he calls the number at the bottom of Thursday’s email, and the friendly voice on the other end confirms every digit. The number belonged to the crook. The confirmation was part of the costume. The wire went out Friday, and the following week the real balance was still owed in full.
Hold that file in mind and look at what a payoff letter actually contains. A figure, say $61,380. A per diem, say $158. A good-through date, often ten days out. The letter is built to give you room. Nothing about a legitimate payoff requires you to wire within the hour, and a request that manufactures that kind of pressure is telling on itself.
So when instructions change inside the final week, you have two plays.
Play one, wire anyway and protect the closing date. Best case, you saved a day. Worst case, the payoff went to a stranger, the balance is still owed in full, and the closing you were protecting is now further away than when you started.
Play two, stop and verify at a number that existed before payoff week. The one printed in your original contract, or the saved contact from month one of the deal. Read the account and routing digits back to a person you called, and have them read the figure back to you. If that slips the closing by a day, it slips by a day. Against the example above, the slip costs $158 of per diem. The wrong wire costs $61,380, and the balance behind it is still due.
I would take play two on every file I have ever touched.
If a wire has already gone out to the wrong account, the clock matters more than anything else you do next. Call your bank first and ask for a recall. Then file a complaint at ic3.gov the same day, because the report is what puts the receiving account in front of people who can freeze it. I will be straight about the limits. A recall works sometimes, mostly when the dollars have not moved again and the report went in fast. Once the receiving account is drained, you are writing the whole thing off. The call you make before the wire is worth more than everything you can do after it.
For what it is worth, the clean version of payoff week is boring. The figure comes from the portal or from a call you placed. Any change in instructions gets confirmed by voice at a number you already had. The wire references the contract number. No legitimate company is offended by any of that. I have never had a real one refuse to confirm its own account digits on a call the merchant placed, and the ones who push back on being verified are telling you something.
The figure on a payoff letter gets read carefully by everyone at the table. The account digits underneath it are usually read by nobody. Flip that habit. The figure is arithmetic, and arithmetic argues back if it is wrong. The digits just sit there looking official, and they are the only part of the letter a crook needs to change.