It seemed like just one of the many details that go into buying a house: to close the deal for their dream home near Lebanon, Pauline and Ben Weintraub needed to send a cashier's check or wire transfer.

In an email thread with their title company and real estate broker to arrange finals details, a message arrived suggesting they wire the money to avoid delaying the transaction. It was a big sum, $379,000, but the Weintraubs had been saving for years, and everyone in the thread was trusted.

They notified their broker the money was sent, then arranged the meeting to sign the papers and seal the deal. And then their broker called.

Their money had vanished. Their new home was on hold.

The broker told them the wire transfer hadn't gone through, and that he had never sent the email with the account number for the transfer. The couple appeared to be out hundreds of thousands of dollars, and it looked like they would lose their new house, too.

"We're super, super screwed right now," Ben Weintraub recalled thinking. "It's the worst possible combination that you could have imagined."

Investigators say the Weintraubs appear to have fallen victim to a new, insidious online scam. Hackers somehow obtained access to the email conversation with their broker and title company, then impersonated the broker and sent a fraudulent account number for the wire transfer.

Bankers and cybersecurity experts warn this kind of theft isn't as far-fetched as is it might sound, with criminals targeting nearly $1 billion in real estate transactions last year through similar scams.

"There's been a lot of these cases. I know hackers are going after either title companies or real estate agents," said Ken Westin, a senior security strategist and researcher in Portland. "This is becoming pretty common."

The Weintraubs landed with a rare fortunate ending: Months later they recovered most of the money they lost – and they got their dream home, too, after arranging an emergency, short-term loan. But experts say they were unusually lucky. Most people never see the money again.

The couple, young professionals in their mid 30s, were living in North Albany but wanted a home in the country. They had been looking for years and had made offers a couple times before.

When they found a 30-acre property for sale in a rural area near Lebanon, the Weintraubs were determined not to let it get away. It's private, on a dead-end street, close to family and just a short drive from Pauline's work. They hope to have a little hobby farm, growing lavender running a seasonal U-cut operation.

Everything about the purchase seemed routine, so far as they could tell. Their email thread with the title company and broker show the parties working out mundane details, like where to sign the papers.

There are clues, in hindsight, that show where things started to go wrong. Emails that appeared to be from their broker abruptly changed topic and began making spelling and grammatical errors as the messages pushed for a prompt wire transfer.

"If you wire, funds will be good funds right away," one message said. "They required you should wire funds now to avoid delay in closing. Let me know when you can send wire so I can send you wire instruction."

To the Weintraubs, none of that stood out in the context of a longer online conversation. And there was nothing strange about the request to wire the money – they had discussed it with the broker earlier.

"In this case, the emails and the directions on the wire (apparently) came from a trusted source," said Lebanon Police Det. Justin McCubbins, who is investigating the case.

Cybersecurity experts frequently warn about "spoofing" attacks, in which a hacker impersonates a trusted correspondent. The Weintraubs were apparently victims of an even more sinister scam, in which the spoofer inserted himself or herself into an ongoing email conversation.

"Essentially a hacker gets into an account and sits in an accounts and just waits," McCubbins said. He said he believes the hackers were lurking quietly, scanning their conversation for an opportune time to impersonate the broker and redirect the Weintraubs' money to the fraudulent account.

"The level of sophistication in this case is definitely higher," McCubbins said.

Jolene Watson manages Umpqua Bank's branch in Lebanon, where the Weintraubs kept their money. She said the bank immediately tried to stop the transfer and contacted Bank of America, home to the fraudulent account.

"To be honest, when I first heard about the situation, it was a gut-wrenching moment because when you do a wire (transfer) you often are unable to get the funds back," Watson said in an email. At Umpqua's request, Bank of America froze the fraudulent account – preserving most of the Weintraubs' funds.

"While I've not run into this exact type of fraud much, it is a growing national problem as cyber-criminals appear to have become more sophisticated at targeting the mortgage process," Watson said. "Homebuyers should definitely be aware of the risk and take precautions."

The FBI told The Miami Herald that criminals running this kind of scam tried to divert nearly $1 billion from real estate transactions during the last fiscal year through fraudulent wire transfers, up from just $19 million the prior year.

While McCubbins and the banks investigated, the Weintraubs' were left in limbo for more than a month. They say Bank of America refused to respond to their inquiries for weeks, so they told their story to The Oregonian/OregonLive.

The media outlet inquired on their behalf, and the Weintraubs said they heard from Bank of America almost immediately. Days later, the bank said it had a "resolution" to the issue – and a week later, the Weintraubs received a check for $362,000.

That covered most of their losses but left them more than $17,000 short. They said Bank of America would not explain why they didn't get the full amount.

In response to another inquiry from The Oregonian/OregonLive, bank spokeswoman Britney Sheehan declined to specifically address the Weintraubs' case, citing security and privacy. However, she said that fraudulent wire transfers typically involve multiple victims making claims on the same money.

"Each claim is thoroughly researched," Sheehan wrote in an email. "After our research is complete — and if we're lucky enough to recover any funds, which is rare — there is a process in place for returning any recovered funds to the claimants and the originating banks."

The hacker or hackers who stole the Weintraubs' funds could be anywhere in the world, so the chances of catching them and recovering the rest of the money are remote.

Still out $17,000 – plus another $8,000 in fees and interest triggered by the delay in closing the deal – the Weintraubs' asked their broker to cover their loss and told him others had suggested they sue. He declined to compensate them, asserting he had no liability for what happened.

The broker, Brian Weinhold, owner of Vanguard Realty Group in Corvallis, declined to say whose email account he believes was hacked.

"Either way, what does it matter? The damage was done, and this is happening all over," Weinhold said in an interview. Ultimately, he said, his clients were at fault.

"They made a poor choice to wire money when it had all the signs and markings that they shouldn't have done it," Weinhold said, noting misspellings and grammatical mistakes in the email thread. "It's unfortunately on them."

The Weintraubs don't see it that way – grammar and spelling mistakes are pretty common in email, after all. But Ben Weintraub said they're not dwelling on what happened, either.

"It's nice that we got the property and we got most of the money back," he said. "It would be nice to get the missing money to really feel complete."

Bankers and online security experts suggest taking an extra step when large sums are involved: call before sending money, talk directly to people you know, and slow down if things start to seem fishy.

"We don't really trust anyone anymore," Ben Weintraub said. "I think that's a big thing that came out of it: Let's triple-check everything now."

-- Mike Rogoway | twitter: @rogoway | 503-294-7699