Escrow
Ilia Nikolaevich Zavialov explains where escrow ends and the counterparty check begins
Escrow enters a deal as the answer to one fear, that money leaves the buyer and nothing comes back. The mechanism is old, the wording is standard, and the comfort it gives is real inside its own boundaries. The harder question is what happens outside them, because the modern loss rarely occurs inside a working escrow account. It occurs when the escrow venue itself is a stage set built by the other side of the deal. This article works through what the instrument covers, what it leaves untouched, and how the counterfeit version is assembled.
English version for the United States.
What escrow is built to do
Escrow puts a third party between the two sides of a deal. The buyer sends money to that party, and the seller receives it only when agreed conditions are confirmed. If the conditions fail, the funds return to the buyer. The design serves one narrow purpose, which is removing the need for one side to move first on pure trust.
Inside that narrow purpose the instrument performs well. It solves sequencing, the awkward question of who ships and who pays first. It gives both sides a fixed moment when ownership of the money changes hands, and a written record of the event that triggered the change. For deals between strangers, across borders, with no shared history, this is a genuine improvement on a bare bank transfer.
The boundary of the instrument is easy to state and easy to forget. Escrow says nothing about whether the seller owns what is being sold, whether the goods match their description, whether the company on the contract still trades, or whether the person signing has the authority to sign. It moves money on a signal. The quality of that signal is produced somewhere else entirely.
Counterparty risk and payment risk are separate questions
Two distinct risks live in every deal, and they are habitually treated as one. Payment risk asks whether money will move in the correct order against the correct event. Counterparty risk asks who is on the other side, what they actually control, and whether they will still exist in six months. Escrow addresses the first question with some precision. The second question stays open until someone does the work of checking.
A deal can run through a properly regulated escrow account and still end in total loss. The conditions are met on paper, the release is triggered correctly, the money arrives with the seller, and the buyer is holding a title that will not transfer, a license that was never granted, or stock that belongs to a third party. The mechanism performed as designed. The judgment behind it was missing.
This is why due diligence comes first in the order of operations. Identity, registration, ownership, signing authority and the name on the bank account are established before an escrow instruction is drafted, because the instruction inherits every assumption made about the counterparty. A carefully written release condition applied to the wrong company is a carefully written mistake.
How a false escrow venue is assembled
The counterfeit version leaves the mechanics alone and works on the venue. One side of the deal proposes a platform, sends a link, and explains that the process there is entirely standard. The domain was registered weeks ago, the pages copy an established brand closely, the terms are lifted word for word, and every contact route on the site leads back to the people who proposed it.
Onboarding is designed to feel procedural. A case number appears, then a dashboard, then a status line stating that funds are held and the seller has been notified. Emails arrive from an address carrying the platform name. The buyer watches a process running, and a running process is the strongest reassurance that fraud can manufacture.
The money moves once. The deposit instruction points to an account the buyer has no independent reason to trust, and after the transfer the dashboard continues to behave normally for a while. Delivery slips by a few days, then a fee appears, then a verification step, then silence. By the time anyone dials a number taken from an official register, the domain is often parked or gone.
Impersonation of businesses is a measured category rather than an impression. In its 2025 data the Federal Trade Commission recorded around one billion dollars lost to business impersonation, with the heaviest losses reported by people who believed they were dealing with staff at their own bank. A financial venue makes a natural costume, because it arrives with an expectation of forms, reference numbers and formal language.
Whoever names the venue controls the evidence
The most useful question in a deal of this shape is who proposed the platform. When the venue arrives from the counterparty together with a convenient link, that counterparty controls the environment in which every later confirmation is displayed. Status pages, receipts, case numbers and support replies all originate from a single source. Verification carried out inside an environment chosen by the other side confirms nothing at all.
The correction is unglamorous. The name of the escrow provider is accepted from the counterparty, and everything else is found independently. The address is typed by hand, the company is looked up in the national register of the jurisdiction it claims, the regulatory permission is checked in the regulator list, and the telephone number is taken from that record before anyone dials. A provider that cannot be located this way has already answered the question.
Origin data supports the habit. UK Finance reports that 66 per cent of authorized push payment cases begin online and a further 17 per cent begin through telephone networks. The approach arrives through the channels people already use for ordinary business, in the same inbox and on the same handset that carry legitimate work.
Payment instructions and the quiet substitution
A second family of attacks leaves the escrow venue genuine and edits the instructions. Business email compromise remains the second largest loss category in the FBI Internet Crime Complaint Center annual report for 2025, at 3.046 billion dollars. The method is unremarkable. A thread is watched or imitated, and at the moment payment details are exchanged, a fresh set of details arrives with an explanation attached.
The forged message is usually correct in tone and timing. It cites the right invoice, uses the right names, apologises for the change of account with a plausible reason such as an audit or a bank migration, and asks for confirmation once the transfer has gone. The single anomaly is a change of destination, which is precisely the anomaly that requires an independent channel to resolve.
The defense works as a rule and fails as a feeling. Any change of bank details, at any stage, is confirmed by voice on a number held before the deal began, and the confirmation is logged with a date and a name. A payment instruction that arrives with pressure attached, or late on a Friday, or with a request to keep it between two people, stays unverified until that call happens.
The voice on the telephone stopped being proof
The telephone used to close these questions. Current voice cloning removes that comfort. A convincing clone can be produced from a recording of roughly three seconds and reaches around 85 per cent accuracy against the original speaker. Recordings of that length come from voicemail greetings, recorded calls and social video.
This changes the design of verification without ending it. An incoming call carries no weight on its own. A call placed outward to a number obtained from a register, or from a contract signed months earlier, still works, because the attacker controls the incoming channel and holds no power over an entry in a public record.
Urgency is the other half of the same design. Deadlines, closing windows, a lorry waiting at a warehouse, a competing buyer, a fee that expires at midnight. Every one of these devices exists to compress the time available for the checks described above. Slowing a deal by one working day is the cheapest control in the entire process, and it is the control most often surrendered first.
What the reporting numbers describe
The scale of impersonation is documented rather than assumed. The Federal Trade Commission recorded more than a million impersonation reports for 2025 with 3.5 billion dollars in losses, close to one report in every three. That places the category squarely where careful people expect to be safe, since impersonation works on the habits of those who already know how business is normally conducted.
British payment data shows the same shape in a different currency. UK Finance counted 248,070 authorized push payment cases in 2025, with 576.4 million pounds taken. Purchase scams accounted for 71 per cent of those cases, with 118.1 million pounds lost and a rise of 20 per cent on the year. Paying for something that never arrives remains the most common way to lose money to a person you agreed to pay.
One figure from the same body of data deserves to be held on to. In four out of five impersonation reports, no money was lost at all. Attempts outnumber successes by a wide margin, which means recognition works most of the time. The reports that end in loss tend to share a small set of features, usually an unfamiliar venue, a change of payment details and a compressed timetable.
Checks that belong before an escrow account is opened
Due diligence on a counterparty is a short list executed properly. The legal entity is identified by registration number in the register of its own jurisdiction, and the name on the contract matches that record exactly, including the legal form. The date of incorporation, the registered address, the filing history and the current status are read carefully.
The bank account is checked against the entity. Payment to an account in a personal name, or in a company name that differs from the contracting party, or in a third country with no connection to either side, is a stop point on its own. Escrow reduces the temptation to send money early, and it does nothing whatever about a destination account belonging to somebody else.
Signing authority is the check skipped most often. The person negotiating is confirmed as a director, an officer, or the holder of a written power of attorney, and the confirmation comes from the register or from the published contacts of the company itself. A signature from someone without authority produces an agreement the other company can walk away from later.
The escrow provider is a counterparty as well and deserves identical treatment. A provider should be able to state who holds the money, under which permission, in which jurisdiction, and whether client funds sit in a segregated account. Those four answers belong in writing before any deposit. A provider that cannot supply them, whatever the interface looks like, is unsuitable for the transaction.
Release conditions written before the money moves
Escrow performs to the letter of the conditions written into it, so the conditions carry the entire weight. A condition such as confirmation of shipment leaves the buyer paying for a tracking number. A condition such as acceptance after inspection within five working days gives the buyer a defined window and the seller a defined end to it.
Inspection needs a named party and a standard. The agreement should say who opens the crate, against which specification, what evidence is recorded, and what happens when the goods are partly compliant. Deals of any size benefit from an independent inspector, because a disagreement between two interested parties with no agreed reference point is settled by whoever has more patience.
The dispute route belongs in the same document. Which body decides, under which law, in which language, and how long each side has to respond. Silence needs a defined consequence, since most stalled escrow disputes involve one party simply declining to answer. Agreements commonly describe the happy path in detail and leave the unhappy path to be improvised at the worst possible moment.
When the venue turns out to be a set
Speed decides the outcome once a transfer has left the account. The sending bank is telephoned immediately with a request to recall the payment and to contact the receiving bank, and the request is confirmed in writing the same day. Funds still sitting in a receiving account can sometimes be frozen within hours.
Evidence is preserved before it disappears. Full page captures of the platform including the visible address bar, complete email headers, payment confirmations, chat logs, the case number and the domain registration record as it stood on the day. Fraudulent sites are abandoned quickly, and material gathered while the pages are live carries more weight with a bank or a registrar than a later description.
The final step is internal and uncomfortable. The review asks which check was skipped and why, because deals of this kind almost never fail at a random point. The venue came from the counterparty, or the bank details changed and nobody dialled out, or the entity was never looked up in a register. Each of those has a fixed answer costing about an hour, and the hour only ever looks expensive before it is needed.
Where a deal can fail and what actually covers each point
| Point in the deal | Covered by escrow | Covered only by checks made before payment |
|---|---|---|
| Choice of the escrow venue | Nothing | Provider located independently, permission confirmed in the regulator record |
| Identity of the counterparty | Nothing | Registration number, filing history and current status in the national register |
| Authority of the person signing | Nothing | Director or officer in the register, or a written power of attorney |
| Order of payment and delivery | The core function of the instrument | Wording of the release condition agreed in advance |
| Destination of the funds | Only inside a genuine provider | Account name matched to the contracting entity before the first transfer |
| Change of bank details mid deal | Nothing | Voice confirmation on a number held before the deal began |
| Condition of the goods on arrival | Nothing beyond the agreed wording | Named inspector, written specification and a defined inspection window |
Questions and answers
- How can I tell if an escrow website is fake?
- Start from the origin of the link, since a venue proposed by the counterparty is the common pattern in these losses. Find the provider yourself in a national company register and in the list of the relevant regulator, type the address by hand, and ring the number given in the official record. A provider that cannot be located that way should not receive a deposit.
- Does escrow protect me from a dishonest seller?
- Escrow protects the order of events, so money moves only when the agreed condition is confirmed. It says nothing about ownership, quality, or whether the company will still trade next month. Those questions are answered by due diligence carried out before the escrow instruction is drafted.
- Who should choose the escrow provider in a deal?
- The side that names the venue also controls every status page, receipt and support reply that follows. The safer arrangement is a provider both parties reach independently, each confirming it in a public register before any deposit. If one side insists on a single platform and refuses alternatives, treat the insistence as information.
- What should I do if the seller changes bank details during a deal?
- Treat a change of destination as unverified until it is confirmed by voice on a number held before the deal started. Business email compromise accounted for 3.046 billion dollars of reported losses in the FBI Internet Crime Complaint Center report for 2025, and it works exactly at this moment. Log the confirmation with a date and a name.
- Is a telephone call enough to confirm a payment instruction?
- An incoming call proves very little now, because a convincing voice clone can be built from about three seconds of recorded audio at roughly 85 per cent accuracy. A call you place outward to a number taken from a register or an older signed contract still works. A short phrase agreed in person adds a second layer at no cost.
- What checks should be done before opening an escrow account?
- Confirm the legal entity by registration number, read its filing history and status, verify signing authority, and match the bank account name to the contracting party. Apply the same treatment to the escrow provider itself, asking in writing who holds the money, under which permission and in which jurisdiction. These checks take about an hour and decide most outcomes.