A Florida couple preparing to close on a new home wired $38,805.17 using instructions that appeared to come from their title company. The sender’s email address was missing a single letter, directing their money to an account the real firm did not control.
Matthew Brock and his wife, Stefanie, were handling the final payments for their home purchase in January 2025. While Stefanie received fraudulent instructions, her father received legitimate wiring details for a separate payment to the company handling the closing.
Lake Wales Police investigators later traced the Brocks’ transfer to a North Carolina bank account allegedly controlled by Cecil Porter Bartu, 42, of Maryland. Surveillance footage showed a $33,100 withdrawal, and an officer familiar with Bartu identified him from a photograph obtained during the investigation.
Bartu was arrested in August 2026, more than a year after prosecutors initiated the criminal case. He faces three felony charges in Polk County, including scheme to defraud, grand theft and fraudulent use of personal identification information. He has pleaded not guilty.
One Missing Letter Redirected the Homebuyers’ Money
The Brocks had been communicating with Nasseh Law, the firm handling their real estate closing. According to investigators, the legitimate correspondence came from an address ending in “.com,” while the fraudulent messages used the same name with a “.co” ending.
Stefanie began receiving the spoofed messages in late December 2024. The fraudulent emails appeared to come from a paralegal at the firm and contained details associated with the property transaction.
On Jan. 8, 2025, Stefanie received instructions to send $38,805.17 to a First Horizon Bank account. Her father received authentic wiring instructions from Nasseh Law for a separate transaction. Both transferred money using the instructions they had individually received.
The following day, Nasseh Law contacted Stefanie about the expected payment. She explained that she had already sent the money, but the firm said the funds had never arrived. Stefanie confirmed with her bank that the transfer had been completed, then compared the instructions she received with those supplied by the real firm.
The fraudulent instructions used the firm’s business name, logo and other identifying details, but listed a different bank and account number. They also omitted a warning included in the legitimate instructions telling customers to verify wiring details before transferring funds.
Matthew later described how easy the email difference was to overlook during an interview with News 6. The couple initially believed they were completing an ordinary step toward receiving the keys to their new home.
Bank Records Led Investigators to a $33,100 Withdrawal
According to the Lake Wales police affidavit, the account receiving the Brocks’ money had been opened on Nov. 13, 2024, with an initial $100 deposit. Investigators said no additional deposits were made until the $38,805.17 wire arrived on Jan. 9, 2025.
Detectives identified Bartu as the account holder. The fraudulent wiring instructions also included the name “Libquest,” which investigators said was associated with the account.
On Jan. 9, Bartu allegedly entered the Charlotte Uptown Banking Center and withdrew $33,100. Investigators obtained surveillance footage of the transaction and forwarded a still photograph to the Raleigh Police Department.
A Raleigh officer identified Bartu from previous contact with him, according to the affidavit. Investigators also connected him to a vehicle photographed outside another bank branch.
After the first withdrawal, Bartu allegedly traveled to the Charlotte Southpark Banking Center and attempted to obtain the remaining funds. First Horizon had placed a hold on the account, preventing him from withdrawing the full balance.
Investigators identified another $485.50 withdrawn through two ATMs in Charlotte that same day. The affidavit alleges that the bank later closed the account and transferred the remaining money back to Stefanie.
The Brocks told FOX 35 in February 2025 that approximately $5,000 had been recovered. They eventually completed their home purchase with financial assistance from family, friends and supporters.
Prosecutors Filed Three Felony Counts
The Polk County criminal case was opened in April 2025. Prosecutors subsequently filed a three-count Information charging Bartu with scheme to defraud involving at least $20,000, grand theft involving at least $20,000, and fraudulent use of personal identification information.
The first count alleges that Bartu participated in a scheme to obtain property through fraudulent representations between Dec. 27, 2024, and Jan. 9, 2025. The second alleges that he knowingly obtained or used money belonging to the Brocks or Nasseh Law during the January transaction.
The third count concerns the alleged unauthorized use of Nasseh Law’s identifying information. Prosecutors accuse Bartu of using that information with fraudulent intent and without the firm’s consent.
The first two charges are second-degree felonies. The scheme-to-defraud count is charged as organized fraud under Florida’s Communications Fraud Act, specifically Section 817.034(4)(a)(2), while the grand theft count falls under the state’s theft law. The personal-identification charge is a third-degree felony under Section 817.568.
The charges are contained in Polk County Circuit Court case 53-2025-CF-003206-A000-XX. The prosecution followed an investigation that involved the electronic transfer, bank account records, surveillance footage and identification evidence obtained from North Carolina.
Bartu Was Arrested in August and Later Allowed to Return to Maryland
According to the sheriff’s booking record, Bartu was arrested on Aug. 22, 2026. The Polk County Sheriff’s Office recorded three charges, with bond amounts of $10,000 for each of the two second-degree felonies and $5,000 for the third-degree felony.
September 15 court minutes show that Bartu entered not-guilty pleas to all three charges. At that time, the court recorded him as being in custody.
On Sept. 17, Bartu’s defense filed a motion requesting permission for him to return to his residence in Maryland. His attorney argued that he had no place to live in Florida and was willing to comply with additional reporting requirements imposed through pretrial supervision.
The sheriff’s booking record lists Bartu’s release from jail on Sept. 21. The following day, Circuit Judge Cassandra Denmark granted his request to return to Maryland. Under the September 22 court order, Bartu was permitted to return to his Maryland home, provided he continued contacting his pretrial release officer as instructed. The remaining release conditions stayed in effect.
The Polk County case docket lists the prosecution as pending. A status conference is scheduled for Oct. 9, 2026, at 8:30 a.m., followed by a pretrial conference on Nov. 19 at 8:30 a.m. Both are scheduled at the Polk County courthouse in Bartow.
Bartu is presumed innocent of the charges unless proven guilty in court.
Verify Closing Instructions Before Wiring Money
The Consumer Financial Protection Bureau identifies fraudulent wiring instructions as a mortgage closing scam. Criminals can imitate title companies, settlement agents, attorneys or real estate professionals to redirect funds intended for a property purchase.
The Brocks’ experience illustrates why buyers should independently confirm the receiving bank and account number before sending closing money. The CFPB advises establishing trusted telephone numbers for the closing professionals in advance and using those numbers to verify any payment instructions, rather than relying on contact information contained in an unexpected email.
The FBI classifies similar incidents as business email compromise. Small changes in a sender’s address, combined with authentic-looking business details, can make fraudulent instructions difficult to distinguish from legitimate correspondence.
If a wire has already been sent to the wrong account, buyers should immediately contact their financial institution and request that it attempt to recall the transfer. They should also retain the messages, account instructions and transaction records and report the incident through the FBI’s Internet Crime Complaint Center.