Mortgage Closing Scam

Catalog of Scams: Mortgage Closing Scam

A Mortgage Closing Scam is a sophisticated fraud that targets homebuyers, real estate agents, or attorneys during the closing process of purchasing a property. Scammers usually gain access to sensitive information by hacking into email accounts of those involved in the transaction, such as the buyer, the real estate agent, or the attorney. Once they have access, they monitor the communication related to the closing process, waiting for the moment when the buyer is about to transfer funds for closing costs or a down payment.

Scammers also gain knowledge by reviewing public records that often contain sensitive information about sellers.

The scam typically unfolds when the buyer receives an email, seemingly from their real estate agent, attorney, or mortgage lender, providing new wiring instructions for the transfer of funds. This email looks legitimate because it closely mimics the actual communication between the parties, often containing details specific to the transaction that the scammer obtained through their earlier hacking. However, the email is fraudulent, and the wiring instructions direct the funds to a bank account controlled by the scammer.

Because mortgage closings often involve large sums of money, these scams can result in significant financial losses for the victim. By the time the fraud is detected—usually when the legitimate parties inquire why the funds were never received—the money has already been transferred, often to accounts that are quickly emptied or routed through multiple foreign banks, making recovery nearly impossible.

Scammers take advantage of the urgency and time-sensitive nature of the mortgage closing process. Buyers may be under pressure to finalize the deal, making them less likely to carefully scrutinize the wiring instructions or confirm the authenticity of the request. Since the emails appear legitimate and are timed perfectly within the transaction timeline, victims often don’t question the changes in instructions.

The scam is facilitated through phishing attacks, where the scammer either tricks someone into providing email login credentials or installs malware that gives them access to email accounts. Once they are inside the email system, scammers monitor the communication, waiting for the opportune moment to send the fraudulent wiring instructions.

The fake email typically contains subtle changes to the sender’s address, like an extra letter or number, to make it look authentic. For example, an email from the real estate agent might come from a slightly altered address that the victim does not notice. The tone, language, and formatting of the email are often meticulously crafted to match previous legitimate correspondence, making it difficult for the buyer to detect anything suspicious.

The Mortgage Closing Scam is particularly devastating because it can jeopardize the entire home purchase, and victims may not have the resources to replace the stolen funds. Additionally, once the money is transferred, it is often moved quickly between various accounts, making it difficult for authorities to trace and recover the funds. This type of scam has become increasingly common with the rise of online real estate transactions and the increased reliance on email communication for sensitive financial dealings.

In summary, a Mortgage Closing Scam targets unsuspecting homebuyers by exploiting vulnerabilities in email communications to steal large amounts of money during the closing process of a property purchase. The scam relies on the victim’s trust in seemingly legitimate emails that contain fraudulent wiring instructions.

Glossary

• Account number validation — This refers to a bank’s process of confirming that a destination account exists and can receive funds. A mismatch or failed validation often signals risk and should prompt a pause. A buyer can ask the bank to verify beneficiary details before any transfer.
• ABA routing number — This is the nine-digit code that identifies a U.S. financial institution for domestic transfers. Criminals sometimes substitute a near match to divert money. Verification with the known bank name prevents misdirection.
• Beneficiary account — This is the account designated to receive a wire. In mortgage fraud, the name may look right while the account belongs to a criminal. A buyer should ask the bank to compare both name and number before release.
• Business email compromise (BEC) — This is a takeover or spoofing of a professional email account to redirect payments. Real estate deals are frequent targets because timelines are predictable and funds are large. Strong authentication and live callbacks reduce exposure.
• Callback verification — This is a voice confirmation using a phone number independently obtained from closing documents or a known website. The caller reads back invoice numbers, amounts, and bank details to an authorized staff member. It stops most payment diversion attempts.
• Cashier’s check policy — This is the title company or attorney rule for accepting cashier’s checks in place of wires. Limits often apply due to counterfeits and funds availability delays. Written policies help buyers plan safer payments.
• Closing attorney — This is the licensed lawyer who conducts settlements in states where attorneys handle closings. The attorney’s office issues instructions only through confirmed channels. Any change must be verified by a live call.
• Closing costs — These are fees and prepaid items due at settlement, separate from the down payment. Scammers copy legitimate figures to add credibility to fake instructions. A buyer can confirm totals against the latest closing disclosure.
• Closing disclosure (CD) — This is the federally required statement listing final loan terms and all closing charges. The CD shows who receives funds and in what amounts. Differences between the CD and an emailed request should be treated as a warning.
• Compromised inbox — This is an email account that has been accessed by an unauthorized person. The intruder reads threads, sets silent forwarding rules, and waits to strike. Password changes and removal of rogue rules are necessary after any suspected incident.
• Domain lookalike — This is a web or email address altered by one character to imitate a legitimate sender. Examples include swapped letters or added punctuation. Careful reading of full addresses, not display names, prevents mistaken trust.
• Earnest money deposit (EMD) — This is the initial deposit that shows a buyer’s good faith. Scammers often target EMD because it moves early in the process and feels routine. Safe delivery follows written instructions confirmed by phone.
• Email forwarding rule — This is an automated mailbox setting that quietly sends copies of messages to another address. Criminals use it to monitor conversations without obvious signs. Deleting unknown rules is part of any account cleanup.
• Escrow account — This is the neutral account that holds funds until the transaction conditions are met. In a safe process, only the verified escrow holder provides instructions. Requests to move money outside escrow signal danger.
• Faster payment recall — This is the request a sending bank makes to retrieve funds after a mistaken transfer on fast payment rails. Success depends on immediate reporting and whether the receiving bank has frozen the funds. Speed is critical.
• Final funding instructions — These are the last, signed wiring details issued by the settlement agent. Legitimate instructions rarely change close to closing. Any change requires live confirmation with the agent at the published number.
• Funds availability hold — This is the temporary restriction a bank places before deposited funds can be used. Holds vary by instrument and bank policy. Understanding holds prevents rushed substitutions that expose buyers to risk.
• Funds recovery letter — This is the written request a victim submits to the bank to initiate a recall or reversal. It includes transaction numbers, dates, and the fraud description. Precise documents improve the chance of a freeze at the receiving bank.
• Impersonation email — This is a message that appears to come from a trusted party but originates from a criminal. Tone, signature blocks, and logos are copied from real threads. Independent verification prevents acceptance of fake changes.
• International wire path — This is the route a transfer takes through correspondent banks to reach a foreign account. Criminals favor paths that move money through multiple jurisdictions. Early alerts to the sending bank can stop the chain before funds settle.
• Loan payoff statement — This is a lender document showing the exact amount required to satisfy an existing loan. Payoff fraud swaps the destination account with a criminal’s account. Settlement agents confirm payoff details with the lender directly.
• Out of band confirmation — This is a verification using a different channel than the one where the request appeared. A phone call or in person check confirms details received by email. This practice defeats many account diversion scams.
• Payee name mismatch — This is a discrepancy between the named recipient and the account holder on file at the receiving bank. Banks sometimes ignore name fields on wires. Reading back the exact registered account name helps detect diversion.
• Payment diversion — This is the redirection of a legitimate payment to an unauthorized destination. In real estate, it occurs when new instructions replace confirmed ones. A culture of verified changes prevents diversion.
• Pretext message — This is a crafted communication that creates a false scenario to rush action, such as a sudden deadline or locked account. The message appears to solve a problem while steering funds to criminals. Calm verification disrupts the tactic.
• Receiving bank freeze — This is the block a receiving institution places on suspect funds after a fraud alert. A freeze is most likely when reporting is immediate and details are complete. Victims should ask both banks to coordinate directly.
• Settlement agent — This is the title company, escrow holder, or attorney responsible for handling documents and funds at closing. The agent issues wiring instructions and confirms receipt. Buyers should only follow instructions that the agent verifies live.
• Settlement statement — This is the ledger of all money flows in the transaction, often a law firm or title company document. It lists payees and amounts, which allows cross-checks with any emailed request. Discrepancies warrant a halt.
• Signature block spoofing — This is the copying of a real person’s email signature and footer to build credibility. Criminals paste logos, titles, and disclaimers into fake messages. Visual familiarity should never replace voice confirmation.
• Single-use payment portal — This is a secure link created by the settlement agent for one transaction. It avoids exposure from emailed bank numbers. Buyers should navigate to such portals from the agent’s known website, not a link in email.
• Title company — This is the firm that insures title and often conducts closing in many U.S. states. Its staff controls disbursements and verifies payoffs. Any instruction that bypasses this firm should be treated as suspect.
• Verification script — This is a short checklist used during callback verification. It includes file number, property address, exact dollar amount, and full beneficiary details read back by both parties. A consistent script removes guesswork.
• Wire fraud — This is the use of electronic communications to carry out a scheme to obtain money by false pretenses. Real estate closings are frequent targets due to high-dollar transfers. Prompt reporting to banks and law enforcement is essential.
• Wire recall request — This is the formal action a sending bank takes to retrieve funds after a mistaken or fraudulent wire. Success depends on speed and whether the receiving account remains open with funds intact. Victims should provide full transaction data at once.
• Wiring instructions — These are the bank details required to send a transfer, including institution, routing or SWIFT, account number, and beneficiary name. Legitimate instructions arrive on secure letterhead and rarely change. Any change requires independent confirmation before action.