Mortgage Fraud Red Flags: Appraisal, Wire, and Closing Scams

Mortgage fraud red flags fall into a handful of recognizable patterns: borrower information that doesn’t add up, occupancy claims that don’t match reality, inflated appraisals, tampered documents, suspicious money movement, fake wire instructions before closing, and “rescue” offers aimed at homeowners in distress. Spotting them early protects you from becoming either a victim or an unwitting participant in a federal crime. Under 18 U.S.C. § 1014, false statements on a loan application to a federally insured institution carry penalties of up to $1,000,000 in fines and up to 30 years in prison.¹

Borrower, Income, and Identity Warning Signs

Fabricated identity and employment data sit at the core of most mortgage fraud. One of the clearest tells is an employer’s business address that matches the borrower’s home address or the property being purchased. That overlap usually means someone invented a company to manufacture income. A borrower who lists only a cell phone number for their employer, with no verifiable corporate line, deserves extra scrutiny. So does a reported income that doesn’t fit the borrower’s age or job title. A 23-year-old claiming $250,000 annually as a “freelance consultant” should trigger questions, not just a checkbox.

Credit history tells its own story. An older applicant with an unusually thin credit file — few accounts, short history — may be using a stolen or synthetic identity. A sudden burst of new credit activity right before a loan application can signal someone building a false profile. Social Security number mismatches are the most severe red flag: digits that don’t correspond to public records or that belong to a deceased person point directly to identity fraud.²

Lenders now use third-party databases to cross-check employment data in real time. Services like Equifax’s Work Number pull payroll records directly from employers each pay cycle, letting lenders confirm income and job status without relying on documents the borrower supplies. Lenders are also required to re-verify employment within 10 days of the closing date, which catches borrowers who quit or lose a job after applying. When a borrower resists or delays consent for these verifications, the reluctance is itself a warning sign.

Occupancy Fraud and Straw Buyers

Occupancy fraud is one of the most common and most underestimated forms of mortgage misrepresentation. It happens when a borrower claims a property will be their primary residence to lock in a lower interest rate, a smaller down payment, and easier approval, while actually intending to use the property as a rental or investment. Standard mortgage agreements typically require the borrower to move in within 60 days of closing and live there for at least a year.

Signs that occupancy has been misrepresented include a mailing address that doesn’t match the property, the home appearing on rental listing sites, a homeowners’ insurance policy that switches to a landlord policy shortly after closing, or a long commute between the property and the borrower’s known workplace. Lenders increasingly use software to scrape rental platforms and cross-reference public records like voter registration and property tax filings. If occupancy fraud surfaces, the lender can accelerate the loan and demand the full remaining balance immediately, even if every monthly payment was made on time. Because the false statement appears on a federal loan application, the penalties under 18 U.S.C. § 1014 also apply.¹

Straw buyer schemes take this further. A straw buyer is someone with good credit who poses as the actual purchaser on a mortgage application while secretly acting on behalf of someone else, often a person whose own credit would disqualify them or an organizer running a property-flipping ring.³ Warning signs include a buyer unfamiliar with basic details of the property, a purchase funded entirely by another party, or the same buyer appearing on multiple transactions in a short period. The straw buyer faces the same criminal penalties as the organizer, and claiming ignorance of the scheme rarely holds up in court.

Appraisal and Property Valuation Red Flags

The appraised value sets the loan-to-value ratio, which makes it one of the most targeted numbers in a mortgage transaction. Inflating that value lets someone borrow more than the property is worth, and the fraud often goes undetected until the loan defaults.

Warning Signs in the Appraisal Itself

The easiest manipulation involves comparable sales, or “comps.” A legitimate appraisal uses recently sold properties in the same neighborhood with similar characteristics. When the comps are miles away, in a different school district, or in a clearly more expensive area, the choice is deliberate and inflates the subject property’s value. Photographic evidence deserves close attention too. If the report describes a mountain view or a renovated kitchen that doesn’t match the property’s actual condition or geography, the documentation has been fabricated.

Rapid property flipping is another classic sign. When a property changes hands multiple times within six months at significantly increasing prices without any documented renovations, the transactions are likely staged to create a paper trail of rising value.⁴ An appraiser based 100 miles from the subject property also warrants concern. They may lack the local market knowledge for an accurate valuation, or they may have been selected specifically because they won’t visit the property in person.

Pressure on the Appraiser

Federal law makes it illegal for anyone involved in a mortgage transaction to pressure an appraiser into hitting a target value. Under the Truth in Lending Act’s appraisal independence requirements, no loan officer, broker, or other interested party can coerce, bribe, or intimidate an appraiser to inflate a valuation.⁵ The implementing regulation identifies specific violations: threatening to withhold payment unless the appraiser meets a value threshold, promising future business in exchange for favorable numbers, or blacklisting an appraiser who came in low on a previous deal.⁶

If a loan officer insists you use a specific appraiser, pushes back on an appraisal that came in “too low,” or suggests the appraiser should “reconsider” the valuation, the independence rules are being violated. Lenders are required to use appraisal management companies or randomized selection processes to keep the appraiser at arm’s length from the people who profit from the loan closing. You can verify whether an appraiser is properly licensed through your state’s appraisal regulatory board, which maintains a searchable online database.

Document Tampering and Missing Paperwork

Physical anomalies in loan paperwork are common in fraud cases and often visible to the naked eye. Blurry scans, misaligned text, white-out marks, or correction fluid residue all suggest original figures were altered before submission. Different fonts or ink colors across sections of the same document indicate tampering. A bank statement doesn’t naturally switch from Times New Roman to Arial halfway through.⁴ Handwriting that doesn’t match the borrower’s signature on their government-issued ID creates immediate doubt about who actually filled out the application.

Missing documentation is just as telling. Fraudulent files routinely lack pages from bank statements or tax returns, specifically the pages that would reveal large debts, insufficient balances, or undisclosed liabilities. An unsigned or undated loan application prevents the lender from holding anyone accountable for the accuracy of the information. Verifying that page numbers are sequential and all required schedules are present catches many of these omissions.

Resistance to IRS Verification

One of the most effective tools against income fraud is IRS Form 4506-C, which lets lenders request a borrower’s tax transcript directly from the IRS through the Income Verification Express Service. Because the transcript goes straight from the IRS to the lender, a borrower can’t alter the numbers along the way.⁷ The borrower signs the form to authorize the disclosure, and the form must reach the IRS within 120 days of the signature date. If a borrower stalls on signing the 4506-C, claims they “already provided” their returns, or repeatedly submits versions with errors that delay processing, the resistance often signals that the tax documents they submitted don’t match what the IRS has on file.

Suspicious Money Movement at Closing

The way money moves during a real estate transaction reveals more about fraud than almost any other element. Down payment funds that appear from unverified accounts or sudden “gifts” right before closing deserve intense scrutiny. Legitimate gifts for down payments must come with no repayment obligation. If the donor has any financial interest in the transaction (the seller, the builder, the real estate agent), it isn’t a gift, it’s a disguised loan that skews the borrower’s actual debt. Side agreements where the borrower quietly repays the “gift” after closing are a textbook scheme.

Cash back to the buyer at closing is a major red flag. It typically stems from an inflated sales price, with the excess funneled back to the buyer in a way that isn’t disclosed to the lender. Reviewing the Closing Disclosure should reveal every payment to every party, and any line item that isn’t clearly explained in the escrow instructions warrants investigation. Last-minute addendums that change the price or terms just before closing are a common vehicle for these manipulations. Legitimate contract changes don’t materialize the day before signing.

Wire Fraud Before You Send Closing Funds

Wire fraud has become one of the fastest-growing threats in real estate, and it doesn’t require anyone to falsify a loan application. In a typical scheme, a hacker compromises the email account of a title company employee, real estate agent, or closing attorney. After monitoring email traffic to learn the details of an upcoming closing, the hacker sends the buyer an email, often from what appears to be the title company’s actual address, with “updated” wiring instructions directing the funds to the hacker’s account. Once the wire goes through, the money is usually gone within hours.

The FBI’s Internet Crime Complaint Center reported $275 million in real estate fraud losses and over $3 billion in business email compromise losses in its most recent annual report.⁸ Wire fraud carries penalties of up to 20 years in prison under 18 U.S.C. § 1343, and up to 30 years if the scheme affects a financial institution.⁹

The red flags are straightforward but easy to miss in the rush to close:

Any email, text, or phone call telling you the wire instructions have changed. Treat every last-minute change as a potential attack.
Pressure to act immediately. Scammers create urgency because delay gives you time to verify.
Slightly altered email addresses. A hacker might swap one letter or add a character to mimic a legitimate address.
Instructions to wire to a personal account. Legitimate title companies use business accounts.

Before wiring any closing funds, call the title company or closing attorney at a phone number you obtained independently, not one from the email, and confirm the account details verbally. If you’ve already sent a wire to a suspicious account, contact your bank immediately to request a recall. Speed matters enormously. Banks can sometimes freeze outgoing wires within the first 24 hours, but recovery rates drop sharply after that.

Foreclosure Rescue and Loan Modification Scams

Homeowners facing foreclosure are frequent targets, and the schemes often look like help. Under federal law, it is illegal for any company offering mortgage assistance services to charge upfront fees. A legitimate provider cannot collect a dime until three things have happened: the company obtains a written offer of relief from your lender, delivers that offer to you, and you accept it in a signed agreement that actually changes your loan terms.¹⁰ Charging separately for “consultations,” document reviews, or communicating with your lender is also prohibited.

The warning signs follow a predictable pattern:¹¹

Any upfront fee demand. No legitimate organization helping borrowers avoid foreclosure asks for money before delivering results.
Unsolicited contact through flashy advertisements or cold calls that claim to “save your home,” often timed suspiciously close to a missed payment or public foreclosure notice.
Isolation tactics, such as being told to stop communicating with your lender or any housing counselor you’ve been working with.
Payment redirection, meaning instructions to send your mortgage payment to someone other than your loan servicer.
Deed transfer requests that ask you to sign your property’s title over to a third party, even “temporarily.”
Blank documents. Any paperwork with empty lines or spaces that can be filled in later.

The most damaging version is equity stripping. A scammer promises to pay off your delinquent mortgage and repair your credit if you “temporarily” sign your deed over to an investor. You’re told you can stay in the home as a renter and eventually buy it back. Once the deed transfers, the scammer takes out a new mortgage far exceeding your original balance, pockets the difference, and has no obligation to sell the property back to you. Refinance scams work similarly. Documents presented as “foreclosure rescue” paperwork turn out to be deed transfers, and the homeowner doesn’t realize they’ve surrendered ownership until it’s too late.

Where to Report Suspected Mortgage Fraud

If you spot any of these signs in your own transaction or suspect someone else is committing mortgage fraud, several federal agencies accept reports, and the right one depends on the type of fraud.

The FBI handles mortgage fraud as a federal crime. You can submit information through tips.fbi.gov without providing your name, though anonymous tips can be harder to investigate.¹²
For fraud involving FHA loans, housing subsidies, or HUD-funded programs, contact the HUD Office of Inspector General at 1-800-347-3735 or file a complaint online. Your written statement should include who was involved, what happened, when and where it occurred, and how the scheme worked. Vague reports without supporting details are often closed without action.¹³
If your identity was used on a fraudulent mortgage application, report it through IdentityTheft.gov or call 1-877-438-4338. The site generates an Identity Theft Report that serves as proof to businesses and guarantees certain recovery rights.¹⁴

Your state attorney general’s office typically investigates fraud by mortgage brokers and loan servicers operating within the state. If you’re currently in a mortgage transaction and discover irregularities, notify your lender’s fraud department immediately. Lenders have their own obligation to investigate, and early detection gives them the best chance of stopping a scheme before closing.

1
Office of the Law Revision Counsel. 18 USC 1014 – Loan and Credit Applications Generally
2
Federal Bureau of Investigation. Privacy Impact Assessment – Mortgage Fraud
3
Federal Housing Finance Agency. Fraud Prevention
4
Federal Financial Institutions Examination Council. The Detection and Deterrence of Mortgage Fraud Against Financial Institutions
5
Office of the Law Revision Counsel. 15 USC 1639e – Appraisal Independence Requirements
6
eCFR. 12 CFR 1026.42 – Valuation Independence
7
Internal Revenue Service. IVES Request for Transcript of Tax Return
8
FBI Internet Crime Complaint Center. 2025 IC3 Annual Report
9
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
10
Federal Trade Commission. Mortgage Assistance Relief Services Rule – A Compliance Guide for Business
11
Federal Deposit Insurance Corporation. Beware of Foreclosure Rescue Scams
12
Federal Bureau of Investigation. Electronic Tip Form
13
HUD Office of Inspector General. Report Fraud
14
IdentityTheft.gov. Steps to Report Identity Theft