
What is mortgage fraud? For a growing number of homebuyers, it arrives as an email a few days before closing, asking them to wire the down payment to a "new" account. That tactic sat behind the real estate email hacks that cost more than 400 US buyers around $20 million, and it keeps working.
In August 2025, a couple closing on a home received a message impersonating their attorneys and wired more than $449,000 to criminals, a case the FBI describes in its 2025 Internet Crime Report. Calls from the couple's bank and attorneys to the receiving bank went nowhere, and the funds were frozen only after the couple filed a complaint with the FBI's Internet Crime Complaint Center, which asked the receiving bank to hold the account.
That isn't an isolated story. The Federal Bureau of Investigation recorded 12,368 real estate fraud complaints and $275.1 million in losses in 2025, up from roughly $173 million the year before, as the National Association of Realtors reported, with closing wire theft counted separately under business email compromise. On the lending side, Cotality estimates that about one in every 119 mortgage applications showed signs of fraud risk in the second quarter of 2026, as HousingWire reported.
Therefore, this guide aims to answer the questions of homebuyers, homeowners, and anyone whose personal information may already be exposed. It covers the types of mortgage fraud with real examples, how schemes are detected, the penalties they carry, and the steps that protect you from financial loss, legal trouble, and identity theft.
● Mortgage fraud has two faces. Some schemes are committed by borrowers or mortgage industry insiders who lie to lenders, while others target buyers and homeowners directly, through identity theft, wire fraud, and fake foreclosure help.
● The riskiest loans are investment and multifamily properties. Cotality's latest data puts fraud indicators in about one in 44 investment property applications, far above the industry average.
● It is a federal felony. False statements on a mortgage application can carry up to 30 years in prison and a $1,000,000 fine under federal law.
● Two habits stop the costliest consumer scams. Confirming wire instructions by phone blocks closing wire fraud, and working only with HUD-approved counselors blocks foreclosure rescue scams.
Mortgage fraud is a material misrepresentation, misstatement, or omission in the mortgage process that a lender relies on to fund, buy, or insure a loan. In practice, that covers anything from falsifying income or employment information on a loan application to forging a deed and borrowing against a home the borrower does not own.
Because the mortgage lender makes its decision based on the information in the loan documents, any deliberate falsehood that changes that decision can qualify.
Loan applicants, mortgage brokers, loan originators, appraisers, real estate agents, title agents, and closing attorneys all touch the loan process, and fraud occurs wherever one of them misstates facts or where an outsider impersonates one of them. The Federal Housing Finance Agency and Fannie Mae both publish fraud alerts and scheme descriptions to assist mortgage market participants in recognizing these patterns.
Mortgage fraud occurs at every stage of the real estate transaction, from home loan origination through closing, and years later when a homeowner falls behind on mortgage payments.
The schemes fall into two groups, and the protection differs for each:
Borrower fraud starts with a single goal: qualifying for a loan, or for better terms, than the true numbers would allow. Each type of mortgage fraud targets a different part of the underwriting picture.
Income fraud involves falsifying income or employment information so that monthly debt payments look affordable against the lender's debt-to-income limits. Borrowers may submit edited pay stubs, fabricated W-2 forms, invented employers, or overstated self-employment earnings. Cotality's 2026 annual fraud report warns that AI-altered documents have become harder to spot on a loan-by-loan basis, so lenders now look for patterns such as a shared tax preparer or consistently even-numbered income across a group of files.
Occupancy fraud misrepresents the intended use of a property. A borrower claims a home will be their primary residence when they plan to rent it out, because owner-occupied loans usually carry lower rates and smaller down payment requirements. The misstatement secures favorable loan terms that the lender would have priced differently for an investment property.
Asset rental fraud happens when a borrower temporarily borrows or "rents" money, many times from a third party who charges a fee, and parks it in their bank account so it appears on statements as savings or reserves. Once the loan closes, the funds go back to their owner, and the borrower is left with a mortgage they had no real cushion to support.
A straw buyer is someone who applies for a mortgage on behalf of another person, lending their name and credit history to disguise the true buyer. The straw buyer may be paid to participate or may be a victim whose identity was used without consent.
Borrowers who own other properties sometimes hide that mortgage debt, conceal simultaneous purchases, or omit past foreclosures to improve their ratios. This posted the largest year-over-year increase of any fraud category in Cotality's Q2 2026 index, rising 2.6%, according to HousingWire. Taking out multiple loans at once on different properties, each application claiming to be the only one, is one of the ways this surfaces.
Fraud for profit schemes involve industry insiders, because they require access to appraisals, closing documents, and lender relationships that outsiders do not have. These common mortgage fraud schemes tend to involve more money and more participants.
Home appraisal fraud inflates property values so that a sale can close at a higher price or a borrower can extract more cash. It usually involves collusion between a seller, a broker, and an appraiser who reports an artificially inflated price. The lender ends up funding a loan larger than the collateral is worth, and the gap becomes profit for the participants.
Illegal property flipping involves buying a property, making few or no improvements, and reselling it quickly at an inflated appraisal. In Q2 2026, Cotality reported rising property alerts for homes that appeared to have been flipped within the previous 12 months, particularly in markets with higher foreclosure activity and rising home prices.
Air loans involve non-existent buyers and properties. A broker or insider invents a borrower, a house, an appraisal, and sometimes a fake employer with a phone line that answers, then pockets the loan proceeds. Because nothing about the transaction is real, these schemes depend on insiders who can move fabricated files past verification.
Equity skimming occurs when an investor persuades a struggling homeowner to transfer the deed, collects rent payments from the occupant or a tenant, and stops paying the mortgage, leaving an unpaid mortgage and eventual foreclosure. Builder bailout schemes hide large incentives to move unsold inventory, inflating the recorded sale price. Real estate owned (REO) schemes exploit bank-owned properties through undisclosed side deals and non-arm's-length sales.
A home equity conversion mortgage (HECM) is the federally insured reverse mortgage that lets homeowners 62 and older convert home equity into cash. That equity makes them targets of reverse mortgage scams, where a relative, contractor, or so-called advisor pressures a senior into a HECM and diverts the proceeds, or recruits a straw buyer to take one out on a property they do not occupy.
These schemes rely on stolen personal or financial information, impersonation, and the pressure people feel during a purchase or a financial crisis.
Identity theft in mortgage fraud involves using someone else's personal information without consent to obtain mortgages or home equity lines in their name. The FBI logged more than 31,000 identity theft complaints in 2025, up from 21,403 the year before, according to its 2025 Internet Crime Report, and synthetic identity fraud, where real Social Security numbers are combined with invented details, lets criminals build a credit history before applying.
The first sign is an inquiry or a new account on your credit reports that you did not open. For this reason, Bitdefender Identity Theft Protection includes Advanced Fraud Monitoring, which notifies you if your identity is used to apply for a mortgage, a car loan, or a new credit card, along with alerts for unauthorized change-of-address requests and court records filed in your name. For the broader habits that keep your data out of these schemes, see our identity theft prevention guide.
Closing wire fraud can take a buyer's entire down payment in a single transfer. Criminals compromise an email account belonging to a real estate agent, title company, or attorney, monitor the thread until closing day, then send "updated" wiring instructions from a lookalike address. Business email compromise, the category that covers these attacks, generated $3.04 billion in reported losses across all sectors in 2025, according to HousingWire's analysis of the FBI data.
Our experts recently described in an interview how scam campaigns now move from a phone message to a voice call and end on a computer where the victim is asked to "authorize a transfer," which is why our coverage of the deepfake boss scam recommends verifying any payment request through a separate, known channel.
The defense is procedural. Confirm wiring details by calling a phone number you obtained at the start of the transaction, never one listed in the email.
PS: Email and scam protection in Bitdefender Ultimate Security scans incoming messages and links for phishing, and the free Bitdefender Scamio assistant, which our guide to bank impersonation scams walks through, lets you check a suspicious message before you act.
Seller impersonation fraud occurs when a criminal poses as a property owner to sell or borrow against land they do not own, pocketing the proceeds before the real owner learns what happened. The American Land Title Association's 2026 Seller Impersonation Fraud Study found that 59% of title firms experienced at least one attempt in 2025, up from 28% in its 2024 survey. Vacant land remains the main target, cited by 82% of firms.
According to the ALTA announcement, 87% of respondents rated spoofed contact information as at least somewhat common and 58% said the same of deepfake image or voice technology. Tom Cronkright, CEO of Sun Title and co-founder of CertifID, told HousingWire that scammers in his state monitor obituaries and recorded death certificates to find properties whose heirs are easy to impersonate.
Bitdefender does not monitor property titles, so this is a risk to cover separately. However, county recorders offer free recording notification services that email you when a deed or deed of trust is recorded under a name you register. Please note that the alerts give early warning rather than preventing the filing. Owners of vacant land, inherited property, or a home owned free and clear have the most reason to sign up.
Foreclosure rescue scams target homeowners facing financial difficulties. These foreclosure scams start with a company that promises to stop foreclosure, negotiate a loan modification, or deliver debt elimination, then demand upfront fees and disappear, a pattern sometimes called "collect and vanish." In the more damaging version of a foreclosure rescue scheme, the homeowner is persuaded to sign over the deed in exchange for a promise to rent the home back, and loses the property entirely.
The Consumer Financial Protection Bureau states that anyone who charges in advance or guarantees to stop a foreclosure is not legitimate, and it directs homeowners to HUD-approved housing counselors, whose assistance is free. Our earlier breakdown of loan scams covers the same warning signs, including guaranteed approval and requests for payment before any service is delivered.
One of the most common questions homeowners ask online is whether renting out a house they bought as a primary residence counts as occupancy fraud. The answer depends on intent at the time of the mortgage application and on the terms of the loan.
Standard mortgage documents include an occupancy clause that generally requires the borrower to live in the home as their principal residence for at least a year. A buyer who moves in and relocates after that period is typically within the rules, provided they notify their lender and switch to landlord insurance, while a buyer who never intended to live there and checked "primary residence" to secure a lower rate has committed fraud.
Regulators also track the reverse pattern, where a borrower claims rental income on an investment property to qualify, then moves in as the occupant. Because loan terms vary, check your security instrument and ask your lender before changing how a property is used.
Lenders detect mortgage fraud by comparing the story in the loan file against independent data. Inconsistencies in loan files can indicate misrepresentations, such as:
● A pay stub that does not match tax transcripts
● A Social Security number tied to a different name
● An address history that conflicts with tax mailing records
Fannie Mae's Desktop Underwriter returns potential red flag messages when submitted financial data looks inconsistent, and excessive loan submissions, where the same file is run through underwriting repeatedly with small changes.
Analytics firms such as Cotality add predictive scoring across identity, income, occupancy, property, transaction, and undisclosed debt indicators. When a lender suspects mortgage loan fraud, it files a suspicious activity report with FinCEN, and those reports feed investigations by federal and state law enforcement agencies.
Consumers have their own detection tools. Monitoring credit reports can help detect signs of mortgage fraud, because a mortgage application in your name generates a hard inquiry and, once funded, a new account. Unexpected mail from a lender or servicer, a property tax bill for a home you do not own, or a missing statement can all point to fraudulent activity worth investigating.
The consumer-facing schemes above share a set of warning signs, and recognizing one gives you the moment to stop and verify.
Upfront fees are the clearest one. Legitimate lenders do not demand payment for loan modification or foreclosure help before delivering results, so a request for money in advance typically signals a scam. Pressure to act quickly is a close second, because urgency prevents you from checking details with anyone else. Be wary of anyone who asks you to sign blank or incomplete documents, tells you to stop contacting your lender, or offers terms that seem too good to be true, such as guaranteed approval regardless of credit history.
During a purchase, last-minute changes to wiring instructions, a sudden shift in an agent's tone, or a request to switch email addresses all warrant a call to a number you already trust.
Yes. Mortgage fraud can result in federal prosecution, and the main statute, 18 U.S.C. § 1014, makes it a crime to knowingly make a false statement or willfully overvalue property to influence federally insured financial institutions, including any mortgage lending business.
Anyone committing mortgage fraud under that statute is exposed whether or not the loan is approved, because the Justice Department's Criminal Resource Manual notes that neither the lender's reliance nor an actual loss is an element of the offense. Conviction carries a fine of up to $1,000,000, up to 30 years in prison, or both. Mortgage loan fraud involving wire transfers or several lenders can bring additional counts, such as bank fraud and wire fraud.
Common penalties also include restitution, forfeiture, and supervised release, and mortgage brokers and other real estate professionals can lose their licenses, so civil and criminal penalties together can follow someone for years.
The steps that prevent mortgage fraud depend on where you are in the homeownership cycle. Each of the following groups faces a different mix of risks.
Prepare your credit before starting the mortgage process so you can spot anything unfamiliar. Verify the licenses of mortgage professionals before engaging with mortgage services; the NMLS Consumer Access database, which state regulators direct consumers to, lets you confirm that a lender, broker, or loan originator is licensed and check for disciplinary actions. Save a verified phone number for your title company at the start, and call it before sending any funds. Reviewing loan documents thoroughly before signing can help expose misstatements that someone else added to your application.
Check your credit report regularly for inaccuracies, and treat any mortgage inquiry you did not initiate as urgent. Sign up for your county recorder's property fraud alert if it offers one, particularly for vacant land, rental properties, or an inherited home. Avoid sharing personal information with unverified sources, since a Social Security number and a scanned driver's license are enough to start many of these schemes.
Contact your servicer directly, using the number on your statement, before accepting help from anyone else. Verify the legitimacy of foreclosure rescue services by working through a HUD-approved housing counselor, which you can find by calling HUD at (800) 569-4287, a number listed on HUD's contact page. Never transfer your deed to a company that promises to save your home.
If you believe you are a victim, the order of your response matters, because the first hours decide whether money can be recovered.
Keep copies of every email, text, and payment record for investigators.
Consumer-facing mortgage fraud depends on your personal information and on your trust in a message, and Bitdefender Ultimate Security covers both. The US Plus plans alert you when your identity is used to apply for a mortgage, monitor credit across up to three bureaus along with address changes and court records, and add identity theft insurance and a resolution specialist, while Scam Protection flags the phishing messages behind closing wire fraud. Pair it with your county's recorder alert, since Bitdefender does not monitor titles, and a credit freeze at each bureau.
tags
The meaning of Bitdefender’s mascot, the Dacian Draco, a symbol that depicts a mythical animal with a wolf’s head and a dragon’s body, is “to watch” and to “guard with a sharp eye.”
View all posts