Mortgage payoff fraud happens when a fraudster poses as the seller’s lender or servicer and sends a fake or altered payoff statement, so the settlement agent wires the payoff to the fraudster’s account. The lender isn’t paid and the mortgage lien stays on the property. Verify every payoff with the servicer, on a number you found yourself, before you wire.
You hold the funds on payoff day, and if the payoff goes to the wrong account, you’re the one everyone remembers.
What is mortgage payoff fraud?
Mortgage payoff fraud is wire fraud aimed at one specific disbursement: the payoff you send to the seller’s lender to satisfy the existing mortgage. Instead of tricking a buyer into wiring funds to close, the fraudster gets between you and the servicer. You receive a payoff statement that looks right, with wire instructions that point to an account the fraudster controls.
That’s what separates it from closing wire fraud in general. Fraud on a buyer’s funds to close is a related problem, and knowing how closing wire fraud works helps, but the payoff has its own weak points. If you need a refresher on what a mortgage payoff statement contains, including the good-through date and per diem, start there. This article is about what happens when one is faked.
If the payoff goes to the wrong account, the lender hasn’t been paid, so the mortgage isn’t satisfied and the lien stays on the property after closing. The defense is the same whether your team orders payoffs itself or uses verified payoff requests: confirm every payoff with the servicer before the wire goes out.
Why do fraudsters target the payoff wire?
Mortgage payoff fraud is a form of business email compromise, and that category is enormous. Victims reported more than $3 billion in business email compromise losses across 24,768 complaints in 2025, according to the FBI’s 2025 Internet Crime Report. Title and escrow sit squarely in the line of fire. FinCEN’s analysis of real estate business email compromise found that title and closing companies were the parties fraudsters impersonated most often, in more than a third of incidents in 2020 and 2021.
Payoff wire fraud works for structural reasons, not because anyone in the chain is careless. The payoff statement is the document you rely on for the lender’s wire instructions, so a convincing fake carries the authority of the real thing. The payee isn’t at the closing table, which means you’re wiring a servicer you may never have spoken to. And the timing works for the fraudster. Payoffs are finalized and wired in the last days before closing. Combined with the inherently high-pressure environment of the closing process, that’s when a delay feels worse than a quick decision.
How does a payoff get hijacked?
Most payoff fraud starts with a compromised inbox. A fraudster gets into an email account somewhere in the transaction, often through phishing, then monitors communications and waits for the right moment, usually close to the closing date. When it comes, the fraudulent instructions look legitimate, mimicking the email format, language, and signatures of the real parties involved.
From there, the payoff gets hijacked in a few recognizable ways. A spoofed payoff statement copies the lender’s layout but carries new wire instructions. An email links to a fake lender payoff portal. An “updated” payoff shows up that nobody requested, with a revised account number. Or the payoff reaches you secondhand, from the seller or another party, after it has been altered on the way to your desk.
The first instruction can be the fake one. The classic warning sign of wire fraud is a change in instructions. On a payoff, there may be nothing to compare against: if the first payoff statement you receive is the fraudulent one, nothing ever “changes.” ALTA’s coverage of payoff statements as a fraud gateway described exactly this pattern, which is why verification can’t wait for a red flag.
What are the red flags on a payoff statement?
Payoff statement fraud usually leaves traces, if you know where to look. These are the signs title insurance underwriter guidance tells agents to watch for, and what to do when you see one.
Use this table to spot payoff statement fraud before the wire goes out.
| Red flag | What it looks like on the file | What to do |
| An “updated” payoff nobody requested | A revised statement arrives by email days after the original | Treat it as suspect and verify by phone before using either version |
| Editable file or wire details in the email body | A Word file, or account numbers typed into the message | Don’t accept it; request the payoff through the servicer’s own channel |
| Receiving bank doesn’t match the lender | The payoff is owed to one bank, but the wire is directed to another | Stop and confirm with the servicer on a number you found yourself |
| Contact details that only appear on the statement | The phone number or portal link exists only in the document you were sent | Look the servicer up yourself; never call or click from the statement |
| Near-identical sender address | The sender’s domain is one character off from the servicer’s real one | Check the actual sender address before opening anything attached |
| Formatting tells | Missing address, spelling errors, mixed fonts, or a text box sitting over the wire instructions | Treat the whole statement as unverified |
| Pressure | “Wire today or the payoff expires,” or a warning of consequences | Slow down; urgency is the scheme’s tool, and the good-through date is checkable |
Source: Attorneys’ Title Fund guidance on payoff fraud.
One red flag is enough to stop and verify. None of them proves fraud on its own, and a clean-looking statement doesn’t prove a payoff is genuine, which is why the next step applies to every payoff.
How do you verify a payoff before you wire?
Verification works because it moves the conversation off the channel the fraudster controls. Run these steps on every payoff, not only the ones that look wrong.
- Order the payoff early, directly from the servicer, with the borrower’s signed authorization. Under the federal payoff-statement requirement (15 U.S.C. § 1639g), a creditor or servicer must send an accurate payoff balance within seven business days of a written request, so ordering early keeps verification from getting squeezed against closing.
- Find the servicer’s contact details yourself. Avoid reliance on third-party information. Instead, independently verify payees using known and trusted phone numbers, never the number or link printed on the statement.
- Call and confirm the details. Verify banking details by calling the payee directly, and confirm the payoff amount, good-through date, account number and receiving bank.
- Check that the receiving bank matches the lender. If the lender is a depository bank, the payoff should go to that bank.
- Record the verification in the file: who you spoke with, when, and the number you called. If a payoff is ever questioned, that note shows the check happened.
- Treat any later change as a brand-new payoff. A revised statement or new wire details after verification sends you back to step 2.
- If you can’t verify, don’t wire. If new wire instructions cannot be verbally verified, arrange for payment via overnight check.
It takes a few minutes per file. It also turns a judgment call on deadline day into a routine you can defend. The same habit belongs on every outgoing wire, which is why the guide on how to request HOA documents tells escrow officers to verify wiring instructions before paying an HOA too.
Who on your team should handle payoffs?
The fewer hands on a payoff, the fewer openings a fraudster has. Underwriter guidance recommends keeping the group that orders payoffs and handles wire details small, and the same principle protects you: when a payoff goes out, you want to know exactly who touched it. In practice, that means:
- A short, named list of people who can order payoffs
- Changes to wire details limited to those same people
- One standard wire routine with frequent payees, so anything different stands out
- A record of verified accounts and payees for each bank or lender
Firm-wide cybersecurity controls for title and escrow teams, such as email security, multi-factor authentication and device policy, sit underneath all of this. But the payoff routine is the part you control on every file. The human element is often the target of social engineering attacks, so the routine matters as much as the technology.
What should you do if a payoff wire goes wrong?
Move immediately. ALTA’s Rapid Response Plan for wire fraud incidents stresses that time is critical and sets out the first steps: alert your internal response team and your underwriter, call your bank’s fraud department to request a recall and ask it to start the FBI’s Financial Fraud Kill Chain, then contact the receiving bank, give it the wire details, and ask it to freeze the account.
Reach the other parties, including the buyer, seller, agents and attorneys, only on phone numbers you’ve already verified. Don’t reply on the email thread the fraud came through. Assume it’s still being watched.
Until the lender is actually paid, the mortgage isn’t satisfied, the lien isn’t released, and it keeps its place in line. Here’s how mortgage liens and lien priority work at closing. Once the corrected payoff goes out, payment and release are still separate events, so what happens when you find a lien on a file still applies: chase the release and confirm it recorded.
Where Rexera fits in your payoff workflow
Rexera, a RealPage company, orders Mortgage Payoff Statements from any lender in the country, by email, phone and IVR, or fax, and from inside your production system, with a 2-day average turnaround. Rexera handles borrower authorization when the lender requires it, using digital authorization forms where the lender accepts them. Hankin & Pack, for example, worked with Rexera to cut the clicks it takes to order payoffs and to build digital authorization forms that removed back-and-forth between parties. Read how Hankin & Pack streamlined payoff ordering.
When the statement comes back, Rexera checks it against your order: lender name, loan number, property address and good-through date. The banking and remittance details are extracted and checked again, and any mismatch or low-confidence result pauses the file for a human analyst, who reviews the source document and contacts the lender when needed. You get updates through the portal and by email.
Rexera never sends the payoff wire. You still release the funds, and you should still make your own verification call. What changes is that the payoff details in front of you have already been checked against your order.
Book a demo or email sales@rexera.com.
Disclaimer:
This article is provided for informational purposes only and does not constitute legal advice. For interpretation of specific laws or legal obligations, consult qualified legal counsel.
