Mortgage fraud
The fraud in the file, and the page that proves it
Most mortgage fraud is not one forged page. It is a file where every page looks fine on its own and the pages disagree with each other.
A reviewer reads documents one at a time, against a checklist. Fraud lives between them: in the copy of a statement that differs from the other ten, the earnings record dated the same day as a charge from a paystub generator, the landlord insurance policy on a home the borrower swore they would live in. Sei reads every page of the file, tests each one on its own arithmetic and on the file behind it, then sets every document against every other — and cites the page for each finding.
Every page is tested on its own arithmetic, on the file behind it, and against every other document — and the copy that disagrees goes to your underwriter with both pages cited.
Who commits it, and what it leaves behind
Fraud for housing
A borrower shades the truth to get a home they mean to live in: income rounded up, a gift that is really a loan, a debt left off. It is most of the fraud a lender sees and the file usually disagrees with itself — the paystub and the deposits do not match, the 1003 and the credit report do not match.
Fraud for profit
Organised and deliberate: straw buyers, inflated values, cash back at closing, an investor posing as an owner-occupant. It is less of the volume and most of the loss. The file is built to look clean, so the signal is in what the documents say about each other — and about the people on them.
Documents made to order
The supply chain behind both. Paystub and statement generators sell fabricated documents for a fee, and generative editing tools change a figure in seconds. These documents are internally consistent by construction; they give themselves away in the file behind the page, in arithmetic that only looks right, and in the purchase showing up on the borrower’s own bank statement.
The fraud we target
Each signal is read from the loan file — the documents, the files behind them and the third-party reports already in it.
- 01
Income and employment
OriginationServicingThe borrower earns less than the file says, works somewhere else, or does not work at all.
What it looks like
- A paystub or earnings record bought from a generator, or a real one with the gross and net retyped
- A verification of employment recreated by the borrower, with a phone number routed to someone they know
- A pension or award letter with one digit changed
- An employer that is a shell the borrower controls
- In servicing, the same tools used to fabricate hardship income for a modification
What gives it away
- Social Security withholding that is not 6.2% of the wages, or Medicare that is not 1.45% — a forger rarely gets both right, and almost never handles the wage base
- FICA withheld from retirement income, which is not subject to it
- Year-to-date pay that does not follow the pay cadence, and net pay that never appears as a deposit
- A charge to a paystub generator on the borrower’s own bank statement, dated the same day as the document
- An employer identification number that is malformed, or differs between the paystub, the W-2 and the verification
- Income rebuilt three ways — from the documents, the tax records and the deposits — and the spread between them reported
- 02
Assets and down payment
OriginationThe money to close is not there, is not the borrower’s, or came from someone with an interest in the sale.
What it looks like
- A statement balance edited up, or a deposit inserted, on one copy of a statement
- A statement fabricated to look like a real bank’s
- Borrowed funds parked in the account long enough to look seasoned
- A gift letter for money that has to be paid back
- A deposit from the seller, the listing agent or the builder, outside closing
What gives it away
- A statement that does not foot — opening balance plus credits minus debits does not reach the closing balance
- A statement whose closing balance is not the next month’s opening balance
- Duplicate copies of the same statement compared line by line, so the one altered copy is set beside the genuine ones under the same transaction reference
- Large deposits sourced and classified, and any that trace to a party in the transaction named
- Assets stated on the initial application, the final application and the verification compared, with every version shown
- 03
Undisclosed debt and accounts
OriginationObligations the borrower left off the application, which change what they can afford.
What it looks like
- A private or family loan with no tradeline
- A mortgage on another property the borrower did not declare
- An account at another institution left out, along with what moves through it
What gives it away
- Recurring debits on the bank statements that match no liability on the application or the credit report
- Transfers to and from accounts the application never mentions
- Properties on the tax return’s rental schedule or in the title documents that are missing from the real estate owned
- Payroll deposits from an employer the application does not list
- 04
Occupancy
OriginationServicingAn investor buys as an owner-occupant to get a better rate, a lower down payment or a program they are not eligible for.
What it looks like
- An occupancy affidavit signed by a borrower who plans to rent the home from day one
- A departing residence declared as retained while it is listed for sale
- A landlord insurance policy bought alongside the homeowner’s binder the lender sees
- After closing, the home rented out and the policy renewed as a rental
What gives it away
- Two hazard policies on the same property, one of them a rental-dwelling or landlord form
- A rental listing for the subject property in the file, with the borrower’s own phone number on it
- A departing residence that a listing in the file shows for sale
- An occupancy affidavit whose signature is a pixel copy of the borrower’s signature from another document
- In servicing, a renewal declaration on a landlord form for a loan closed as a primary residence
- 05
Identity
OriginationThe borrower is not who the file says, or is a straw buyer for someone who is not on it.
What it looks like
- A synthetic identity, or a stolen one
- A credit privacy number presented as a Social Security number
- A straw buyer with no stake in the transaction, funded by someone else
What gives it away
- Name, date of birth, Social Security number and address compared across the application, the ID, the credit report, the W-2 and the tax documents
- Identity verification and credit-report alerts already in the file read and reconciled, rather than left in an attachment
- A borrower whose funds all come from a third party and whose income does not explain the purchase
- 06
Fabricated and edited documents
OriginationServicingAny document in the file altered after it was issued, or never issued at all — including the edits generative tools now make in seconds.
What it looks like
- A real PDF edited and saved again
- A figure covered with a white box and retyped
- A digit or signature copied from elsewhere on the page
- A document generated end to end, employer and all
- A photo with something removed or a lawn made greener
What gives it away
- Revision history inside the PDF, where the original values often still sit beside the edited ones
- The software that last saved the file — a bank statement saved by a PDF editor, an earnings record saved by a word processor
- Text under a white box, still present in the text layer of a page that looks clean
- A character or signature identical pixel for pixel to one elsewhere in the file
- Provenance marks generative tools write into a file, and the noise pattern they leave around an edited region
- Misspellings, impossible dates and arithmetic that a real issuer’s system does not produce
- 07
Contract, closing and wire
OriginationServicingThe transaction is not what the lender was shown: a different price, money moving outside closing, or funds sent somewhere they should not go.
What it looks like
- A purchase price changed after signing
- A seller rebate to the buyer outside closing, written into an addendum
- Cash back at closing disguised as a repair or consulting payment
- A change of wire instructions days before closing or payoff
What gives it away
- Price, credits, loan amount and cash to close tied out across the contract, the appraisal and the Closing Disclosure
- A price in figures that no longer matches the price in words, and revision history that shows when it changed
- Money from the seller or an agent on the bank statements that the Closing Disclosure does not show
- Payees on the Closing Disclosure resolved against the parties to the loan
- Wire instructions and payoff requests checked against the parties and contacts already on the file
- 08
Collateral and valuation
OriginationThe property is worth less than the file says, or is not in the condition it says.
What it looks like
- An inflated value supported by distant or dissimilar comparables
- Defects disclosed in the narrative while the condition rating stays clean
- Photos edited, or taken from a prior listing
- A quick resale at a price the market does not explain
What gives it away
- Comparable distances and adjustments read from the appraisal and set against the AVM and collateral reports already in the file
- Every defect named in the appraiser’s comments reconciled against the condition rating and the as-is basis
- Photos compared with the ones elsewhere in the package, and checked for edited regions
- Prior sale date and price set against the current price, with the gap explained or flagged
- 09
Participants
OriginationSomeone on the file who should be independent is not — the agent, the gift donor, the employer, the appraiser.
What it looks like
- A gift donor who is also the seller’s agent
- An employer whose phone number is the borrower’s or the agent’s
- A non-arm’s-length sale presented as arm’s-length
- A participant on an exclusion list
What gives it away
- Every name, address, phone and email on every document resolved into one list of participants, and the overlaps named
- Exclusion-list and license screening results in the file read, with each name hit resolved to the same person or a different one
- A relationship stated in one document and denied in another
- 10
Servicing schemes
ServicingFraud on a loan already on the books — to get a workout, take the equity, or redirect the money.
What it looks like
- A loss mitigation package with fabricated income, statements or a templated hardship letter
- A deed transferred to a third party or a new LLC while the loan is delinquent, and rent collected without payments made
- A short sale to a buyer connected to the seller, resold soon after at a higher price
- A payoff request or wire change from someone who is not a party to the loan
- A hazard claim or loss draft supported by photos from somewhere else
What gives it away
- The origination document tests run on every hardship package — withholding, footing, revision history, generator charges
- Recorded deeds read as they arrive, and a transfer during delinquency flagged
- Buyer, seller and agents on a short sale resolved against each other
- Payoff requests and wire instructions checked against the contacts already on the loan
- Claim photos compared with the ones already in the file
How a finding is made
- 01
Every page, every copy
Loan files carry the same statement four times and nobody reads all four. Sei AI's fraud agent reads every page — the duplicates, the attachments embedded in a PDF, the borrower’s uploads — because the altered copy is usually the one nobody compared.
- 02
Each document against itself
The arithmetic a real issuer’s system cannot get wrong: statements that foot and chain from one month into the next, withholding that matches the wages, year-to-date pay that follows the cadence, a price in figures that matches the price in words.
- 03
The file behind the page
Revision history, the software that last saved it, text hidden under a box, characters copied pixel for pixel, and the marks generative tools leave. These are read from the file the borrower uploaded, before anything flattens it.
- 04
Every document against every other
Occupancy against the insurance form and the listings in the file. Income against the deposits. The contract against the Closing Disclosure. The people on one document against the people on the rest. Most fraud is only visible here.
- 05
A finding, cited, with a severity
Each check returns fail, review or pass, with the pages behind it and the rule it breaks. A review is not a fail: distant comparables are a question for the underwriter, an altered statement is a finding. What passes is listed too, so a reviewer can see what was checked.
Two desks, one for each end of the loan
For Lenders
Fraud AgentTests every document in the file for fabrication and alteration, and every figure for misrepresentation, before the loan funds — each finding cited to the page.For Servicers
Fraud ManagerTests the documents that reach servicing — hardship packages, insurance renewals, recorded deeds, payoff and wire requests — for fabrication and misrepresentation, each finding cited to the page.
Further reading on mortgage fraud
How to Spot a Fake Paystub or W-2 With Arithmetic: The Withholding Math Forgers Get Wrong
A fabricated paystub can carry the right logo, the right font and a plausible salary, and still fail a check any underwriter can run with a calculator: Social Security is 6.2% of Social Security wages up to the wage base, Medicare is 1.45% plus 0.9% above $200,000, and a W-2's boxes have to agree with each other. The statutory withholding tests that catch income fraud, why a 401(k) and a cafeteria plan change the math, where the checks produce false positives, and how an AI agent runs them on every stub instead of the ones that look wrong.
7 min readThe Forged Document Problem AI Made Worse, and the Detection Desk That Answers It
A paystub edited in a browser tab used to need a steady hand. Now it needs a prompt. The volume of altered and fully synthetic income and asset documents hitting mortgage intake is rising because the tools to make them got free and good, and the human eye that used to catch the clumsy ones is no match for the clean ones. What a document-authenticity agent actually checks beyond reading the numbers, why the detection model is itself governed under SR 11-7, and where catching a forgery becomes a SAR obligation rather than a decline.
6 min readMortgage Fraud Detection at Origination: What an AI Agent Can Flag, What It Cannot Decide, and Where the SAR Obligation Starts
Most origination fraud is not a forged document, it is a set of facts that are each plausible and collectively wrong: an owner-occupancy claim that does not fit the file, an employer that only exists on paper, a gift that is really a loan. Where an AI agent reads the whole file for the pattern instead of each document in isolation, what FinCEN's mortgage AML rule and the Red Flags Rule actually require, and the line between a fraud flag and a fraud determination.
6 min readStraw Buyers, Synthetic Identities and CPNs: Detecting Mortgage Fraud When the Borrower Is Not Who the File Says
Most fraud checks ask whether the borrower told the truth. Identity fraud asks a prior question: whether the borrower on the file is the person who will own, pay for and live in the property at all. How straw-buyer schemes, synthetic identities and credit privacy numbers show up in a mortgage file, what SSA's eCBSV and the Red Flags Rule give a lender to work with, the fair-lending trap in naive identity rules, and what an AI agent can and cannot conclude.
6 min readDual Contracts, Hidden Seller Credits and Cash Back at Closing: Mortgage Fraud in the Transaction Itself
Some mortgage fraud is not about the borrower at all. It is about the deal: a purchase price that changed after signing, a seller rebate paid outside closing, cash back disguised as a repair credit, a second lien nobody disclosed, a seller who does not own the property. How each scheme shows up across the contract, the appraisal, the Closing Disclosure and the bank statements, the interested party contribution limits it is designed to evade, and the tie-out an AI agent runs on every file.
6 min readAppraisal Fraud and Illegal Property Flipping: Detecting Inflated Values Before the Loan Funds
Collateral fraud is the most expensive kind a lender can fund, because the loss lands on a property that was never worth the loan. How value inflation, cherry-picked comparables, condition misrepresentation, edited photos and flip chains show up in a mortgage file, what FHA's anti-flipping rule at 24 CFR 203.37a and appraiser independence under Regulation Z require, and the collateral checks an AI agent can run on every appraisal rather than a sample.
6 min readMortgage Fraud After Closing: Loss Mitigation Fraud, Equity Skimming, Short-Sale Flopping and Payoff Diversion
Fraud does not stop when the loan funds. Servicers see fabricated hardship packages, foreclosure rescue schemes that strip a distressed homeowner's equity, short sales to related buyers who resell days later, landlord insurance on loans closed as owner-occupied, and payoff funds redirected by a forged request. How each scheme shows up in the documents a servicer already receives, the rules around them, from Regulation X to the MARS rule, and where an AI agent fits without slowing down a borrower who needs help.
6 min read
You Ain't Seen Nothin' Yet
Book a Demo
Pack up some of your complex historical files — any loan type, any investor. We run them through intake, income and condition clearing, and in 30 minutes you see every condition we created and cleared efficiently for your own team, and why.
- Any loan type, any agency guideline or custom investor overlays.
- Every finding cited to the guideline or document it came from
Case study highlight
Loan review fell from 4 hours 50 minutes to 47 minutes per file, and 78% of items now clear at high confidence — so QC touches only the exceptions.
Pre-Close QC Agent · Better Mortgage— read the case study