# Mortgage Fraud After Closing: Loss Mitigation Fraud, Equity Skimming, Short-Sale Flopping and Payoff Diversion

*October 30, 2026 · 6 min read · Ramkumar Venkataraman*

> Fraud does not stop when the loan funds. Servicers see fabricated hardship packages, foreclosure rescue schemes that strip a distressed homeowner's equity, short sales to related buyers who resell days later, landlord insurance on loans closed as owner-occupied, and payoff funds redirected by a forged request. How each scheme shows up in the documents a servicer already receives, the rules around them, from Regulation X to the MARS rule, and where an AI agent fits without slowing down a borrower who needs help.

## Fraud Has a Second Window

Most writing on mortgage fraud stops at funding. That makes sense: origination is where most fraud is committed, and where catching it is cheapest. But the loan then lives for years in servicing, and over that time the servicer receives a steady stream of documents that matter just as much as the ones underwriting read: hardship packages, insurance renewals, recorded deeds, short-sale offers, claims and payoff requests. Each of these can be used for fraud, and each arrives at a desk that is usually measured on speed and on helping borrowers rather than on checking whether the document is real.

The difficulty in servicing is that the person on the other end is often in genuine distress. A servicer that treats every hardship package as suspect fails the borrowers loss mitigation exists to help, and runs into Regulation X's timelines and the fairness obligations that come with them. Fraud detection in servicing has to be quiet: it has to run on every document without adding a step for the borrower, and only surface the files where something specific does not hold.

## Loss Mitigation Fraud: Fabricated Hardship

A loss mitigation application asks a borrower to prove a hardship and their current income, usually with paystubs, bank statements, tax returns and a hardship letter. The incentive to misstate runs both ways: some applicants understate income to qualify for a deeper modification, while others fabricate income to show they can afford a modified payment. Either way the documents are the same kinds of documents underwriting sees, and they can be fabricated or altered with the same tools.

That is the useful part. Everything an origination fraud program checks on an income or asset document applies unchanged to a hardship package: [withholding that does not match the wages](/blog/fake-paystub-w2-detection-fica-withholding-math-mortgage-underwriting), statements that do not foot or do not continue from one period to the next, a file that was edited after it was issued, and a charge to a paystub generator on the borrower's own bank statement. Hardship letters add one more signal: templated or generated text that appears, nearly word for word, across unrelated borrowers' packages, which often points to a third party preparing applications at volume.

The timing constraint is real. Under [Regulation X at 12 CFR 1024.41](https://www.ecfr.gov/current/title-12/chapter-X/part-1024/subpart-C/section-1024.41), a servicer has to acknowledge a loss mitigation application within five business days and evaluate a complete application within thirty days, and it cannot let a fraud review quietly stop that clock. So the checks have to run as the package is read for completeness, not afterwards, and a finding should go to the loss mitigation team as information for the evaluation they already owe, with the document and the specific problem cited. We covered the evaluation itself in our [loss mitigation playbook](/blog/ai-agents-mortgage-loss-mitigation-regulation-x-servicer-playbook).

## Foreclosure Rescue and Equity Skimming

Foreclosure rescue schemes target homeowners rather than lenders, but they land in the servicer's file. A company promises to save the home, takes an upfront fee and does nothing; or persuades the homeowner to deed the property to the company or an investor "temporarily" while the loan is fixed. The new owner collects rent, makes no payments and lets the foreclosure proceed, keeping whatever equity and rent they extracted.

The CFPB's [Mortgage Assistance Relief Services rule, Regulation O at 12 CFR Part 1015](https://www.ecfr.gov/current/title-12/chapter-X/part-1015), bans most advance fees for mortgage relief services and requires specific disclosures, which is why a borrower describing fees paid to a "modification company" is itself a signal worth routing. For the servicer, the most concrete evidence is in recorded documents: a deed from the borrower to a third party or a newly formed LLC while the loan is delinquent, an authorisation for a third party to discuss the account that arrives at the same time, and a change of mailing address to somewhere the borrower does not live.

None of this is proof. Borrowers transfer property for legitimate reasons, including to family members and trusts. But a transfer during delinquency to an unrelated entity, combined with a third-party authorisation and a request to delay, is the pattern, and a servicer that reads recorded documents as they arrive can surface it while there is still time to contact the borrower directly.

## Short Sales and Flopping

In a short sale, the lender agrees to accept less than the balance owed so the borrower can sell. "Flopping" exploits that: the lender is shown a low value, often through a broker price opinion supported by unflattering photos or omitted comparables, and agrees to a short sale to a buyer connected to the seller or the listing agent. The buyer then resells the property, sometimes within days, at its real market value.

The GSEs require short-sale parties to certify that the sale is arm's-length, and the signals are about relationships and timing. The buyer, seller, listing agent and buyer's agent should be resolved against each other for shared names, addresses, phone numbers and companies. A buyer entity that appears across many short sales, a value opinion well below other evidence in the file, and an offer that arrives from a party connected to the listing agent are each reasons to look harder before the lender approves a loss it may not need to take.

## Occupancy Breach After Closing

A loan closed as a primary residence carries a promise, in the security instrument, that the borrower will occupy the property, typically within sixty days and for at least a year. Occupancy fraud at origination often becomes visible in servicing, and the clearest evidence comes from a document the servicer already handles: the hazard insurance renewal.

A homeowner's policy and a landlord or rental-dwelling policy are different forms, priced differently, and a borrower who rents out the property usually has to change the coverage. A renewal on a landlord form for a loan closed as owner-occupied, or a declarations page showing a tenant-occupied property, is close to conclusive that the occupancy promise is not being kept. Servicers read these declarations every year for escrow. Reading them for the policy form as well costs nothing extra. A mailing address that moves away from the property, and a homestead exemption that never appears on the tax bill, point the same way.

## Payoff Diversion and Wire Fraud at the End of the Loan

A payoff is the largest single movement of money in the life of most loans, and it is a target. A forged payoff request, a spoofed email from a title company asking for funds to be sent to new instructions, or a request from someone who is not a party to the loan and has no authorisation on file can each divert funds or extract information. We covered the legal framework for wire verification in our post on [UCC Article 4A and commercially reasonable security](/blog/ucc-article-4a-wire-fraud-ai-verification-commercially-reasonable).

The checks are straightforward and worth running on every request: is the requester a borrower, an authorised third party or a settlement agent already on the loan; do the contact details match what is on file rather than only what is in the request; and has anything about the destination changed close to the payoff date. A [payoff desk](/for-servicers/payoffs-manager) that prepares quotes from the file is already reading these requests, which is the natural place to check them.

## Hazard Claims and Loss Drafts

Insurance claim proceeds on a mortgaged property usually come to the servicer as a loss draft, to be released as repairs are completed. The fraud risk is in the evidence: photos of damage that come from a different property, from an earlier claim, or from before a repair the borrower already completed, and invoices for work that was not done. Comparing claim photos against the ones already in the loan file, including the appraisal and earlier inspections, catches the reused ones. Comparing invoices against each other catches the duplicates.

## The Honest Read

Servicing fraud is not a smaller version of origination fraud. It runs through different documents, involves different parties, and often targets the borrower rather than the lender. But it uses many of the same tools, and much of the evidence arrives at the servicer in documents it already reads for other reasons: the hardship package, the insurance renewal, the recorded deed, the payoff request.

The [Fraud Manager](/for-servicers/fraud-manager) is built for that: it tests those documents as they arrive, with the same forensics origination uses, and sends a cited finding to the fraud or loss mitigation team without adding a step for a borrower whose documents are what they claim to be. It does not deny a workout, hold a payoff or raise a suspicion with the borrower; those decisions stay with the servicer's people. The servicing schemes we target, alongside the origination categories, are listed in our [mortgage fraud guide](/blog/guides/mortgage-fraud#servicing).

---

_Source: [https://www.seiright.com/blog/mortgage-servicing-fraud-loss-mitigation-equity-skimming-short-sale-payoff](https://www.seiright.com/blog/mortgage-servicing-fraud-loss-mitigation-equity-skimming-short-sale-payoff) · Sei AI_