Spotting Mortgage Payoff and Wire‑Change Scams That Use Your Real Property Details

Mortgage payoff and wire‑change scams prey on the rush and high stakes of property transactions. Criminals scrape real property records, data broker profiles, and social media to assemble convincing details about you, your home, and your lender. Then they send precise‑looking emails, letters, or texts to reroute large payments—often your entire payoff or down payment—into accounts they control. This guide explains how these scams work, the red flags to watch for, how to independently verify payoff and wiring details, and the practical steps to reduce your exposure.

How these scams use your real property details

Real estate details live in multiple places. Many are public and can be mixed with breached or brokered data to impersonate trusted parties. Here’s where scammers get their realism:

• Public property records: County recorder or assessor sites often list your name, parcel number, property address, lender on deed of trust, and recording dates. Some jurisdictions expose more than others.
• Data brokers and people‑search sites: Profiles may include phone numbers, email addresses, prior addresses, family members, and employer info used to tailor messages.
• Title and closing timelines inferred from filings: A recorded deed of trust, notice of default, or lien release can signal an active refinance, sale, or payoff window.
• Leaked contact details from breaches: Your email and login combos from unrelated breaches help criminals phish your inbox at the perfect moment.
• Social media and listing photos: Posts about moving or renovations make timing easy, while listing data reveals agent and title company names.

With this, criminals draft emails that include your exact lender, loan type, property address, estimated payoff range, and even a correct‑looking signature block—making small deviations hard to catch.

Common scam plays to watch for

• Wire‑change email before closing: You receive “updated” wiring instructions that appear to come from your title company, attorney, escrow agent, or lender, with a request to act quickly.
• Fake payoff letter or secure portal notice: A message urges you to log in to a “new secure portal” to retrieve an updated payoff statement or QR code for payment.
• Urgent payoff shortfall alert: Near your payoff date, you’re told the calculated interest per diem changed and you must wire a small additional amount immediately.
• Voicemail follow‑up for legitimacy: After an email, a call from a spoofed number “confirms” the details and pressures same‑day action.
• Paper mail with authentic formatting: Well‑designed letters mimic lender headers, include real loan numbers or property IDs, and direct you to a phone number controlled by the scammer.

Early red flags in messages and documents

• New or altered contact details: Email domains with subtle misspellings, recently created email addresses, or phone numbers that don’t match past correspondence or official websites.
• Single‑point verification: Instructions that say “call this number to confirm” instead of asking you to contact your already‑known representative.
• Payment destination mismatch: Wiring to an account name that doesn’t match the title company, attorney trust account, or lender, or to an out‑of‑state bank without explanation.
• Unusual secrecy or urgency: “Do not share with anyone,” “for security we changed banks today,” or “fund within 60 minutes or you will lose the property.”
• Attachment or portal pressure: Demands to open an attachment or new portal you weren’t previously told to expect.
• Typos in formal numbers: Slightly wrong loan numbers, parcel IDs, or payoff math; date formats that don’t match your lender’s style; odd spacing in ABA or account numbers.

Safe verification steps before sending any wire or payoff

Use out‑of‑band, multi‑step verification—never trust a single channel introduced by the message itself.

1. Retrieve known contact details yourself: Use your lender’s official website or your last known‑good statement to call the payoff department. For closings, use the phone number on your signed engagement letter or a business card you already have.
2. Confirm full wiring details verbally: Get the bank name, ABA/routing number, account number, account name, and a callback code. Ask for a second person at the firm to read back the same details.
3. Match documentation on both sides: Your title/escrow/attorney and your lender should each confirm the same payoff figures and payment destination. Mismatches mean stop.
4. Use a controlled callback: Hang up and call back using the number you sourced independently. Never use a number in the suspect email or attachment.
5. Send a $0 test or controlled confirmation step when possible: Some institutions allow a test process or escrow verification call before you release full funds.
6. Reconfirm on the day of wire: Because scammers time last‑minute changes, reconfirm details immediately before authorizing the transfer.

Protecting your email and accounts during a transaction

• Enable multifactor authentication (MFA): Turn on app‑based MFA for email, lender portals, and file‑sharing tools. Avoid SMS if app‑based options exist.
• Lock down forwarding rules: Check your email settings for unknown forwarding rules, filters, or auto‑delete actions that hide replies from your agent or lender.
• Use a clean device and network: Update your operating system and antivirus, and avoid public Wi‑Fi when reviewing payoff or wire instructions.
• Separate inboxes: If possible, dedicate a single email address to the transaction and never reuse its password elsewhere.
• Password hygiene: Use a unique, long passphrase and a reputable password manager; change passwords if you see any suspicious activity.

How attackers get inside a deal—and how to block them

Many wire fraud cases begin with an inbox compromise of someone in the chain—buyer, seller, agent, attorney, or escrow officer. Attackers quietly monitor threads and strike at the critical moment.

• Beware of “reply‑to” swaps: A hijacked thread where the reply‑to address points to a lookalike domain. Manually expand headers and confirm the domain.
• Look‑alike domains and subdomains: Example: titleco‑secure.com vs titleco.com. Verify the firm’s true domain from its official website.
• PDF editing and letterhead cloning: It’s trivial to lift a logo and signature line. Scrutinize fine print, licensing numbers, and the firm’s legal name.
• Calendar manipulation: Phishing invites with “updated closing” cause rushed decisions. Verify date changes by phone using known numbers.

Checklist before you wire anything

• Did you independently obtain the phone number of the receiving firm?
• Did two different, verified people at that firm confirm the exact wiring details?
• Does the account name exactly match the business you expect (trust/escrow/IOLTA if applicable)?
• Is the routing number for the bank’s stated location, and does that fit your region?
• Did you reconfirm on the same day of the wire, and save screenshots/notes of confirmations?
• Are your email MFA and forwarding rules locked down?

What to do if you receive a suspicious payoff or wire instruction

• Do not click or open attachments. Take a screenshot for records and close the message.
• Contact your known representatives immediately: Use previously saved phone numbers to ask if any change was sent.
• Forward a copy to the legitimate company’s fraud team: They can alert other clients and tighten controls.
• Report the attempt: File a report with the FTC and your state regulator. If sensitive data was exposed, consider a credit freeze with the credit bureaus.

If money was already sent

Act within minutes—speed is critical to recovery.

1. Call your bank’s wire department immediately: Ask to initiate a SWIFT recall or domestic wire recall and a fraud hold on the recipient account.
2. Contact the receiving institution’s fraud team: Provide the wire details and a fraud affidavit to attempt a freeze before funds move again.
3. File an IC3 complaint: Provide full transaction details to help coordinate a financial kill chain with banks and law enforcement.
4. Notify your closing team and title insurer: Their counsel may have recovery channels and guidance on next steps.
5. Secure all accounts and emails: Reset passwords, revoke suspicious sessions, and enable MFA to prevent repeat attempts.

Reduce how much of your property data is exposed

You can’t fully remove public land records, but you can limit what else is easily tied to you.

• Opt out of data brokers: Remove your profiles from major people‑search and marketing databases to reduce the amount of contact detail and familial linkage available.
• Limit listing footprints: Ask your agent to minimize oversharing in public MLS remarks and keep sensitive documents in secure portals only.
• Redact where allowed: Some counties allow redaction of certain personal details from online images or to suppress scanned signatures; inquire with your recorder’s office.
• Harden your online presence: Scrub posts about transaction timelines, moving dates, and travel during closing week.

Sample script to verify a payoff or wire instruction

Use calm, specific language and only a known‑good phone number.

• “I’m calling using the phone number from your official website to verify wiring instructions for [Property Address / File Number]. Please read me the full account name, bank, routing, and account number.”
• “I will call back through your main switchboard and ask for you by name to confirm we match. Is there a second authorized contact who can read back the same details?”
• “Has your escrow/trust account name or bank changed in the last 30 days? If so, please email an updated instruction on your standard letterhead and I will confirm by phone again.”

Documentation you should keep

• Original engagement letters and business cards with trusted phone numbers for your lender, title/escrow, attorney, and agent.
• Written wire instructions saved as PDFs, plus notes of the date/time and person who verbally confirmed them.
• Email header screenshots of any suspicious messages for investigators or your IT support.
• Bank confirmations and call logs from the day the wire was initiated.

When monitoring and alerts help

Misdirected wires are only one part of the risk. Criminals who gather your property and identity data may attempt credit applications, utilities in your name, or new accounts after a failed scam. Ongoing monitoring can help you spot and respond to these attempts quickly.

Consider setting up credit and identity monitoring that alerts you to new accounts, inquiries, address changes, or suspicious activity. A consolidated dashboard that pulls these signals together can save time while you’re focused on a closing. If you want a single place to track credit changes and potential identity misuse while you manage a transaction, see this overview of privacy, credit monitoring, and identity protection.

Practical do/do‑not list during closing week

• Do reconfirm wiring details by voice using numbers you sourced yourself.
• Do tell your team up front that you will ignore any last‑minute changes sent by email or text.
• Do lock your email with MFA, review forwarding rules, and update passwords.
• Do not trust any message that introduces a new phone number, portal, or bank account without prior notice and multi‑party voice confirmation.
• Do not broadcast closing dates or travel plans online.
• Do not send partial data (SSN, account numbers) to “verify” yourself via email or unknown portals.

Conclusion

Wire‑change and mortgage payoff scams succeed because they look and feel legitimate—often referencing your real property, lender, and timeline. The best defense is slowing down, verifying through trusted contact points you retrieve yourself, and locking down the communication channels criminals exploit. Combine multi‑party voice confirmation with strong email security, keep thorough records, and reduce your personal data exposure where you can. With these steps, you greatly lower the chance of misdirected funds and identity fallout during one of life’s biggest financial moments.