Chapter 27: Fraud Prevention: Red Flags, Identity Verification, and Protecting Yourself and Your Borrower

"Almost nobody who commits mortgage fraud wakes up planning to. They wake up planning to get the house, and then somebody offers them a shortcut and does not call it a crime." — constructed; the working premise of this chapter

Overview

Here is the problem this chapter solves, stated as a working loan officer actually experiences it.

You will originate somewhere between two hundred and six hundred loans before you knowingly meet your first fraud. In that time you will see several thousand things that look like fraud and are not: the deposit nobody can immediately explain, the paystub whose year-to-date figure does not reconcile, the borrower whose address history on the credit report has four entries in three years, the gift from a person who is not a relative, the buyer who cannot describe the house they are buying because their spouse toured it and they were at work. Every one of those is a red flag. Almost every one of them has an innocent explanation, and if you treat the people attached to them as suspects you will be both unpleasant to work with and wrong.

So the skill is not suspicion. Suspicion is easy and useless. The skill is a specific two-part discipline: notice the thing, then go get an independent fact. Not a better look at the document — an independent fact, from a source the borrower does not control. That discipline resolves ninety- nine red flags out of a hundred in favor of the borrower, quickly and quietly, and it is also the only thing that reliably catches the hundredth.

The other half of the chapter is about you. A loan originator is the front door of a system that runs from a kitchen table to a pension fund, and the law treats you accordingly. Knowingly putting a false statement into a file that a federally insured institution will rely on is a federal crime, and the doctrine that gets originators in trouble is not lying — it is not asking, because you did not want the answer. The license, the career, and criminal liability are all genuinely in play, and the good news is that the conduct that protects all three is the same conduct that makes you good at the job.

And then there is the thing that is happening right now, to somebody's borrower, today: a spoofed email carrying altered wiring instructions, sent three days before closing, which takes a family's entire down payment and does not give it back. That is §27.10, and if you read one section of this book twice, read that one.

In this chapter, you will learn to:

• Distinguish fraud for housing from fraud for profit, and say how each is detected
• State your own criminal, civil, and licensing exposure — including for what you chose not to ask
• Identify red flags in applications, income documents, and asset documents, and resolve them
• Describe occupancy fraud, straw buyers, silent seconds, air loans, and appraisal fraud
• Apply identity verification, and recognize elder financial abuse when it is in front of you
• Prevent wire fraud and business email compromise, and act in the first hour if it happens
• Escalate a suspicion correctly, and tell a genuine fraud from an ordinary surprise

Learning Paths

🎓 Exam — §27.1, §27.2, §27.6, and §27.11. The SAFE test wants the fraud-for-housing versus fraud-for-profit distinction, the definition of a straw buyer, occupancy misrepresentation, and who files a Suspicious Activity Report. It also likes the licensing consequence in §27.2. 🏠 New LO — §27.3 through §27.5 and §27.10. These are the ones you will use this month. 🤝 Partner — §27.10 above everything, then §27.6. A real estate agent whose clients lose a down payment to a spoofed email will not have another business problem for a while, because they will not have another business. 📊 Operations — §27.4, §27.5, §27.11. Verification design and escalation routing are operations problems long before they are legal ones.

27.1 Fraud for housing vs. fraud for profit

Mortgage fraud is a material misrepresentation, misstatement, or omission relied on by a lender to fund, purchase, or insure a loan it would not have made — or would not have made on those terms — had it known the truth. Three words in that sentence do the work. Material: it has to matter to the decision. Relied on: somebody had to act on it. Omission: staying silent about something you were asked about counts.

Everything else in this chapter is a variation on that sentence. But the variations sort into two families, and the families are so different in scale, participants, motive, and detection method that treating them as one subject is the most common teaching error in this material.

THE TWO FAMILIES                                        [constructed teaching example]

  FRAUD FOR HOUSING                     │  FRAUD FOR PROFIT
  ──────────────────────────────────────┼──────────────────────────────────────
  Goal: get or keep a specific house    │  Goal: extract money from the loan
  Borrower intends to pay               │  Nobody intends to pay for long
  Usually ONE party, sometimes two      │  MULTIPLE parties, coordinated
  Rarely involves an industry insider   │  Almost ALWAYS involves an insider
  Loan often performs for years         │  Early payment default is typical
  Loss to the lender: often zero        │  Loss to the lender: the whole loan
  ──────────────────────────────────────┼──────────────────────────────────────
  CAUGHT BY: routine verification —     │  CAUGHT BY: pattern analysis —
  transcripts, VOEs, asset sourcing,    │  repeat parties across files, quality
  the credit refresh                    │  control samples, early payment
                                        │  default review, post-close audits
  ──────────────────────────────────────┼──────────────────────────────────────
  BOTH ARE CRIMES. The difference is scale, intent, and how you find them.

Fraud for housing is misrepresentation by somebody who wants to live in the house and fully intends to make the payment. They overstate income because the qualifying number came up short by four hundred dollars. They describe a loan from a parent as a gift because a gift is allowed and a loan is not. They say they will occupy a property they intend to rent, because the down payment for a primary residence is smaller. The motive is almost always the same: they want the house, they believe they can afford it, and somebody — sometimes the originator — told them there was a way.

It is still a crime. The borrower's sincerity about their own creditworthiness is not a defense, because the entire system depends on the representations being true rather than earnest. But the honest description of fraud for housing is that it is usually committed by people who would be horrified to be described as criminals, frequently at the suggestion of somebody they trusted, and often on a loan that then performs for a decade.

Fraud for profit is a scheme. The house is not the objective; the loan proceeds are. It requires more than one person and it nearly always requires an insider — an originator, a processor, an appraiser, a closing agent, an escrow officer, someone with the access to make fabricated facts look verified. The property may be real and grossly overvalued, or real and never actually sold, or not exist at all. The applicant may be a real person lending their credit for a fee, a stolen identity, or an identity assembled out of nothing.

The distinction between the two families is not moral squeamishness. It is operational, and it changes what you look for:

That last row is the one to sit with. In a normal career you will meet fraud for housing repeatedly and fraud for profit rarely — but when fraud for profit arrives, it arrives as an offer. It comes from a referral source with a lot of volume, or a colleague with an unusual pipeline, or a builder's representative with a creative structure, and it does not announce itself. Chapter 7 talks about where loans come from; this chapter is about the price of the wrong ones.

🎓 NMLS Exam Watch

The exam tests this distinction directly and it tests it with intent. Read the stem for who benefits and how many people are involved.

• A borrower overstates income to qualify for a home they will live in → fraud for housing.
• An investor pays three people a fee to apply for loans on properties they will never see, using inflated appraisals, and splits the proceeds → fraud for profit.

Two traps. First, candidates assume fraud for housing is somehow not fraud because the borrower intends to pay. It is fraud, it is a federal crime, and the exam will punish "not fraud." Second, candidates assume the borrower is always the perpetrator. In a large share of documented fraud-for-profit schemes the applicant was recruited, paid a small fee, and told the arrangement was legal — and was still charged.

Also know the general term for the applicant in that role: straw buyer (§27.7).

27.2 The originator's exposure

Now the uncomfortable part, and the reason this chapter sits in Part V rather than Part III.

There is no single federal statute called "mortgage fraud." What prosecutors charge are the general federal fraud and false-statement statutes, applied to a mortgage transaction. The ones that recur: false statements to influence a federally insured institution (18 U.S.C. § 1014), bank fraud (§ 1344), wire fraud (§ 1343) and mail fraud (§ 1341), false statements in a matter within the jurisdiction of a federal agency (§ 1001), and, for HUD and FHA transactions specifically, false statements in HUD-related transactions (§ 1010). Conspiracy is charged alongside most of them, because fraud for profit is by definition a group activity. Running parallel to the criminal track is civil exposure: the Financial Institutions Reform, Recovery, and Enforcement Act gives the government civil penalty authority with a notably long limitations period, and the False Claims Act has been used against originators and lenders in connection with government-insured lending.

This book does not print penalty ranges or sentence lengths, and neither should you. They depend on the counts charged, the loss amount, the defendant's role, and sentencing law that changes. What matters on the desk is the shape of the exposure, which is easy to state: a false statement you knowingly put into a file that a federally insured institution will rely on is a federal felony, and it does not become less of one because the borrower asked you to, because everybody does it, or because the loan later performed.

Willful blindness is the actual risk

Very few originators are prosecuted for inventing a paystub. The doctrine that catches people is willful blindness — sometimes called deliberate ignorance or conscious avoidance. In broad terms, a person who is aware of a high probability that a fact is true and deliberately avoids confirming it can be treated, for purposes of knowledge, as though they knew. The precise formulation is a legal question for counsel, not for a textbook, and the jury instruction varies by circuit. But the practical version needs no lawyer:

You cannot protect yourself by not asking. In fact, not asking is the thing that converts an ambiguous situation into an inference about your state of mind, because the question you skipped is visible in the file forever. The processor asked in an email; you did not answer. The underwriter's condition said "explain"; the explanation you submitted did not explain. The borrower said something on a recorded call that you did not follow up on. Reconstructed later, a pattern of not-asking looks exactly like knowing.

The inverse is the most useful professional habit in this chapter: ask the question in writing, write down the answer, and let the file show that you asked. A file that contains a question, an answer, and a verification is a defensible file even if the answer later turns out to have been a lie — because you were deceived, which is a different thing from having participated.

The three things at risk, in order of how fast you lose them

1. The loan. A misrepresentation discovered pre-closing kills the file. Discovered post-closing, it can trigger a repurchase demand under the representations and warranties your employer made to the investor (Chapter 14). Somebody eats that loan, and your employer will find out who caused it.
2. The license. Chapter 3 has the licensing mechanics; here is the fraud consequence. Under the S.A.F.E. Act's character and fitness standard, a felony conviction in the preceding seven years bars licensure — and a felony involving fraud, dishonesty, breach of trust, or money laundering is a permanent bar, with no lookback that ever expires. That is not a suspension. There is no version of your career after it. Separately, and much faster than any criminal process, a state regulator can act on a licensee's conduct directly.
3. Liberty. Rare, real, and reserved mostly for the fraud-for-profit family, where an insider is nearly always required and the insider is nearly always an originator, an appraiser, or a closing agent.

⚖️ Compliance Check

Three obligations that attach to you personally, not just to your employer.

First, your company has an anti-fraud policy and an escalation path, and you are required to know them. Non-bank residential mortgage lenders and originators have been subject to anti-money-laundering program requirements under the Bank Secrecy Act since a Financial Crimes Enforcement Network rule took effect in 2012; depositories have been subject to them far longer. That program is why you sit through annual fraud training, and it is what the escalation path in §27.11 implements.

Second, the agencies require reporting. Fannie Mae and Freddie Mac both require sellers and servicers to report suspected fraud involving loans sold to them, and both publish fraud-prevention resources for lenders. Your compliance department owns the mechanics; your job is to hand them the facts.

Third, do not attempt to work out for yourself whether something is "technically" a crime. That is a question for counsel, and the act of privately deciding a borderline file is fine is itself the thing that looks worst in hindsight.

Statutes, rules, and licensing standards change, state law varies substantially, and nothing here is legal advice. Verify current requirements with your compliance department, your state regulator, and counsel.

27.3 Red flags in the application

A red flag is a fact or pattern in a file that is inconsistent with the story the file is telling and therefore requires an independent verification before you rely on it. That definition is doing something deliberate: a red flag is defined by inconsistency, not by suspicion, and it resolves by verification, not by judgment.

Say the corollary out loud, because it governs everything in §27.3 through §27.5: most red flags have innocent explanations. People move a lot. People get paid oddly. Families help each other with money and are vague about the paperwork. Small employers answer the phone on a mobile. A borrower who cannot describe the kitchen is usually a borrower who works nights. Treating a red flag as an accusation is not only rude, it is bad craft, because it produces defensive borrowers who stop telling you things — and the thing you most need from a borrower is that they keep telling you things.

What actually shows up on the 1003

Chapter 9 owns the application and its declarations. The fraud lens on it is narrower: look for places where the application disagrees with something else in the file, or with itself.

The last row is the one with teeth. The application asks, in substance, whether the borrower is borrowing any money for this transaction and whether there is any undisclosed subordinate financing. Those questions exist precisely because the answer changes the lender's decision, which makes a knowing "no" a material false statement rather than a paperwork slip. Chapter 9 walks the declarations; know that these two are not filler.

File-level and party-level patterns

Fraud for housing shows up inside one file. Fraud for profit shows up across several, and the pattern is almost always a repeating party: the same appraiser, the same closing agent, the same "gift" donor, the same employer, the same phone number on documents from unrelated companies, the same seller reselling properties within months at large increases. Nobody sees that pattern from one file, which is why quality control exists and why post-closing audits are not bureaucratic theater.

But you can see one version of it, and you are the only one who can: you know your own referral sources. If files from one source keep arriving with the same unusual feature — every borrower has the same kind of unverifiable side income, every transaction has a large seller credit and a last-minute contract amendment, every file has a "gift" — that is a pattern and it belongs with your manager, not in your own head.

📞 On the Phone

A red-flag question, asked correctly. The credit report shows an address the borrower did not list, in a state they have not mentioned.

The wrong version: "There's an address on your credit report you didn't tell me about." Now they are a suspect and they know it.

The other wrong version: saying nothing, and letting underwriting raise it on day 28.

What works: "One housekeeping thing. Your credit file has an old address in a different state that isn't on the application. That's normal — bureaus keep addresses forever and they pick them up from anywhere. Can you tell me what it is so I can put the right thing on the file? If it's nothing, it's a one-line note and we're done."

Four things happened there. You disclosed what you saw, you supplied the innocent explanation first, you asked an open question, and you told them what a clean answer costs — nothing. In my experience roughly nineteen out of twenty of these are a parent's address, a college apartment, or a data error. The twentieth is a property they own and did not mention, which changes the debt ratio and needs to be on the file anyway.

Ask every one of them. Never with an edge in your voice.

27.4 Red flags in income and employment documents

Income and employment fraud is the most common form of fraud for housing, for a plain reason: income is the denominator of the ratio that declines files, and it is the one input a borrower can imagine improving with a document. Chapter 11 owns qualifying income, the written and verbal verification of employment, and IRS Form 4506-C. What this section owns is why those controls exist and what to do when a document does not reconcile.

Start with the professional conclusion and work backwards to it:

You do not detect document fraud by looking at documents. You detect it by verifying independently.

That sentence saves careers. Document review has a real but narrow role — it tells you where to verify, not whether to trust. Modern fabricated documents are good, they are produced at scale, and an originator who believes they can spot them by eye is exactly the originator who will be deceived, and will have a file full of evidence that they looked carefully and approved anyway.

The inconsistencies that route you to a verification

Notice the third row. The single most common "red flag" a new loan officer reports is a W-2 that does not equal the last paystub's year-to-date gross, and it is almost never anything, because Box 1 is reduced by pre-tax retirement and benefit contributions. Learning which discrepancies are normal is as important as learning which are not, and it is the difference between a loan officer underwriting cares to hear from and one they learn to filter.

📄 Read the File

text FIGURE 27.1 — "Three documents that do not agree" [constructed teaching example] THE DOCUMENT An income package on a purchase file: two current paystubs, the prior year's W-2, and a written verification of employment returned by the employer. Reviewed on day 9, before submission. THE CONTEXT A $310,000 purchase, 5% down, one borrower, W-2 hourly plus overtime. Qualifying income is tight; the file clears the ratio by 0.7 points, so every dollar of the income calculation is load-bearing. WHAT IT SHOWS Three things do not reconcile. (1) The stub's year-to-date gross implies an average of about 46 hours a week; the VOE reports "40 hours, overtime not guaranteed." (2) The W-2's Box 1 is $4,180 below the prior-year final stub's YTD gross. (3) The VOE came back the same afternoon it was sent, signed by a "payroll manager," from an email address at a free consumer domain rather than the employer's own. WHAT IT DOESN'T It does not show fraud, and a reviewer who writes "fraud" here is wrong. Every item has an ordinary explanation: overtime is real and common in this trade; a $4,180 Box 1 gap is exactly what a 401(k) deferral looks like; and a nine-person employer may genuinely have one person who does payroll from a personal address. The document set is UNRECONCILED, which is a different finding from FALSE, and the file is not entitled to a conclusion it has not earned. THE DECISION Do not study the documents further; there is nothing more in them. Order the independent facts: tax transcripts via the executed 4506-C, and a verbal verification of employment placed to a number obtained from an independent directory listing rather than from any document in the file. Ask the borrower, plainly and without an accusation, to confirm typical weekly hours and whether they contribute to a retirement plan. Then document the question and the answer in the file. If the independently obtained number does not reach the employer, stop and escalate under §27.11 — do not call the number on the VOE to "check." THE LESSON A red flag is not a finding. It is an instruction to go get a fact from a source the borrower does not control. Two of these three items will resolve on their own; the third is why the control exists.

Constructed. The figures and the employer are illustrative and are not the Linden Street file.

Why the verbal VOE sits where it sits

The Linden Street approval carried eleven conditions, and condition 10 was a verbal verification of employment for both borrowers within the required window before the note date — a condition marked prior-to-funding rather than prior-to-docs, which means it is cleared at the end, deliberately, when it is nearly too late to be useful for anything except the truth. Chapter 19 owns the condition list. The fraud point is the timing: a verification performed at application answers a question about the past. A verification performed days before funding answers the question the investor actually asked, which is whether this person is employed now, at the moment the money moves.

That single design choice — verify late, close to the event — is the same idea as the pre-closing credit refresh, and it is the reason §27.12 exists.

27.5 Red flags in assets

Chapter 12 owns assets: sourcing, seasoning, large deposits, gift funds, and the documentation each requires. Here is the fraud lens, which is short, because Chapter 12's controls are the fraud controls.

The asset question a lender is really asking is not "do you have the money?" It is "is this money yours, and is it not a loan?" Both halves matter. Money that is borrowed creates a debt that is not in the ratio; money that is somebody else's may indicate a party to the transaction who is not on the application. That is the entire theory behind sourcing and seasoning, and once you say it that way the rules stop feeling arbitrary and the conversations with borrowers get much easier.

That sixth row is a moment worth teaching directly. When a borrower tells you they will "pay their parents back eventually," they have just told you the truth about a material fact, and how you respond determines what they tell you next. The wrong response is a lecture. The right response is that the arrangement has to be one thing or the other on paper: either it is a gift with no expectation of repayment, which the donor signs a letter saying, or it is a loan, which has to be disclosed and which the underwriter will count. Those are the two available structures. Coaching a borrower to describe a repayable loan as a gift is not a favor. It is a false statement, made by you, in a document the lender relies on.

Linden Street is the ordinary version of all of this and it is worth holding onto as the baseline: \$28,000 in verified savings across two accounts with three months of statements, plus a \$10,000 gift from one borrower's parents, papered with a signed gift letter and evidence of the transfer, plus a single \$4,900 deposit that looked exactly like an unsourced deposit and was in fact the net of a \$6,900 gross quarterly commission after \$2,000 of withholding. That deposit generated a condition, the condition was cleared on day 33 with a commission statement and a deposit record, and nobody involved was doing anything wrong at any point. That is what a red flag looks like in the overwhelming majority of files: a question, an answer, a document, and a cleared condition.

27.6 Occupancy fraud

Occupancy fraud is representing that a property will be the borrower's primary residence — or a second home — when the borrower intends something else, most often to rent it out. Chapter 5 defines the occupancy categories and Chapter 20 covers how the contract treats them; this section owns the misrepresentation.

It is the fraud-for-housing category most people commit without believing they are committing anything, because the misstatement is about the future and futures feel negotiable. It is also, in volume terms, one of the most consequential, because occupancy drives so much of the deal at once:

Verify current program requirements before quoting any of that; the specifics change and vary by investor and by lender overlay (Chapter 14).

How it is caught

Occupancy is a statement of intent, and intent cannot be verified directly — so the controls are all circumstantial, and they are surprisingly effective in aggregate:

• Distance and commute. A primary residence two hours from the borrower's verified employment invites a question. It is often answered well: a new job, a remote arrangement, a spouse's workplace, a family reason.
• The departing residence. A borrower who owns a home nearby and is neither selling it nor documenting a reason to leave it raises the obvious question. Again, frequently answered: divorce, a growing family, an aging parent moving in.
• Fit. A one-bedroom condominium purchased as the primary residence of a household of five is a question. A duplex where the borrower will occupy one unit is not — owner-occupied two-to-four unit property is a legitimate, common, program-eligible structure, and confusing it with occupancy fraud is a classic beginner error.
• The subject property already listed for rent. This is found during the process more often than you would think, because listings are public.
• The certifications. The application declares intent to occupy, and the uniform security instrument carries an occupancy covenant — typically requiring the borrower to occupy the property within sixty days of closing and to continue occupying it as a principal residence for at least one year, unless the lender agrees otherwise or extenuating circumstances exist.
• After closing. Servicers see returned mail, a mailing address different from the property, and an insurance policy that converts to a landlord policy. Quality control samples order occupancy verifications. Early payment default triggers a file review.

Intent is a real defense, and circumstances really do change

Say this to borrowers and mean it. A borrower who genuinely intends to occupy a home, closes, moves in, and is transferred out of state four months later has not committed occupancy fraud. Intent is measured at the time of the representation. Life changes, employers relocate people, marriages end, parents get sick, and none of that is retroactive dishonesty.

What would be fraud is representing an intent the borrower does not have — and the giveaway is almost always a conversation rather than a document. When a borrower says "we'll live there for a year and then rent it," that is a plan to comply with the covenant and it is fine. When a borrower says "we're not really going to live there, but my agent said to put primary," you have just been handed a material fact, and you now know it. You cannot un-know it, you may not submit the application as a primary residence, and §27.11 is what you do next.

🔍 Check Your Understanding

1. A borrower's employer is verified at an address 95 miles from the subject property. Is that a red flag, a finding of fraud, or neither — and what is your next action?
2. A borrower tells you their parents are giving them \$15,000 and adds, "we'll pay them back when we can." What are the only two ways this can appear in the file?
3. Which is caught by verification inside a single file, and which by pattern analysis across many files: a fabricated paystub, or an appraiser who values every property from one seller at exactly the contract price?

(1 is a red flag and nothing more; the action is to ask, and to document the answer. 2: a gift, documented per Chapter 12, or a disclosed loan that gets counted in the ratio — there is no third option. 3: the paystub is caught inside the file by transcripts and an independent VOE; the appraiser pattern is invisible from one file and is caught by quality control.)

27.7 Straw buyers, silent seconds, and air loans

These three are the classic fraud-for-profit structures. You are unlikely to originate one knowingly. You are entirely likely to be invited into one, and the invitations do not look like invitations, so the point of this section is recognition and the criminal exposure attached.

Straw buyers

A straw buyer is a person who applies for a mortgage and takes title in their own name for someone else's benefit — usually lending their credit for a fee, with an undisclosed party supplying the money, controlling the property, or both. The lender believes it is lending to the person on the application. It is not, and that is the material misrepresentation.

Straw-buyer arrangements are usually sold to the applicant as something else: "you're just helping a friend get financing," "you'll be on the loan for six months and then we refinance out," "it's an investment partnership and my attorney set it up." The applicant is frequently recruited for exactly the qualities that make them useful — good credit, a clean employment history, no idea how mortgage lending works. They are still committing a federal crime, and in documented prosecutions straw buyers have been charged alongside the organizers. "I was told it was legal" is not a defense, and neither is having received only a small share.

How it is caught:

• The earnest money, down payment, or closing funds come from a party who is not on the application. This is why asset sourcing exists, and it is the single most effective control against straw purchases.
• The applicant cannot describe the property, the neighborhood, the price negotiation, or the inspection.
• The same non-borrowing party appears across several transactions — as a "gift" donor, a seller, a contractor, or a payer of an unexplained credit.
• The applicant buys multiple properties in a short window, each as a primary residence.
• Post-closing: the payment is made by someone else's account, or the loan defaults immediately.

Silent seconds

A silent second is an undisclosed subordinate lien — most often a seller carryback or a private note that funds part of the borrower's down payment — deliberately hidden from the first-lien lender. It matters because it falsifies two things the lender priced on: the borrower's actual equity investment, and the combined loan-to-value ratio. It also creates a debt payment that never made it into the ratio.

Do not confuse this with legitimate subordinate financing. The Harlow Street file carries a \$10,000 forgivable county down-payment-assistance second, zero percent, forgiven twenty percent a year over five years, producing a CLTV of 101.15% on a base loan of \$207,475.00 against a \$215,000 purchase price. That second is disclosed, approved, program-sanctioned, underwritten, recorded, and completely proper — and Chapter 33 works the layering. The difference between the Harlow Street second and a silent second is not the structure. It is disclosure. A second lien the lender knows about and approved is a product feature. The same lien concealed is a crime.

How it is caught: the title commitment and the search behind it (Chapter 21), the closing statement that shows funds arriving from an unexplained source, the borrower's verified assets failing to reconcile with the cash actually delivered at closing, and post-closing recording review.

Air loans

An air loan is the pure form: a loan on a fabricated transaction. The property may not exist, or may exist and not be for sale, or may exist and be owned by someone who knows nothing about it. The borrower may be fabricated. In documented schemes, perpetrators have stood up entire counterfeit infrastructures — a phone bank answering as the employer, the appraiser, the title company, and the escrow office — so that every verification call routes back to the scheme.

That last detail is why one control matters more than all the others combined, and it is the same control that defeats wire fraud in §27.10:

THE ONE CONTROL THAT CUTS ALL THREE                     [constructed teaching example]

  Legend: ✔ = independently obtained    ✘ = supplied by a party to the transaction

     THE SCHEME WANTS THIS                    THE CONTROL IS THIS
  ┌──────────────────────────┐            ┌──────────────────────────┐
  │ employer phone number    │ ✘ from the │ employer phone number    │ ✔ from an
  │ on the VOE               │   file     │ from a directory YOU     │   independent
  └──────────────────────────┘            │ looked up                │   source
  ┌──────────────────────────┐            └──────────────────────────┘
  │ appraiser chosen by the  │ ✘          ┌──────────────────────────┐
  │ transaction's promoter   │            │ appraisal ordered through│ ✔
  └──────────────────────────┘            │ the lender's AMC (Ch.18) │
  ┌──────────────────────────┐            └──────────────────────────┘
  │ title/escrow named by    │ ✘          ┌──────────────────────────┐
  │ the same promoter        │            │ title ordered by the     │ ✔
  └──────────────────────────┘            │ lender/settlement per    │
  ┌──────────────────────────┐            │ normal channels          │
  │ wire instructions in an  │ ✘          └──────────────────────────┘
  │ email                    │            ┌──────────────────────────┐
  └──────────────────────────┘            │ instructions confirmed on│ ✔
                                          │ a number you already had │
                                          └──────────────────────────┘

  Every one of these is the SAME control: the verifying fact must come from a
  channel the other party did not choose. Fraud dies at independently sourced
  contact information, which is why schemes spend most of their effort trying
  to control which channel you use.

⚠️ Where Deals Die

The silent second nobody asked about.

How it actually goes. Your borrower is short on cash. The seller — a small builder — offers to "carry a note for the difference," and the buyer's agent, who is not a bad person and does not know the rules, tells everyone that is a normal thing sellers do. Nobody puts it on the application. Nobody tells you. You submit a file showing a 5% down payment funded from savings.

It surfaces at title, on Schedule B, as a recorded instrument nobody in your file has heard of. Best case: the transaction restructures, the second is disclosed and either approved or paid off, and you lose a week and possibly a lock. Worst case: the file dies at day 40 and the earnest money is exposed.

The version that ends careers is the one where it surfaces after closing and somebody asks what you knew. There is exactly one defense, and you build it at application: ask the question, in writing, and keep the answer. "Is any part of your down payment or closing costs being borrowed from anyone, including the seller, a family member, or an employer?" Ask it at application, ask it again when the contract is amended, and put the answer in the file both times.

The declarations on the application ask this for a reason. Do not let them be the only place it was asked.

27.8 Appraisal and property fraud

Chapter 18 owns the appraisal, appraiser independence requirements, appraisal management companies, and the reconsideration-of-value process. This section owns appraisal fraud — a material misrepresentation of a property's value or condition relied on by a lender — and the originator's specific exposure to it.

There are three distinct things people mean by the phrase, and they are worth separating:

Value inflation. The appraisal supports a value the property does not have, achieved through comparable selection, unsupported adjustments, or fabrication. This is the engine of most fraud-for-profit schemes, because an inflated value is what creates loan proceeds in excess of the property's worth — the money the scheme extracts.

Fabricated or misappropriated reports. A report that no appraiser prepared, or one issued in a real appraiser's name without their involvement. Appraiser identity theft is a documented pattern, which is why lenders verify that the license is active, that the appraiser signed, and that the report actually came through the ordered channel.

Property misrepresentation. The property is not what the report describes: the photographs are of a different unit, the condition is materially worse, the square footage is invented, or the occupancy or use is misstated.

Two structures worth naming

Illegal property flipping is the resale of a property within a short period at a sharply higher price, supported by a fraudulent appraisal, often with a straw buyer. Note carefully what it is not: buying a distressed house, genuinely renovating it, and reselling it at a higher price is a legitimate business, and describing it as fraud is both wrong and insulting to a large number of honest contractors. The fraud is in the appraisal and the misrepresentation — a rapid resale with a large increase and no improvements to justify it. Detection is straightforward and almost entirely automatic: prior-sale history is disclosed on the appraisal report, and rapid appreciation with no documented work triggers review. Some programs impose explicit seasoning restrictions on resales; verify current requirements by program.

Property flopping is the mirror image, and it appears in distressed sales: the value is pushed down so the property can be acquired below market — frequently by an insider — and resold immediately.

The originator's actual risk here

You will almost never fabricate an appraisal. You may very easily be the person who pressures one, and that is what appraiser independence rules exist to prevent. The line matters and it is not subtle:

Chapter 18 has the mechanics of the reconsideration process. The fraud point is that a request built entirely on evidence is a professional act, and the identical request built on a number is a violation — and on the Cypress Court file, where the appraisal returned at \$505,000 against a \$540,000** contract and opened a **\$28,000 gap, the temptation to cross that line arrives at its maximum strength precisely when the deal is worth the most to you. That is not an accident. It is the structure of the incentive, and knowing it is coming is most of the defense.

27.9 Identity theft and elder financial abuse

Two topics in one section because they share a feature that inverts everything else in this chapter: the person in front of you is the victim, not the perpetrator.

Identity theft in origination

Identity theft in this context is the use of another person's identifying information to apply for or obtain a mortgage. It shows up in two shapes. In the first, an application is submitted in a real person's stolen identity. In the second — synthetic identity fraud, which the Federal Reserve's payments-improvement work has documented as a distinct and growing category — an identity is assembled: a real Social Security number that does not belong to a credit-active adult, paired with a fabricated name and history, built up over months or years with small accounts until it carries a credit file that looks ordinary. Synthetic identities are hard to catch precisely because there is no victim to notice and complain.

The verification controls you will actually operate:

• Government-issued photo identification, examined by a human, matched to the application, and matched to the person signing at closing.
• Your institution's customer identification and identity theft prevention program — the FACT Act's Red Flags Rule requires creditors to maintain one, and it is where the regulatory sense of the phrase "red flag" comes from.
• Notices of address discrepancy from the credit reporting agency, which arrive when the address on the application does not match the address the bureau has on file. Under the Fair Credit Reporting Act these carry a procedural obligation; your compliance department owns it.
• Fraud alerts, active duty alerts, and security freezes on the credit file. A frozen file is not a red flag about the borrower — it is a borrower doing exactly what consumer protection agencies recommend, and it means someone will need to lift the freeze before the file can proceed.
• Out-of-wallet knowledge questions and third-party identity verification services, with the understanding that both have failure modes and neither is proof.

One obsolete heuristic to unlearn, because it is still repeated in training rooms: Social Security number prefixes no longer encode the state or the era of issuance. The Social Security Administration moved to randomized assignment in 2011. An originator who "knows" that a number is suspicious because of its first three digits is working from a rule that stopped being true a long time ago.

When the borrower is the victim — a credit report showing accounts they do not recognize — your job is narrow and important. Do not dispute anything on their behalf, and never refer them to an operation that charges advance fees to dispute accurate information. Direct them to the Federal Trade Commission's identity theft resources, help them understand that a fraud alert or a police report will be part of the file, and be honest that the loan will take longer. Chapter 10 owns credit and the dispute mechanics.

Elder financial abuse

Elder financial exploitation is a distinct and heavily documented problem in mortgage lending, because home equity is frequently the largest asset an older household owns and because the instruments that access it — cash-out refinances, reverse mortgages, and transfers of title — are exactly the instruments an exploiter needs. Chapter 35 covers reverse mortgages as a product; this is the abuse lens.

What it looks like on a file, with the caution that every one of these has an ordinary explanation and most of the time that is what it is:

The single most useful procedure is also the simplest: speak with the borrower alone. Not accusingly, not dramatically — "I need about five minutes with you directly, that's just how I have to take an application" is a complete and unremarkable explanation, and any legitimate companion will accept it without friction. What you are checking is not competence; it is whether the borrower can tell you, in their own words, what they are borrowing, why, and what they will pay.

If the answer worries you: document what you observed factually, do not accuse anyone, and escalate under §27.11. Reporting frameworks exist and your compliance department knows them — adult protective services in most states, mandatory reporting for certain roles in some, and the federal Senior Safe Act, which provides immunity from certain liability for covered financial institution employees who receive appropriate training and report suspected exploitation in good faith to the appropriate authorities. Verify how your institution implements it; the training is usually the condition of the protection.

27.10 Wire fraud and business email compromise

This is the most urgent practical content in this book.

Wire fraud in a real estate closing means a criminal induces a party to send funds to an account they control, using falsified payment instructions. The delivery mechanism is nearly always business email compromise (BEC) — an email that appears to come from a party to the transaction, sent by a criminal who has either compromised that party's mailbox or spoofed a lookalike domain, and who has been reading the transaction's email traffic for weeks.

Read that last clause again. This is not a random phishing blast. The message arrives at the right moment, quotes the right property address, uses the right names and the right closing date, and matches the tone of the person it imitates, because the criminal has been inside the conversation. Nothing about it looks wrong. That is the entire design.

HOW IT ACTUALLY GOES                                    [constructed teaching example]

  WEEK 1   A mailbox somewhere in the transaction is compromised — the agent's,
           the title company's, the assistant's, or the borrower's own. Often via
           a credential-harvesting page. Nobody notices. Nothing is stolen yet.
              │
  WEEKS 1-6  The criminal READS. Learns the property, the price, the closing date,
           the names, the writing style, and who instructs whom about money.
              │
  DAY -3     An email arrives at the borrower: "Wiring instructions attached —
           note our bank has changed, please use these and confirm receipt."
           Correct address. Correct amount. Correct signature block. Urgent tone.
              │
  DAY -2     The borrower wires $25,376.34 to the criminal's account.
              │
  DAY -1     Funds are withdrawn or moved onward, often within hours.
              │
  DAY  0     Closing. The title company says the funds never arrived.
              │
             ──────────── AND THE MONEY IS FREQUENTLY GONE ────────────

The reason this is the most dangerous fraud in residential lending is not sophistication. It is that the loss lands on the household rather than the institution, at the exact moment they have the most money in motion they will ever have, and recovery is uncertain at best.

⚠️ Where Deals Die

What a misdirected wire actually costs a family. Price it on the Linden Street file.

These borrowers began with \$43,000. On day 4 they paid \$5,000 of earnest money, leaving the \$38,000** in verified assets the file was built on. Cash to close is **\$25,376.34, with \$12,623.66 — 4.16 months of PITI — remaining as reserves after closing.

If that \$25,376.34 goes to a criminal's account:

	Amount
Assets before closing	\$38,000.00
Wire misdirected	(\$25,376.34)
Remaining	\$12,623.66
Earnest money already delivered and now at risk	\$5,000.00
Appraisal fee already spent	\$650.00

They have lost 66.78% of every liquid dollar they own (\$25,376.34 ÷ \$38,000.00), they do not own the house, the seller may keep the earnest money, and they cannot close on anything else because they no longer have a down payment. There is no insurance policy in the file that fixes this. There is no lender remedy. The loan simply does not happen, and the household is set back years.

This is the largest single financial catastrophe you are in a position to prevent, and it costs you one conversation at application and one before closing.

Prevention: five rules, and the fifth one is the whole thing

1. Never send wiring instructions by email, and never accept them by email. Not as an attachment, not as a PDF, not "for reference." If your organization must transmit them, it uses a secure portal — and even then, the instructions are confirmed by voice.
2. Warn the borrower at application, in writing, and again before closing. Tell them plainly: no one in this transaction will ever email you a change to wiring instructions, and if you receive one, it is fraud. Say it on day 5 and say it again in the week before closing, because an early warning fades and the attack is timed to the closing.
3. Verify by voice, on a number you obtained independently. Not the number in the email. Not the number in the signature block. The number from the executed contract, from the title company's published listing you looked up yourself, or from your own contacts. This is the same control as §27.4's independent VOE and §27.7's independent order channel, and it is the one control that fraud cannot route around.
4. Treat any change as an attack until proven otherwise. Changed bank, changed account number, changed beneficiary name, new urgency, a request for secrecy, or a request to switch from wire to another rail. Legitimate changes to closing instructions are rare and can survive a phone call.
5. Assume the borrower's own email is compromised. This is the rule people skip. If the criminal is in the borrower's mailbox, then confirming instructions by email with the borrower confirms nothing, because the criminal is reading and can reply. Voice, on an independently obtained number, or nothing.

Chapter 23 owns the funding sequence and the mechanics of how money actually moves at closing. This section owns the fraud, and the two meet at one point: the moment the borrower is told where to send money is the moment of maximum exposure in the entire transaction.

📞 On the Phone

The warning, at application (day 5). Ninety seconds, and you deliver it as a rule, not a worry.

"One thing I tell everybody, and I need you to remember it in six weeks when you're tired. Nobody in this transaction — not me, not the title company, not your agent — will ever email you new wiring instructions. Criminals read real estate email. They wait until three days before closing and they send a perfect-looking message with a new account number, and people send their entire down payment to a stranger. It happens constantly and the money usually does not come back. So here is our rule: when it is time to send funds, you will call the title company at the number on your contract — not a number in an email — and you will confirm the instructions with a human voice. If you ever get an email about wire instructions, call me first. I will never be annoyed about that call."

And if it has already happened, the first hour is everything:

1. Call the sending bank immediately and ask for a wire recall and, if applicable, a hold-harmless or indemnity request to the receiving bank. Minutes matter; ask for the fraud department by name, not the branch.
2. Have the borrower report it to the FBI's Internet Crime Complaint Center (IC3) right away. IC3 maintains a recovery function that can, when a domestic fraudulent transfer is reported quickly, work with the financial institutions to freeze funds. It works best in hours, not days.
3. Notify the receiving bank's fraud department with the wire details.
4. File a local police report, which the banks will ask for.
5. Notify your compliance department, the title company, and the lender immediately — and preserve every email, including headers.

Do not let the borrower "wait and see." Do not let anyone spend the first two hours deciding whose fault it was. Recovery odds fall by the hour.

27.11 What to do when you suspect something

Suppose the verification did not resolve it. The number you obtained independently does not reach the employer. The transcripts do not match the returns. The borrower told you they will not really live there. Now what?

There is a correct procedure, it is short, and most of it is about restraint.

THE ESCALATION LADDER                                   [constructed teaching example]

   YOU OBSERVE SOMETHING
          │
          ├─► 1. STOP. Do not confront. Do not accuse. Do not "just ask them
          │        one more time." You are not an investigator and the
          │        question you ask next can destroy an investigation.
          │
          ├─► 2. PRESERVE. Change nothing. Delete nothing. Do not re-request
          │        a "cleaner" document. Do not re-paper the file.
          │
          ├─► 3. DOCUMENT FACTS ONLY. What document, what date, what was said,
          │        by whom, what you verified and how. No conclusions, no
          │        adjectives, no theory of the case.
          │
          ├─► 4. ESCALATE INTERNALLY, SAME DAY, per your company's policy —
          │        manager and compliance. That policy exists precisely so
          │        this decision is not yours.
          │
          ├─► 5. DO NOT DISCLOSE. Not to the borrower, not to the agent, not
          │        to the title company, not to your colleague at the bar.
          │
          └─► 6. DO NOT PROCEED TO CLOSING while the question is open.

   THE INSTITUTION decides what gets reported and to whom. Not you.

Take those in turn, because each one has a failure mode attached to a real career.

Stop, and do not confront. The instinct to say "this doesn't look right, can you explain?" is decent and, past a certain point, wrong. A confrontation gives a perpetrator the chance to substitute documents, and it gives an innocent borrower the impression they have been accused of a crime by their lender. There is a line between §27.3's ordinary clarifying question — asked early, neutrally, as part of building the file — and an interrogation after you already have a specific suspicion. Before you have a suspicion, ask everything. After you have one, escalate.

Preserve. Do not request a replacement document to "clean up" the file. Do not delete the email thread. Do not amend the application to make the inconsistency go away. Every one of those looks like concealment in hindsight, and at least one of them is.

Document facts only. "The written VOE listed (555) 0100 as the employer's number. The number listed in the state business registry for that entity is different. I called the registry number on day 12 at 2:15 p.m.; the person who answered stated the company has no employee by that name." That is a useful memo. "I think this borrower is committing fraud" is not — it is a conclusion you are not qualified to draw and it will be read aloud someday.

Escalate the same day. To your manager and your compliance department, in writing, through whatever channel the policy names. This is not you informing on your borrower. It is you routing a question to the people whose job it is to answer it.

Do not disclose. This has a legal dimension covered in the callout below, and a practical one: if you tell the borrower, you have destroyed whatever the institution might have done, and if you tell the referral source, you may have told the perpetrator.

The three hard versions

What if the suspected party is your referral source? Escalate anyway. This is the moment the chapter is actually about. A referral relationship is worth real money — Chapter 38 puts numbers on it — and it is worth less than your license, which is not a close call and never has been. You may also be wrong, in which case the escalation resolves quietly and nobody is harmed.

What if it is a colleague, or your manager? Your company has a channel that routes around the person implicated; find it before you need it. Every regulator also accepts complaints directly.

What if you are wrong? You will be, most of the time, and that is the expected outcome. Good- faith escalation is what the system asks of you. Nobody's career has ended because they raised a question that turned out to be a retirement deferral in Box 1. Careers end on the other side of that ledger — on the question that was noticed and not raised.

⚖️ Compliance Check

The Suspicious Activity Report, and the rule people break by accident.

A Suspicious Activity Report (SAR) is a confidential report filed by a financial institution with the Financial Crimes Enforcement Network describing a transaction the institution suspects may involve fraud or other illegal activity. Institutions subject to the Bank Secrecy Act — including, since a rule effective in 2012, non-bank residential mortgage lenders and originators — must maintain an anti-money-laundering program and file SARs when the applicable criteria are met.

Four things a loan officer must know:

1. The institution files, not you. Your obligation is to escalate internally per policy. You almost certainly do not have access to file one and should not try.
2. SARs are confidential, and disclosure is prohibited. You may not tell the subject — or anyone outside the process — that a SAR has been filed or is being considered. This is the rule most often broken innocently, usually by an originator who tells the borrower "I had to report this," or who tells the agent why the file stopped. Say nothing. If a borrower presses on why the file is delayed, the answer is that the file is in review and you will follow up.
3. There is a safe harbor. Federal law provides institutions and their employees protection from civil liability for reporting suspicious activity in good faith. Good-faith reporting is protected; failing to report is not.
4. A SAR is not an accusation and not a finding. It is an information report. Many concern activity that turns out to be entirely lawful.

Requirements, thresholds, and program specifics change, and state law varies. Verify current obligations with your compliance department and your regulator; nothing here is legal advice.

27.12 The day-44 question: when is a surprise not a fraud?

Now the case that matters most, because it is the one you will actually live.

On day 41 of the Linden Street file, the borrowers walked into a furniture store and financed \$5,200.00** on a nine-month promotional plan at **\$611.00 a month. They did not tell the loan officer. On day 44, the pre-closing credit refresh — condition 11 on the approval, written on day 28, sixteen days before the event it was written to detect — found the new account. Back-end DTI went from 42.66% to 48.48%, the approval's DTI condition was blown, and the file stopped.

This is not fraud. Not close to fraud. And working out exactly why is the most useful thing in this chapter, because it is the analysis you will run in real time, under pressure, with a disappointed family on the phone.

🧮 Run the Numbers

What \$611.00 a month did, and why the balance was almost irrelevant.

Income is \$10,500.00 per month. Before day 41:

	Amount
PITI + MI	\$3,033.72
Other monthly debts	\$1,446.00
Total obligations	\$4,479.72

\$4,479.72 ÷ \$10,500.00 = 42.66%.

Add the furniture payment: \$4,479.72 + \$611.00 = \$5,090.72, and \$5,090.72 ÷ \$10,500.00 = 48.48%. The move is \$611.00 ÷ \$10,500.00 = 5.82 percentage points.

Now the part that surprises everyone. The balance was \$5,200.00 — 1.42% of the \$365,750.00 loan amount (\$5,200.00 ÷ \$365,750.00). A rounding error against the size of the transaction. But debt-to-income counts payments, not balances, and a nine-month promotional plan is designed to retire the balance fast: straight-line, \$5,200.00 ÷ 9 = **\$577.78 a month before any fees, and the creditor reported \$611.00**. A short term is precisely what turns a trivial balance into an enormous payment.

The resolution (Chapter 19 owns it) was to pay the account in full from reserves and document it: \$12,623.66 − \$5,200.00 = \$7,423.66**, and \$7,423.66 ÷ \$3,033.72 = 2.45 months of reserves, down from 4.16**. DTI returned to 42.66%. It cost four business days.

The lesson in one line: a \$5,200 balance on a nine-month plan hurt this file worse than either of the borrowers' car loans does — \$611.00 a month against \$487.00 and \$429.00 — because the file is priced on the payment, not on the balance.

Run the test

Whether something is fraud turns on three questions. Ask them in this order, every time.

Three noes. Not a close question, and any professional who calls this fraud has told you they cannot run the test.

Notice also what the account itself did. It reported to the credit bureaus in the ordinary course, in the borrowers' own names, at their own address, within days of being opened. Concealment requires an affirmative act of hiding, and these borrowers did the opposite of hiding: they created a public record of the transaction and left it in plain sight, where the control designed to find it found it on schedule. The system worked exactly as designed. Condition 11 was written for this and it caught this.

What would have made it fraud

Precision here matters more than any other paragraph in the chapter, because the same event can sit on either side of the line depending on what happens next:

• If, on day 42, the loan officer had asked "have you opened any new credit?" and they had said no — that is a false statement to the lender, made knowingly, about a material fact. The purchase was innocent; the answer would not be.
• If they had signed a final application at closing showing no new debt, knowing the account was open and unpaid — that is a false statement in a document the lender relies on. This is the one that catches decent people, because by then the file feels finished and signing feels ceremonial. It is not ceremonial.
• If they had asked a relative to take the account into their name, or had the store re-paper it, to keep it off the report — that is concealment, and the affirmative act is exactly what distinguishes it from what actually happened.
• If the loan officer had told them to pay it off and say nothing — then the originator has committed the offense, and would have done so on behalf of a borrower who never asked to commit a crime.

The distance between "not fraud" and "federal felony" here is one sentence spoken on one phone call. That is not a reason to be frightened of borrowers. It is a reason to make sure the honest path is always the obvious one — which brings us to whose failure this actually was.

The failure was the loan officer's

Say it without hedging: this was preventable and nobody prevented it.

The "do not open new credit, do not finance anything, do not change jobs" conversation is supposed to happen at application. On this file it did, on day 5, as item nine of a list of twelve things delivered to two first-time buyers on the same day they signed an initial disclosure package. Then nothing was said about it again. And look at the calendar: all nine prior-to-doc conditions cleared between day 29 and day 33, and then nothing happened on this file for eleven days. Day 33 to day 44 is the file's real failure, and the furniture was bought on day 41 — right in the middle of it, by two people who had heard nothing from their lender for over a week and reasonably concluded that everything was finished.

The fix is not more suspicion. It is a scheduled, specific, second conversation:

• Say it at application, in plain terms, with the reason attached — "a new payment changes the ratio your approval is conditioned on, and the lender re-checks your credit days before closing." A rule with a reason is remembered; a rule without one is item nine of twelve.
• Put it in writing, in the same document set, so it exists somewhere they can find it.
• Say it again when the file goes quiet, and again at conditional approval, and again the week before closing. Silence from the lender reads to a borrower as permission.
• Name the specific temptations out loud, because "new credit" is abstract and "furniture, a car, appliances, a store card for the new washer, and please do not co-sign for anyone" is not.

A pipeline discipline that puts a touchpoint into every quiet stretch would have caught this on day 36 with a phone call instead of on day 44 with a stopped closing. Chapter 39 builds that discipline. And it is worth noticing what the day-44 discovery actually cost: four business days, a payoff, a re-run of findings, and a household's reserves cut from 4.16 months to 2.45 — while these borrowers were, throughout, quietly shopping another lender with a lower quote. A loan officer who handles that call badly — who arrives sounding like an investigator rather than an advocate — loses the file, and deserves to.

The general rule

Most surprises are not fraud. They are communication failures, and most of the communication that failed was yours.

A borrower who does something inconvenient without knowing it was inconvenient has not deceived you. They have revealed a gap in what you told them. The professional response is to fix it in this file and close the gap for the next hundred — and to reserve the fraud analysis for the cases that actually pass the three-question test, so that when you do raise one, everybody knows you mean it.

🗂️ The Loan File

Chapter 27 contribution: the fraud review, and the disposition of the day-44 event.

Every file gets a fraud review whether or not anyone writes it down. This chapter's contribution is writing it down. Add to the Linden Street file a short, factual review memo covering the four events in the file that a reviewer would look at twice — and the disposition of each.

The three-question test, applied to the day-44 event:

What this settles: the file's integrity. Every fact in it has an independent verification behind it, every anomaly has a documented explanation, and the one late surprise passes the fraud test cleanly and is resolved on the record rather than papered over. That is what makes this a saleable file rather than a hopeful one.

What it does not settle: the loan officer's process. Nothing in this memo prevents the next borrower from doing the same thing on the next file. The correction is a communication schedule, not a suspicion.

Open questions carried forward:

• Q1. What did this file cost in days and dollars, and which of those days were avoidable? (Chapters 30 and 39)
• Q2. What is the complete, closed file worth as a business asset — and what did the loan officer actually earn on it? (Chapters 26, 38)

Your task. In Appendix C's workbook, write the fraud review memo for this file in fewer than 200 words, using only facts and dates, with no conclusions. Then write the two-sentence script you will use at application on your next file to prevent a day-41 furniture purchase — including the reason, not just the rule. Read it out loud. If it takes more than fifteen seconds, cut it until it does not.

Conclusion

Mortgage fraud sorts into two families that share a definition and almost nothing else. Fraud for housing is a misrepresentation by somebody who wants the house and intends to pay; it lives inside one file, it is caught by routine verification, and it is committed largely by people who would be appalled to be called criminals. Fraud for profit is a scheme to extract money, it requires multiple parties and nearly always an insider, and it is caught by pattern analysis across files rather than by scrutiny within one. Both are federal crimes.

Your own exposure is real and it is not primarily about lying. It is about willful blindness — the question you did not ask because you did not want the answer, which is visible in the file forever. The protection is not caution; it is documentation. Ask, in writing. Record the answer. Verify from a source the borrower does not control. A file that shows you asked is a defensible file even when the answer was a lie, because being deceived is a different thing from participating.

That last phrase — a source the borrower does not control — is the whole chapter compressed. It is the independent employer phone number in §27.4, the direct-source asset verification in §27.5, the appraisal ordered through the lender's channel in §27.8, the identity verification in §27.9, and, in §27.10, the phone call to a number from the contract rather than from the email. Fraud's entire project is to control which channel you use. Refuse to let it, and most of this chapter takes care of itself.

And then hold on to day 44. Two first-time buyers bought a sofa for a house they were about to own, told nobody because nobody had made it matter to them, and the control designed to catch exactly that caught it exactly on schedule. Three questions — false statement, concealment when asked, intent to deceive — and three noes. Not fraud. A communication failure, and the person who failed to communicate was the loan officer.

That asymmetry is worth carrying out of Part V. The rules in these four chapters exist because somebody's money is at risk and somebody's license is on the line, but the day-to-day work of complying with them is mostly the work of telling people the truth early, in language they can act on, and then writing down that you did.

Next: Part VI opens the machinery behind everything you have been quoting. Where does \$365,750 actually come from on the morning of day 51, who buys it, and why does a loan that meets every guideline in this book still have to be sellable? Chapter 28 follows the money out the back door.

Key Terms

Mortgage fraud — a material misrepresentation, misstatement, or omission relied on by a lender to fund, purchase, or insure a loan it would not have made, or would not have made on those terms, had it known the truth. (Ch.27)

Fraud for housing — misrepresentation by a borrower who intends to occupy the property and repay the loan; typically one or two parties, no insider, and caught by routine verification. Still a crime. (Ch.27)

Fraud for profit — a coordinated scheme to extract money from a mortgage transaction, typically involving multiple parties and an industry insider; caught by pattern analysis and post-closing quality control. (Ch.27)

Red flag — a fact or pattern inconsistent with the story a file is telling, requiring independent verification before it is relied on. A prompt to verify, never a conclusion about a person. (Ch.27)

Income and employment fraud — misrepresentation of the existence, amount, source, or continuity of qualifying income or employment; the most common form of fraud for housing. (Ch.27)

Occupancy fraud — representing a property as a primary residence or second home when the borrower intends another use, most often rental, to obtain better terms. Intent is measured at the time of the representation. (Ch.27)

Straw buyer — a person who applies for a mortgage and takes title in their own name for another party's benefit, typically for a fee, with the true beneficiary undisclosed to the lender. (Ch.27)

Silent second — an undisclosed subordinate lien, often a seller carryback, concealed from the first-lien lender; falsifies the borrower's actual investment and the combined loan-to-value ratio. Distinct from disclosed, approved subordinate financing such as down-payment assistance. (Ch.27)

Air loan — a loan on a fabricated transaction: a property, a borrower, or an entire chain of parties that does not exist, supported by counterfeit verifications. (Ch.27)

Appraisal fraud — material misrepresentation of a property's value or condition relied on by a lender; includes value inflation, fabricated or misappropriated reports, and property misrepresentation. (Ch.27)

Identity theft — use of another person's identifying information to apply for or obtain a mortgage; includes synthetic identity fraud, in which an identity is assembled rather than stolen whole. (Ch.27)

Wire fraud — inducing a party to transmit funds to an account controlled by a criminal using falsified payment instructions; in real estate, most often targeting a borrower's closing funds. (Ch.27)

Business email compromise (BEC) — the delivery mechanism for most real estate wire fraud: a compromised or spoofed email account inside the transaction, used to send altered instructions timed to the closing. (Ch.27)

Suspicious Activity Report (SAR) — a confidential report filed by a financial institution with the Financial Crimes Enforcement Network describing activity suspected to involve fraud or other illegal conduct. Filed by the institution, not the individual; disclosure to the subject is prohibited. (Ch.27)

Bank Secrecy Act / anti-money-laundering (AML) program — the federal framework requiring covered financial institutions, including non-bank residential mortgage lenders and originators, to maintain an AML program and report suspicious activity. (Ch.27)

False statement to a federally insured institution — the federal offense most commonly charged in mortgage fraud: knowingly making a false statement or report to influence the action of a federally insured institution on a loan. (Ch.27)

Willful blindness — deliberately avoiding confirmation of a fact one is aware is highly likely to be true; in broad terms it may be treated as knowledge, and it is the originator's most common route to liability. (Ch.27)

Spaced Review

1. (Ch.12 + Ch.27) A borrower's statements show a \$9,400 deposit eleven days before application. Name the Chapter 12 condition this generates, then state what makes the same deposit a fraud issue rather than a documentation issue.

2. (Ch.19 + Ch.27) Condition 11 on the Linden Street approval was written on day 28 and caught an event on day 44. Explain, in two sentences, why the condition is marked prior-to-funding rather than prior-to-docs, and connect that to the timing of the verbal verification of employment in condition 10.

3. (Ch.27) Run the three-question test on this: a borrower who told you in week two that they intend to occupy the property signs the closing package, moves in, and is transferred out of state nine weeks later, renting the home out. Fraud or not, and why?

4. (Ch.12 + Ch.27) The Harlow Street file carries a \$10,000 forgivable county second, producing a CLTV of 101.15%. A different file carries a \$10,000 seller carryback that nobody disclosed. Both are second liens for the same amount. Name every difference that matters, and say which one is a crime.

5. (Ch.19 + Ch.27) Your borrower calls three days before closing: "The title company emailed new wiring instructions — their bank changed. Should I send it today?" Write your exact reply in under forty words, and then name the one verification step that resolves it.