How to Spot a Fake Payoff Letter

What a Fake Payoff Letter Actually Is

A payoff letter, also called a payoff statement or payoff quote, is the lender's statement of the exact amount required to retire a loan in full as of a specific date, and where to send it. Title and escrow companies request one before a home sale or refinance closes. Auto dealers and refinance lenders request one before they pay off a vehicle loan on a trade-in or a new note. The letter names the borrower, the loan number, the principal, accrued interest, a per diem that keeps the figure current past the good-through date, any fees, and the remittance instructions.

For mortgages, the obligation to issue that statement is written into federal rule. Regulation Z, 12 CFR 1026.36(c)(3), requires the creditor, assignee, or servicer of a consumer credit transaction secured by a dwelling to provide an accurate statement of the total outstanding balance as of a specified date, within a reasonable time and in no case more than seven business days after a written request from the consumer or someone acting for the consumer. A creditor that no longer owns the loan or the servicing rights does not issue it. The current servicer is the issuer, which matters when the letter arrives from a name the file has never seen.

Fake payoff letters come in two production classes. Edited-after-creation starts with the servicer's genuine statement and changes the bank, the routing number, the account number, the beneficiary name, or the total after the servicer produced the file. Every other field stays correct. Generated-from-scratch starts with a template or a logo and impersonates a servicer, sometimes for a loan that exists and sometimes for one that does not.

The edited class is the expensive one. The U.S. Secret Service warned title companies, in an advisory published by the American Land Title Association, that criminals impersonate mortgage lenders and send fictitious or altered payoff statements so that the settlement agent wires the payoff to an account the criminal controls. The loan stays open. The servicer never received the money, and the gap often surfaces only when the borrower's next payment comes due on a loan everyone believed was closed.

Why Payoff Fraud Rides on Email Compromise

Payoff fraud is mostly a delivery problem before it is a document problem. Payoff statements travel by email, fax, and portal between servicers, title agents, attorneys, dealers, and borrowers, and any compromised inbox in that chain can intercept a real statement, edit it, and forward it on. The page that lands looks like every other payoff from that servicer because it was one.

The scale shows up in the FBI's numbers. The FBI's 2025 Internet Crime Report logged 24,768 business email compromise complaints with $3,046,598,558 in reported losses, and 12,368 real estate complaints with $275,110,419 in losses, up from 9,359 complaints and about $173.6 million in 2024. The same report describes a buyer closing on a home who wired more than $449,000 after an email impersonated the buyer's attorneys. Those categories are broader than payoff letters, and IC3 does not break out payoffs on their own, so treat them as the environment, not a rate.

The same pattern runs through any closing that pays a third party by wire. A fake wire confirmation lies about a payment that already happened. A fake payoff letter lies about where the next payment should go. Both depend on the receiver trusting a forwarded PDF over a channel the sender controls.

Tells That Still Work, and the Ones That Don't

Logos, fonts, and layout catch a crude template from someone who has never seen that servicer's statement. They do not catch the servicer's own statement with the remittance block edited. A phone number on the letter catches nothing, because whoever edited the instructions chose the number too.

The tells that survive a clean layout compare the letter to something the sender did not supply. Remittance instructions that differ from the account the title company or dealer has paid that servicer before. A follow-up email announcing that the servicer has "updated" its wiring details. A beneficiary name that does not match the servicer. An international routing code on a domestic payoff, which the Texas Land Title Association's guidance on counterfeit mortgage payoffs calls a major red flag. A figure that does not reconcile with the last mortgage statement plus the per diem.

The most dangerous version passes every arithmetic check. The principal, interest, and per diem are the servicer's own numbers. Only the account moved.

How Detection Actually Works

Detection that holds up reads the file's story before it reads the page, through six classes of signal.

Production method asks how the bytes were made. A payoff statement generated by a servicing platform carries that pipeline's structure. A file last saved in a desktop PDF editor, rebuilt from a screenshot, or assembled by a generative tool carries a different one. Edited-after-creation and generated-from-scratch are separate findings, because a real servicer file can sit underneath a later edit, and that is exactly the payoff fraud pattern. Timestamp trail asks whether creation and modification times cohere with the statement date and the good-through date. PDF metadata analysis is one input here, not the verdict, because faxed and re-scanned payoffs add benign noise.

Issuer matching asks whether the claimed servicer is the current servicer of record and whether the remittance details belong to it. Consistency sets the letter against the rest of the file: the loan number on the mortgage statement or title commitment, the borrower name, the property, the last balance, the per diem arithmetic. Model artifacts ask whether generative tooling or an image-only rebuild removed the production story. Recycled patterns ask whether the same remittance account, signature block, or exact file has appeared on another closing under a different servicer's name. One title officer sees a few dozen payoffs a week. A portfolio check sees the same diverted account on every one of them.

The file checks settle what happened to the PDF. They do not settle whether the servicer's real account changed last month. That question still belongs to a phone call.

What to Do With a Suspect File

A flagged payoff letter is a hold on the wire, not a rejection of the closing. Request the payoff directly from the servicer through a channel the file did not supply: the servicer's published payoff line, its portal, or a payoff desk your team has used before. Ask a narrow question: what is the payoff for this loan number as of this date, and to which account. Leave every phone number and email on the letter unused. The Secret Service advisory says the same thing in plainer terms: obtain payoff statements independently, restrict wires to previously verified accounts, and pay by check when the information cannot be verified.

When the servicer's answer and the letter disagree, record the field that failed: a beneficiary account that differs from the servicer's confirmed instructions, a modification after the statement date, a total that does not reconcile. Keep the original file and the email it arrived on. Leave the failed signal out of any message to the borrower or the sending party, since that inbox may be compromised. If a wire has already gone out, call the sending bank immediately to request a recall and file with IC3, and treat it as a wire fraud event rather than a paperwork error.

Payoff letters rarely travel alone. In a refinance file they sit beside bank statements, pay stubs, and a mortgage statement, and loan document fraud detection treats that package as one case. Check a document in the Watchdoc playground before the wire is released, so the x-ray is on file when the servicer calls back. The first file is free, and no email is required.

Where Sphinx Fits

Watchdoc scores the file and shows the x-ray: production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns. Published figures are a 94.3% correct verdict, 2.8x more forgeries caught, clean files cleared in under 28 seconds, and a review path 54% less expensive, across 1 million documents processed, at $0.45 per document with no seats and no platform fee. The Watchdoc playground runs the same check for free, including a 50-document free tier. The servicer's callback settles where the money belongs. The x-ray settles whether someone touched the file on its way to the closing table.

Frequently Asked Questions