# The fraud in the file, and the page that proves it *Mortgage fraud* > Income, asset, occupancy, identity, contract, collateral and servicing fraud — the schemes Sei targets and the signal in the file that gives each away. **Most mortgage fraud is not one forged page. It is a file where every page looks fine on its own and the pages disagree with each other.** A reviewer reads documents one at a time, against a checklist. Fraud lives between them: in the copy of a statement that differs from the other ten, the earnings record dated the same day as a charge from a paystub generator, the landlord insurance policy on a home the borrower swore they would live in. Sei reads every page of the file, tests each one on its own arithmetic and on the file behind it, then sets every document against every other — and cites the page for each finding. ## Who commits it, and what it leaves behind - **Fraud for housing** — A borrower shades the truth to get a home they mean to live in: income rounded up, a gift that is really a loan, a debt left off. It is most of the fraud a lender sees and the file usually disagrees with itself — the paystub and the deposits do not match, the 1003 and the credit report do not match. - **Fraud for profit** — Organised and deliberate: straw buyers, inflated values, cash back at closing, an investor posing as an owner-occupant. It is less of the volume and most of the loss. The file is built to look clean, so the signal is in what the documents say about each other — and about the people on them. - **Documents made to order** — The supply chain behind both. Paystub and statement generators sell fabricated documents for a fee, and generative editing tools change a figure in seconds. These documents are internally consistent by construction; they give themselves away in the file behind the page, in arithmetic that only looks right, and in the purchase showing up on the borrower’s own bank statement. ## The fraud we target Each signal is read from the loan file — the documents, the files behind them and the third-party reports already in it. ### 1. Income and employment *Origination · Servicing* — The borrower earns less than the file says, works somewhere else, or does not work at all. **What it looks like** - A paystub or earnings record bought from a generator, or a real one with the gross and net retyped - A verification of employment recreated by the borrower, with a phone number routed to someone they know - A pension or award letter with one digit changed - An employer that is a shell the borrower controls - In servicing, the same tools used to fabricate hardship income for a modification **What gives it away** - Social Security withholding that is not 6.2% of the wages, or Medicare that is not 1.45% — a forger rarely gets both right, and almost never handles the wage base - FICA withheld from retirement income, which is not subject to it - Year-to-date pay that does not follow the pay cadence, and net pay that never appears as a deposit - A charge to a paystub generator on the borrower’s own bank statement, dated the same day as the document - An employer identification number that is malformed, or differs between the paystub, the W-2 and the verification - Income rebuilt three ways — from the documents, the tax records and the deposits — and the spread between them reported ### 2. Assets and down payment *Origination* — The money to close is not there, is not the borrower’s, or came from someone with an interest in the sale. **What it looks like** - A statement balance edited up, or a deposit inserted, on one copy of a statement - A statement fabricated to look like a real bank’s - Borrowed funds parked in the account long enough to look seasoned - A gift letter for money that has to be paid back - A deposit from the seller, the listing agent or the builder, outside closing **What gives it away** - A statement that does not foot — opening balance plus credits minus debits does not reach the closing balance - A statement whose closing balance is not the next month’s opening balance - Duplicate copies of the same statement compared line by line, so the one altered copy is set beside the genuine ones under the same transaction reference - Large deposits sourced and classified, and any that trace to a party in the transaction named - Assets stated on the initial application, the final application and the verification compared, with every version shown ### 3. Undisclosed debt and accounts *Origination* — Obligations the borrower left off the application, which change what they can afford. **What it looks like** - A private or family loan with no tradeline - A mortgage on another property the borrower did not declare - An account at another institution left out, along with what moves through it **What gives it away** - Recurring debits on the bank statements that match no liability on the application or the credit report - Transfers to and from accounts the application never mentions - Properties on the tax return’s rental schedule or in the title documents that are missing from the real estate owned - Payroll deposits from an employer the application does not list ### 4. Occupancy *Origination · Servicing* — An investor buys as an owner-occupant to get a better rate, a lower down payment or a program they are not eligible for. **What it looks like** - An occupancy affidavit signed by a borrower who plans to rent the home from day one - A departing residence declared as retained while it is listed for sale - A landlord insurance policy bought alongside the homeowner’s binder the lender sees - After closing, the home rented out and the policy renewed as a rental **What gives it away** - Two hazard policies on the same property, one of them a rental-dwelling or landlord form - A rental listing for the subject property in the file, with the borrower’s own phone number on it - A departing residence that a listing in the file shows for sale - An occupancy affidavit whose signature is a pixel copy of the borrower’s signature from another document - In servicing, a renewal declaration on a landlord form for a loan closed as a primary residence ### 5. Identity *Origination* — The borrower is not who the file says, or is a straw buyer for someone who is not on it. **What it looks like** - A synthetic identity, or a stolen one - A credit privacy number presented as a Social Security number - A straw buyer with no stake in the transaction, funded by someone else **What gives it away** - Name, date of birth, Social Security number and address compared across the application, the ID, the credit report, the W-2 and the tax documents - Identity verification and credit-report alerts already in the file read and reconciled, rather than left in an attachment - A borrower whose funds all come from a third party and whose income does not explain the purchase ### 6. Fabricated and edited documents *Origination · Servicing* — Any document in the file altered after it was issued, or never issued at all — including the edits generative tools now make in seconds. **What it looks like** - A real PDF edited and saved again - A figure covered with a white box and retyped - A digit or signature copied from elsewhere on the page - A document generated end to end, employer and all - A photo with something removed or a lawn made greener **What gives it away** - Revision history inside the PDF, where the original values often still sit beside the edited ones - The software that last saved the file — a bank statement saved by a PDF editor, an earnings record saved by a word processor - Text under a white box, still present in the text layer of a page that looks clean - A character or signature identical pixel for pixel to one elsewhere in the file - Provenance marks generative tools write into a file, and the noise pattern they leave around an edited region - Misspellings, impossible dates and arithmetic that a real issuer’s system does not produce ### 7. Contract, closing and wire *Origination · Servicing* — The transaction is not what the lender was shown: a different price, money moving outside closing, or funds sent somewhere they should not go. **What it looks like** - A purchase price changed after signing - A seller rebate to the buyer outside closing, written into an addendum - Cash back at closing disguised as a repair or consulting payment - A change of wire instructions days before closing or payoff **What gives it away** - Price, credits, loan amount and cash to close tied out across the contract, the appraisal and the Closing Disclosure - A price in figures that no longer matches the price in words, and revision history that shows when it changed - Money from the seller or an agent on the bank statements that the Closing Disclosure does not show - Payees on the Closing Disclosure resolved against the parties to the loan - Wire instructions and payoff requests checked against the parties and contacts already on the file ### 8. Collateral and valuation *Origination* — The property is worth less than the file says, or is not in the condition it says. **What it looks like** - An inflated value supported by distant or dissimilar comparables - Defects disclosed in the narrative while the condition rating stays clean - Photos edited, or taken from a prior listing - A quick resale at a price the market does not explain **What gives it away** - Comparable distances and adjustments read from the appraisal and set against the AVM and collateral reports already in the file - Every defect named in the appraiser’s comments reconciled against the condition rating and the as-is basis - Photos compared with the ones elsewhere in the package, and checked for edited regions - Prior sale date and price set against the current price, with the gap explained or flagged ### 9. Participants *Origination* — Someone on the file who should be independent is not — the agent, the gift donor, the employer, the appraiser. **What it looks like** - A gift donor who is also the seller’s agent - An employer whose phone number is the borrower’s or the agent’s - A non-arm’s-length sale presented as arm’s-length - A participant on an exclusion list **What gives it away** - Every name, address, phone and email on every document resolved into one list of participants, and the overlaps named - Exclusion-list and license screening results in the file read, with each name hit resolved to the same person or a different one - A relationship stated in one document and denied in another ### 10. Servicing schemes *Servicing* — Fraud on a loan already on the books — to get a workout, take the equity, or redirect the money. **What it looks like** - A loss mitigation package with fabricated income, statements or a templated hardship letter - A deed transferred to a third party or a new LLC while the loan is delinquent, and rent collected without payments made - A short sale to a buyer connected to the seller, resold soon after at a higher price - A payoff request or wire change from someone who is not a party to the loan - A hazard claim or loss draft supported by photos from somewhere else **What gives it away** - The origination document tests run on every hardship package — withholding, footing, revision history, generator charges - Recorded deeds read as they arrive, and a transfer during delinquency flagged - Buyer, seller and agents on a short sale resolved against each other - Payoff requests and wire instructions checked against the contacts already on the loan - Claim photos compared with the ones already in the file ## How a finding is made ### 1. Every page, every copy Loan files carry the same statement four times and nobody reads all four. Sei AI's fraud agent reads every page — the duplicates, the attachments embedded in a PDF, the borrower’s uploads — because the altered copy is usually the one nobody compared. ### 2. Each document against itself The arithmetic a real issuer’s system cannot get wrong: statements that foot and chain from one month into the next, withholding that matches the wages, year-to-date pay that follows the cadence, a price in figures that matches the price in words. ### 3. The file behind the page Revision history, the software that last saved it, text hidden under a box, characters copied pixel for pixel, and the marks generative tools leave. These are read from the file the borrower uploaded, before anything flattens it. ### 4. Every document against every other Occupancy against the insurance form and the listings in the file. Income against the deposits. The contract against the Closing Disclosure. The people on one document against the people on the rest. Most fraud is only visible here. ### 5. A finding, cited, with a severity Each check returns fail, review or pass, with the pages behind it and the rule it breaks. A review is not a fail: distant comparables are a question for the underwriter, an altered statement is a finding. What passes is listed too, so a reviewer can see what was checked. ## Two desks, one for each end of the loan - **Fraud Agent** (/for-lenders/fraud-agent) — Tests every document in the file for fabrication and alteration, and every figure for misrepresentation, before the loan funds — each finding cited to the page. - **Fraud Manager** (/for-servicers/fraud-manager) — Tests the documents that reach servicing — hardship packages, insurance renewals, recorded deeds, payoff and wire requests — for fabrication and misrepresentation, each finding cited to the page. ## Further reading on mortgage fraud - [How to Spot a Fake Paystub or W-2 With Arithmetic: The Withholding Math Forgers Get Wrong](/blog/fake-paystub-w2-detection-fica-withholding-math-mortgage-underwriting) - [The Forged Document Problem AI Made Worse, and the Detection Desk That Answers It](/blog/ai-document-fraud-detection-synthetic-altered-paystubs-bank-statements-red-flags-rule) - [Mortgage Fraud Detection at Origination: What an AI Agent Can Flag, What It Cannot Decide, and Where the SAR Obligation Starts](/blog/ai-mortgage-fraud-detection-origination-misrepresentation-fincen-red-flags) - [Straw Buyers, Synthetic Identities and CPNs: Detecting Mortgage Fraud When the Borrower Is Not Who the File Says](/blog/straw-buyer-synthetic-identity-cpn-mortgage-fraud-detection) - [Dual Contracts, Hidden Seller Credits and Cash Back at Closing: Mortgage Fraud in the Transaction Itself](/blog/dual-contracts-seller-concessions-cash-back-closing-mortgage-fraud) - [Appraisal Fraud and Illegal Property Flipping: Detecting Inflated Values Before the Loan Funds](/blog/appraisal-fraud-property-flipping-fha-anti-flipping-rule-detection) - [Mortgage Fraud After Closing: Loss Mitigation Fraud, Equity Skimming, Short-Sale Flopping and Payoff Diversion](/blog/mortgage-servicing-fraud-loss-mitigation-equity-skimming-short-sale-payoff) --- _Source: [https://www.seiright.com/blog/guides/mortgage-fraud](https://www.seiright.com/blog/guides/mortgage-fraud) · Sei AI_