The payoff demand is a PDF nobody can authenticate
A servicer sends a payoff demand. The closing agent wires the amount to the account it specifies. Neither party can demonstrate that the document came from the servicer, because nothing about it is verifiable.
Can a closing agent verify a mortgage payoff statement?
Not in any practical way. A payoff demand instructs a six-figure irreversible wire and arrives as an unsigned PDF by email or fax. The agent can call the servicer and wait in a queue, compare it to a prior statement whose figures legitimately differ, or act on it.
- A payoff statement instructs a large irreversible transfer and carries no cryptographic authentication of its origin.
- The attacker's timing signal is public: credit inquiries and title orders reveal that a payoff is imminent.
- An issuer signature over the payoff figures and destination account makes the document checkable without contacting the servicer.
Part of Title, escrow and closing wires
The document's role
A payoff demand states the amount required to satisfy an existing loan as of a date, plus per-diem interest, and specifies where to send it. The closing agent relies on it completely: too little and the lien is not released, too much and funds must be clawed back.
It is, functionally, a payment instruction for a large sum. It is also, typically, an unsigned PDF.
How the attacker knows when
This attack does not require monitoring anyone's mailbox, although that helps. The timing is discoverable.
- Credit inquiries from mortgage lenders signal a refinance in progress
- Title orders and property records indicate a pending transaction
- Marketing data derived from those signals is commercially available
- The parties involved — servicer, agent, lender — are identifiable from public records
An attacker who knows a payoff is imminent can send a fraudulent demand at approximately the right moment, from a lookalike domain, to an agent expecting exactly that document.
Why verification is hard for the agent
| Check | Problem |
|---|---|
| Call the servicer | Payoff departments have long queues; the number may come from the document |
| Compare to a prior statement | Amounts legitimately change; accounts legitimately change after servicing transfers |
| Check the domain | Servicers use multiple domains and third-party processors |
| Verify the account | Servicer accounts are not publicly listed, for good reason |
| Rely on the document's appearance | Templates are easily replicated from genuine examples |
The servicing transfer point in row two deserves emphasis. Loans are sold and transferred routinely, so a legitimate change in payoff destination is a normal event — which removes the strongest anomaly signal an agent would otherwise have.
What an issuer signature provides
# Payoff demand, signed by the servicer's issuer key
{
"document": "payoff_demand",
"loan_number": "****4471",
"property": "1420 Fillmore Street",
"borrower": "[name]",
"good_through": "2026-04-15",
"principal": 412880.14,
"interest": 1842.09,
"per_diem": 61.40,
"fees": 125.00,
"total": 414847.23,
"remit_to": {
"bank": "First National Trust",
"routing": "021000021",
"account": "****8823",
"beneficiary": "[servicer entity name]"
},
"issued": "2026-03-29T11:04:00Z"
}
# Ed25519 signature; servicer's JWKS published at a well-known URLThe closing agent verifies against the servicer's published key. No phone call, no queue, no reliance on the document's appearance. A forged demand produces no valid signature.
Why this is a servicer problem to solve
The agent cannot fix it alone. Verification requires the issuer to publish a key and sign what it issues, which puts the work on the servicer for a loss that mostly falls on the agent and the borrower.
Three reasons a servicer should care anyway.
- Unsatisfied liens. When a payoff is diverted, the lien is not released and the servicer is drawn into the resulting dispute regardless of fault.
- Reputational and regulatory attention. Repeated diversions involving a servicer's documents attract examiner interest even when the servicer's systems were never touched.
- Operational load. Payoff verification calls are a substantial and growing volume, and a verifiable document removes most of them.
A realistic adoption path
Signing does not require anyone else to change. A servicer can begin signing payoff demands unilaterally; agents who can verify do so, and those who cannot still receive a normal PDF.
- Servicer publishes a JWKS at a well-known URL and signs its payoff demands.
- The signature travels as an embedded attachment or a companion file; the PDF is unchanged in appearance.
- Closing platforms add verification — a small amount of work, since the key is public and the check is offline.
- Title underwriters begin asking for verification status on high-value files, which is what drives the rest of the market.
Step four is how this becomes standard. Underwriter requirements move this industry faster than anything a technology vendor says.
Why the usual anomaly signal is unavailable
Loans are sold and transferred routinely, so a legitimate change in payoff destination is a normal event. That removes the strongest signal an agent would otherwise have, and it is why comparing to a prior statement does not work.
| Check | Problem |
|---|---|
| Call the servicer | Long queues; the number may come from the document |
| Compare to a prior statement | Amounts and accounts legitimately change |
| Check the domain | Servicers use multiple domains and third-party processors |
| Verify the account | Servicer accounts are not publicly listed, for good reason |
Objections and honest limits
“This is the servicer's problem to fix.” The loss mostly falls on the agent and the borrower, and the fix requires the servicer to sign. That misalignment is why it has not happened, and why underwriter requirements are the realistic forcing function.
“Servicers have no incentive.” Three: unreleased liens draw them into disputes regardless of fault, repeated diversions attract examiner attention, and payoff verification calls are a growing operational load a verifiable document removes.
A realistic adoption path
- Servicer publishes a JWKS and signs payoff demands. Unilateral; the PDF looks unchanged.
- The signature travels as a companion file. No change to existing workflows.
- Closing platforms add verification. Small work — the key is public and the check is offline.
- Underwriters ask for verification status on high-value files. Which is what moves the market.
Terms used here
- Payoff demand
- The servicer's statement of the amount required to satisfy a loan, including per-diem interest and remittance details.
- Servicing transfer
- The routine sale of servicing rights, which makes a changed payoff destination a normal event.
- Lien release
- The discharge recorded once a loan is satisfied — which does not happen if the payoff was diverted.
Frequently asked questions
How does an attacker know when to send a fraudulent demand? Credit inquiries, title orders and property records signal a pending transaction. The timing is discoverable without compromising anyone's mail.
Can't the agent just call the servicer? Payoff departments have long queues, and the number may come from the fraudulent document. It is also slow enough that agents skip it under time pressure.
Why can't the agent detect a changed account? Loans transfer between servicers routinely, so a changed payoff destination is a normal event. The strongest anomaly signal is unreliable here.
Why would a servicer adopt this? Unreleased liens draw them into disputes regardless of fault, examiners notice repeated diversions, and payoff verification calls are a growing operational load.
How does the attacker know when to send it? Credit inquiries, title orders and property records signal a pending transaction. The timing is discoverable without compromising anyone's mail.
Where this fits in Manav
Manav renders the wire or payoff details from a statement the issuer countersigned, has the payer sign on their own device, and puts a verifiable receipt on the file for the agency, the lender and the insurer.