wire fraud at closing · title escrow
homebuyer wired to fraud account — spoofed escrow-instruction email · closing-packet pdf revision · qualia/docusign audit · MT103 wire message. distinct from generic BEC — alta settlement and title file number in evidence.
entry point: qualia title platform audit log forensic analyzer. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- qualia title platform audit log forensic analyzerdrop qualia activity log · wire instruction diff · shield prior-wire · runs locally
- docusign real estate closing packet cert chain analyzerdrop docusign listauditevents export · alta/cd doc roles · closing correction chain · runs locally
- swift mt message forensic analyzerdrop swift mt103 / mt202 / mt940 messages · parse beneficiary + correspondent + amount · runs locally
- email header analyzerpaste raw email headers · trace hop-by-hop routing · SPF · DKIM · DMARC · detect spoofing · visualize delivery path · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- email thread reconstructordrop multiple .eml files · Message-ID References In-Reply-To tree · missing parent flags · flat timeline · CSV export · runs locally
- pdf author and revision metadata deep analyzerdrop pdf file · extract all document information dictionary and xmp metadata · parse creation and modification timestamps · surface author software version revision count and producer chain · runs locally
- pdf digital signature chain analyzerdrop pdf file · extract and analyze all digital signatures · validate signature structure · reconstruct certificate chains · surface signer identity timestamps and what content was signed · runs locally
- fednow payment message forensic analyzerdrop fednow iso20022 message export · parse instant credit + return reason codes · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: wire fraud at closing · title escrow — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.