wire fraud at closing · title escrow — methodology

the first 10 minutes

1. preserve the spoofed escrow-instruction email — export full headers, not mailbox screenshot.
2. freeze the title file — pull qualia or title-software audit for wire-instruction changes before counsel calls the bank.
3. save the closing-packet docusign export — corrected actions after initial send are high-signal.
4. pull the outbound wire confirmation — MT103 or bank fednow message for beneficiary ABA/routing.
5. hash every pdf and csv before sharing with title insurer or FBI — evidence-manifest-generator first.
6. do not trust display-name on escrow email — compare routing numbers to prior wire on the same file number.
7. document the alta settlement line items vs wire purpose text — mismatch is a common fraud tell.
8. if funds already left, start bank recall separately — this page is evidence preservation, not recovery.

the path

preserve email headers → title audit → docusign revision → wire message → bundle. merge timelines in fatcousin-multi-tool-super-timeline-correlator when exports span multiple days around the wire date.

1. 1. evidence manifest generator

   inventory escrow email, wire pdf, title audit csv, docusign export, and swift message with sha-256 before insurer or law enforcement handoff.why first: closing fraud cases lose chain of custody when title staff email unhashed pdfs.

2. 2. email header analyzer

   spoofed escrow-instruction thread — authentication-results, received chain, reply-to mismatch vs known title agent domain.why second: intake says BEC because it started in email — headers separate spoofed escrow from generic vendor fraud.

3. 3. qualia title platform audit log forensic analyzer

   wire instruction bank change after file open · beneficiary ABA mismatch vs prior wire on same file · audit timeline.why third: title-software audit is the closing-specific signal generic BEC playbooks skip.

4. 4. docusign real estate closing packet cert chain analyzer

   ListAuditEvents-shaped export — Corrected actions on closing packet after initial send · cert chain on wire instruction pdf.why fourth: fraudsters push revised wire instructions through the same docusign envelope buyers already trust.

5. 5. swift mt message forensic analyzer

   MT103 fields — beneficiary institution · ordering customer · value date — matched against title file wire instruction.why fifth: proves what actually left the bank vs what the spoofed email claimed.

6. 6. case report generator

   bundle hashed exports into a pdf timeline for title insurer, counsel, or FBI ic3 supplemental.why last: one readable package for parties who were not in the wire room.

common false leads

• this is generic BEC — without alta settlement, title file number, or qualia audit, use BEC methodology instead.
• fednow alone proves fraud — pair fednow with title audit; rail message without file context is incomplete.
• docusign consumer envelope — closing-packet analyzer expects real-estate ListAuditEvents shape, not generic clickwrap.

what we can tell you, what we can't

we can tell you:

• wire instruction change and beneficiary mismatch flags in qualia-shaped audit exports
• docusign Corrected action timeline on closing packet exports
• MT103 field normalization for beneficiary vs file instruction comparison
• sha-256 evidence manifest for insurer or law enforcement packet

we can't tell you:

• recover wired funds — bank recall and insurer coverage are outside this tool
• pull live qualia or docusign tenant data — you supply exports only
• give legal advice on fault between title agent, lender, and buyer

reference investigation

handing it off

• title insurer / SIU: evidence manifest + finding csv + case report pdf.
• FBI / ic3 supplemental: MT103 copy + email headers + qualia audit excerpt with hashes.
• counsel: docusign revision timeline + alta line-item mismatch notes.

vertical hub: real estate title · compare: wire fraud at closing vs BEC