Mortgage QR Code Scam: What It Is and What to Do

The three types of mortgage QR code scams

1. Closing cost wire fraud

This is the highest-stakes variant. Scammers monitor or compromise email threads between buyers, real estate agents, and title companies. Shortly before closing, they send a fraudulent email — mimicking the title company's real email address — with "updated wire instructions." The email may include a QR code to "confirm your wiring details" or verify the transfer amount before sending.

The QR code leads to a convincing fake portal collecting your bank account and routing number. Victims wire five- or six-figure down payments to the scammer's account. Wire transfers are nearly impossible to recover once they leave your bank, especially after a few hours.

2. Fake refinance offers

Mailers, texts, and emails with QR codes promise homeowners a lower interest rate or better loan terms. Scanning the code leads to a fake application portal that collects your Social Security number, income details, and bank account information — enough to open fraudulent credit accounts or initiate unauthorized transfers.

These scams spike when real interest rates shift. The offers look genuine — they include real lender logos, estimated monthly savings, and your approximate property value pulled from public records.

3. Mortgage servicer impersonation

Scammers send emails or texts claiming to be from your actual mortgage servicer — Wells Fargo, Chase, Mr. Cooper, Rocket Mortgage, or whoever holds your loan. The message claims a payment update is required, your account needs reconfirmation after a system upgrade, or autopay has been disrupted. The included QR code leads to a credential-harvesting page.

Once attackers have your servicer login, they can change autopay bank accounts, submit fraudulent payoff requests, or access detailed personal and financial information on file.

What your lender or title company would never do

Legitimate mortgage lenders, servicers, and title companies do not send unsolicited QR codes for:

• Wire transfer instructions or payment confirmation
• Loan account verification or identity checks
• Rate adjustments or refinance application intake
• Autopay setup or banking detail updates

The universal rule for closing day: Wire instructions for a real estate closing are always provided by your title officer or closing attorney — and they should always be verified by calling them directly at a number you find independently (not one provided in an email). Real wire instructions never change via email at the last minute. If you receive a last-minute "updated" wiring notice, call before you transfer anything.

What to do right now

If money was wired to a fraudulent account:

1. Call your bank immediately. Ask them to issue a domestic wire reversal or SWIFT recall. Provide the recipient bank name, routing number, and account number from the wire confirmation.
2. Contact your title company or real estate attorney. They need to know the closing is at risk and may have additional fraud recovery contacts at the receiving institution.
3. File a report with the FBI at IC3.gov. The FBI's Internet Crime Complaint Center handles real estate wire fraud and can coordinate with financial institutions.
4. Contact your state attorney general's consumer protection division. Many states have dedicated real estate fraud units.
5. Report to the FTC at reportfraud.ftc.gov.

If you entered login credentials but no money was transferred:

1. Change your mortgage servicer password immediately on a clean device.
2. Call your servicer's fraud line and ask them to flag your account and require verbal verification before processing any payment changes.
3. Monitor your account daily for autopay changes, unauthorized payoff quotes, or address update requests.

For a complete checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.

How to protect yourself before closing

• Verify wire instructions by phone, every time. Before any real estate wire transfer, call your title officer directly at a number from the title company's official website — never from an email or a QR code.
• Use QRsafer to preview any QR code before tapping. It checks the destination URL against threat intelligence before your browser opens anything. A phishing mortgage portal will not clear a safety check.
• Treat last-minute wiring changes as red flags. Scammers use timing pressure to prevent verification. Legitimate title companies expect you to verify.
• Never submit SSN, routing numbers, or full account details through a QR code. Legitimate loan intake happens through verified lender portals you access directly — not through links in texts or emails.

For a broader guide on bank and financial QR scams, see bank QR code scam. For the specific patterns used by major mortgage servicers' impersonators, see Wells Fargo QR code scam.

Frequently asked questions