Mortgage File Fraud: 6 Documents Borrowers Doctor Most

Mortgage fraud sounds like an organized-crime problem, and sometimes it is. But the bulk of it is quieter: a borrower who needs the debt-to-income ratio to work, a loan officer who needs the file to close, a "credit repair" consultant who knows which PDF to edit. The FBI classifies much of this as fraud for housing — misrepresentation by borrowers to acquire property (fbi.gov) — and nearly all of it runs through documents. Six of them, mostly.

Key takeaways

• Most mortgage fraud is document fraud: edited pay stubs, bank statements, employment letters, and tax forms assembled to pass underwriting ratios.
• Each document type has a characteristic manipulation — inflated income, erased liabilities, invented deposits, fabricated employers.
• Cross-document consistency is the strongest manual check: the same income must reconcile across pay stub, W-2, bank deposits, and the employment letter.
• File-level forensics catches what ratio math can't — the numbers can be internally consistent and still sit in a freshly edited PDF.

1. Pay stubs

The workhorse fake. Gross pay nudged upward, year-to-date totals recomputed (or, in sloppy fakes, not recomputed — YTD that doesn't equal rate × periods is the classic tell). Template-generated stubs from paystub-maker sites carry their own fingerprints: generic layouts, rounded tax withholdings that match no real table, and PDF metadata naming the generator. We've covered the pattern in depth in fake pay stubs.

2. Bank statements

Two goals: inflate the balance for reserves, or hide the liabilities and NSF history. Edited statements fail on internal math — running balances that don't reconcile line to line — and on typography, where an inserted deposit sits in a slightly wrong font or spacing. A statement is a ledger; every line constrains the next. That structure is why fake bank statements are among the most detectable forgeries when anyone actually checks the arithmetic.

3. Employment verification letters

A letterhead, a title, a salary, a signature — and no anchor to reality. Fraudulent VOE letters invent employers entirely or inflate title and tenure at real ones. The countermeasure is source verification: call the employer through a number you found independently, never the one on the letter. (More on this genre in an upcoming post — it deserves its own.)

4. Tax documents

Fabricated W-2s and doctored returns inflate income with a form that looks authoritative. But tax forms are the most cross-checkable documents in the file: the IRS income verification process exists so lenders can match claimed returns against filed ones (irs.gov). A borrower who resists income verification consent is telling you something. The visual tells mirror the fake W-2 patterns we've catalogued before.

5. Gift letters

Down-payment gifts that are actually loans, from "relatives" who are actually interested parties. The letter itself is trivial to fabricate; the check is the money trail — the gift should be traceable to a donor account with a plausible history, not a same-day pass-through deposit.

6. Occupancy and identity exhibits

Utility bills and IDs supporting a claim that the borrower will occupy the property (owner-occupied loans price better), or supporting a straw buyer's identity. Address documents are cottage-industry fakes — the same economy we documented in proof-of-address fraud.

The reconciliation habit

The single best manual defense costs fifteen minutes: reconcile income across exhibits. Pay stub gross × 26 should approximate the W-2. Net pay should appear as recurring deposits on the bank statement, on the right dates, in the right amounts. The VOE letter's salary should match both. Fraudsters rarely fabricate the full constellation consistently — they fix the one document underwriting flagged and leave the others contradicting it. Consumer-side guidance from the CFPB covers the borrower-facing version of these schemes (consumerfinance.gov).

Where the file check fits

Everything above assumes the numbers are wrong somewhere. The harder case is the borrower who edited carefully — consistent math, plausible amounts, clean visuals. What survives careful editing is the file itself: modification timestamps after the statement date, consumer-editor traces in a bank-issued PDF, fonts subsetted twice, a "scan" that was never scanned. Running every income and asset exhibit through an automated forensic document check before underwriting reads the numbers is the cheap way to catch the careful ones — and it's the check the careless ones fail instantly.