Home / Solutions / Real EstateNew
Solutions · Real estate transactions

Six figures wired. Deed recorded. Consent verified.

Real estate is the largest single transaction most people will ever authorize — and once the wire settles or the deed records, the asset is gone. Closing wire fraud topped the FBI BEC categories at over $446M in 2022 reported losses; elder asset stripping moves properties off the books before family members know; coerced quitclaim deeds and predatory refinances clear in days. Each shares the same gap: the documents are valid, the signatures are real, the consent was not free. RTScale adds consent provenance to the moments that decide the transaction — at the bank's wire authorization, at the title company's closing table, at the remote online notary's signing surface.

$446M+
FBI IC3 reported losses to real-estate wire fraud / BEC, 2022 — the category has grown in subsequent years.
47states
U.S. jurisdictions with permanent Remote Online Notarization statutes — the surface where deed and mortgage consent now happens.
$300K+
FinCEN Residential Real Estate GTO reporting threshold in covered jurisdictions for all-cash purchases via legal entities.
01 · The threat landscape

Three attack patterns. One shared gap.

Real estate transactions have many moving parties (buyer, seller, lender, title, escrow, notary, agent) and many high-value signing moments. Attackers and bad actors exploit the points where consent is procedurally documented but evidentially thin.

Threat 01 · Wire fraud

Closing-wire BEC.

Attacker compromises or spoofs the title company's email, sends "updated wire instructions" to the buyer days before closing. The buyer wires six figures to the attacker's account. Within hours, the funds route through mule accounts and are gone. The buyer's signature on the wire authorization is real; the consent was based on a fabricated email.

FBI IC3 · CFPB advisory · 2022–2025
Threat 02 · Asset stripping

Elder property exploitation.

A caregiver, neighbor, or new "friend" influences an elderly homeowner into signing a quitclaim deed, reverse mortgage, or below-market sale. The notary public sees a valid ID and a willing signer. The family discovers the transfer months later — sometimes after the elder has died. The signature is the elder's; the consent often is not free.

AARP · state APS programs · 2024 NAELA report
Threat 03 · Origination pressure

Predatory refinance & foreclosure rescue.

Vulnerable homeowners facing foreclosure are approached by "rescue" operators offering to take title in exchange for a lease-back. Or refinance pitches arrive at moments of financial stress, with terms not understood until later. The TILA/RESPA paperwork is signed; the borrower's understanding at signing was, by the standard of any honest disclosure obligation, incomplete.

CFPB enforcement · state AG actions
02 · A worked example

Sarah & Mark, three days from closing on their first home.

$487,000 due at closing. A phishing email two days before settlement. A bank's wire authorization flow that catches it. A title-company signing surface that verifies the real consent the next day. Two integration points; one transaction saved.

Time
Buyers & counterparties
RTScale · system signal
T-7dunder contract
Under contractSarah & Mark sign the purchase agreement on a $487,000 home. First American Title (illustrative) handles closing. Loan Estimate issued. Settlement date set for T+0.
Not yet engagedLoan Estimate carries title company identifying details — payee name, routing, account — into the buyer's bank's expected-payee record. This becomes the reference for §03's verification.
T-3d · 14:32phishing
The phishing email arrivesSarah receives an email apparently from First American Title with "updated wire instructions, please use these for closing." Email signature, formatting, and grammar all look correct. Routing/account numbers point to "Coastal Financial Services Inc." A note of urgency: "These must be used or closing will be delayed."
Out of bandEmail is the attack vector. Bank does not see the message. Sarah and Mark have no reason yet to suspect; the email passes their casual visual inspection.
T-1d · 09:15wire setup
Sarah opens her banking app to send the wire$487,000 outbound wire. New payee: Coastal Financial Services Inc. Sarah enters the routing and account numbers from the email. Adds memo: "Closing settlement — 1247 Oak Lane."
High-value wire policy firesBank's wire authorization flow includes SoM Sig for high-value outbound wires (per the Banking integration). 30-second Deep Scan begins as Sarah reviews the wire confirmation screen.
T-1d · 09:1730s scan
Sarah pauses, but proceedsSomething feels off; she re-reads the email; she taps "Confirm wire." Throughout, her eyes move repeatedly between the email and the banking app. She reads the routing number aloud, comparing. Her shoulders are tense.
Indicators above thresholdSustained micro-distress (above Sarah's session baseline); scripted-speech prosody (re-reading dictated numbers); gaze instability between apps. Consent clarity: borderline. Borderline · review
T-1d · 09:18cross-check
Bank's risk engine cross-referencesThree signals converge: (1) high-value wire above customer baseline; (2) new payee with no prior history; (3) payee name Coastal Financial Services Inc. does not match the title company name First American Title recorded in the Loan Estimate that this account holds on file; (4) SoM borderline consent.
Step-up required, 24h holdWire is held. Sarah's screen reads: "We've paused this wire briefly. The recipient does not match the title company listed in your Loan Estimate. Please verify by calling the number on your original closing documents — not by replying to email." 24h hold
T-1d · 09:42verify
Sarah calls the real title companyUsing the number from the loan paperwork (not the email), Sarah reaches First American Title. They confirm: no updated wire instructions were sent. The earlier email was a phishing attempt. They re-send the correct instructions through their secured client portal.
DocumentedBank receives confirmation from Sarah of the phishing attempt. Wire to Coastal Financial Services Inc. permanently cancelled. SoM signature retained as evidence; phishing report initiated.
T-1d · 10:15report
Phishing reported and containedSarah forwards the phishing email to her bank's fraud team and to First American Title. The title company alerts its other in-process closings and law enforcement. Sarah's wire is rescheduled with the verified instructions for closing day.
One incident, three filingsBank BSA report, title company ALTA incident log, FBI IC3 referral. All draw from the single SoM signature and the documented payee mismatch.
T+0 · 09:00closing day
Closing morning at the title companySarah and Mark arrive (or join via the title company's RON platform). Wire instructions verified directly with the title company; wire authorized through the bank; funds received in escrow. The signing surface — deed, mortgage, closing disclosure — opens.
Title company's own SoM signingThe title company integrates RTScale at the signing surface. Each of Sarah and Mark provides a Quick Scan at the deed signing — a Presence + Confirmation class signature attesting to their clear consent at the moment of execution.
T+0 · 13:00recorded
Deed recordedClosing completes. Deed sent to county recorder. Property formally changes hands. Sarah and Mark receive keys.
Closing record sealedTitle company's case file retains two SoM signatures (one per signer) bound to the deed transaction hash. Available for E&O insurance, future title disputes, or family/estate inquiries. Cryptographic erasure of biometric provenance available to each signer at any time.
T+30dretention
Documentation archivedBank retains wire-side evidence per BSA records. Title company retains closing-side evidence per ALTA Best Practices. Sarah and Mark have, in retrospect, a record of the moment they almost lost their down payment — and the moment they actually became homeowners.
Two integration points, one transactionThe bank caught the wire fraud. The title company documented the genuine consent. Each integration is independent; together they cover the full real-estate transaction surface.
03 · Five use cases

Where SoM Sig fits across the real estate stack.

Different parties, different signing moments, different regulatory framings. The signature primitive is the same; the integration point and policy varies.

01

Closing wire fraud & BEC

CFPB Bulletin 2017-01 · BSA · ALTA Best Practices · FBI IC3

The flagship case for real estate wire authorization. Bank-side SoM at the moment of wire confirmation, cross-referenced with title-company payee data from the Loan Estimate. Sarah & Mark's case in §02 is the worked example — the same pattern applies to any closing wire above policy threshold.

Trigger High-value wire + payee mismatch
Capture 30s Deep Scan during wire confirm
Outcome 24h hold + verified-channel callback
Integration Bank-side (primary) + title (secondary)
02

Elder real estate asset stripping

State elder abuse statutes · APS reporting · NAELA frameworks

Quitclaim deed signings, reverse mortgage originations, and below-market sales involving signers above an age/vulnerability threshold get Engagement-mode SoM capture at the notary or closing surface. High-confidence undue-influence indicators trigger 72-hour cooling-off, senior-notary or in-person review, and pre-registered trusted-contact outreach. Pairs with the Wealth Management protocol from /solutions/wealth-management.

Trigger Elder-flag profile + property transfer
Capture 30s Deep Scan at signing
Outcome Cooling-off + senior review + APS path
Integration Title + notary + RON platform
03

Remote Online Notarization consent attestation

State RON acts · MBA model RON standards · NNA guidance

RON platforms (Notarize, Proof, Stewart Title, others) integrate SoM at the consent step — after identity verification, before document signing. The notary's standard "are you signing freely, of sound mind, without duress" verbal exchange becomes evidence-backed instead of attested-only. State-by-state RON acts vary; the signature provides documentation portable across them.

Trigger Notary's free-will exchange
Capture ~200ms Quick Scan, Presence + Confirmation
Outcome Attestation evidence + audit chain
Integration RON platform (primary)
04

Mortgage origination & refinance signing

TILA-RESPA Integrated Disclosure · CFPB · State origination acts

High-stakes signing moments in mortgage origination — first-time buyer signing, cash-out refinance, reverse mortgage, HELOC — capture SoM at the disclosure-acknowledgment step. Particularly load-bearing for products like reverse mortgages and HELOCs that have outsized predatory-pitch surface area. Documents the borrower's understanding at the moment of execution rather than relying on signed acknowledgment alone.

Trigger High-risk-profile origination signing
Capture 30s Deep Scan during disclosure
Outcome Acknowledged-understanding evidence
Integration Lender (primary) + e-signature platform
05

Foreclosure rescue & equity stripping

CFPB · State foreclosure rescue acts · FTC Mortgage Assistance Relief Services Rule

Homeowners facing foreclosure are uniquely vulnerable to "rescue" operators who take title in exchange for promised lease-backs. The transaction is documented and signed; the borrower's understanding at signing is the disputed element in subsequent litigation. SoM at the deed transfer in foreclosure-context contexts provides retrospective evidence for both the homeowner's later recovery efforts and the legitimate operator's defense against false claims.

Trigger Foreclosure-context property transfer
Capture 30s Deep Scan + 72h hold default
Outcome Mandatory cooling-off + counsel referral
Integration Title + state foreclosure mediation
04 · Integration patterns

Five integration points. One transaction lifecycle.

Real estate is a multi-party transaction. SoM Sig fits at each party's signing surface — independently authoritative, jointly comprehensive. Most design partners start with one integration and expand.

Title & escrow companies

Pattern 01 · Primary
The natural center of the real estate transaction. Title companies orchestrate closing and hold the most consequential signing moments — deed, mortgage, closing disclosure. SoM at the signing surface (in-person or RON) produces consent-provenance for the title insurance retention period and beyond. Title-side capture is the single most leverage-rich integration in the stack.
First AmericanStewartOld RepublicFidelity NationalALTA members

Banks · wire authorization

Pattern 02
Already an integration target for general bank-fraud use cases. The closing-wire scenario from §02 demonstrates how the existing banking SoM integration applies directly to real estate wire fraud — cross-referencing payee name against Loan Estimate data is the killer signal. Buyer's bank is the natural choke point for closing-wire BEC defense.
Tier-1 retail banksCredit unionsMortgage-affiliated banks

Remote Online Notarization platforms

Pattern 03
RON has consumed an increasing share of real estate notarizations across 47 states. The notary's "free and voluntary act" verbal exchange becomes the SoM capture moment — same camera frame as the existing video notarization session. The platform integration adds a structured attestation layer on top of the existing audio-video recording.
NotarizeProofStewart RONNotaryCamDocVerify

Mortgage lenders & origination platforms

Pattern 04
SoM at disclosure-acknowledgment and at signing. Particularly load-bearing for reverse mortgage origination, HELOC origination, and refinances in foreclosure-context borrowers. Drops into existing e-signature flows (ICE Mortgage Technology, Blend, others) at the moment of borrower acknowledgment.
ICE / EncompassBlendRocketWholesale lenders

Real estate brokerages & iBuyers

Pattern 05
Seller-side protection, particularly for vulnerable populations. iBuyer instant-purchase platforms and brokerages handling pressure-laden sales (estate sales, divorce sales, foreclosure-context sales) capture SoM at the offer-acceptance and seller-disclosure moments. Coercion or undue-influence indicators trigger the brokerage's existing senior-supervisor review escalation path — a documented escalation rather than an informal one.
OpendoorOfferpadNational brokeragesBoutique & estate specialists
05 · Regulatory readiness

What the signature documents, by rule.

Real estate regulation is unusually federated — federal frameworks, state-by-state notary acts, industry standards bodies, jurisdiction-specific elder statutes. The signature is portable across them because it documents an observable affective fact, not a regulatory interpretation.

Framework
Jurisdiction
What RTScale provides
CFPB Bulletin 2017-01 Closing-related wire fraud advisory
US · Federal
Documented buyer-side wire authorization with cross-referenced payee verification. Bank-side artifact supporting the "reasonable steps to verify" expectation in the CFPB's wire fraud guidance.
ALTA Best Practices Title company operational standards
US · ALTA members
Pillar 3 (escrow controls) and Pillar 5 (information security) documentation. Signing-surface SoM attestation as part of the closing case file. Aligned with the ALTA Insured Closing Protection Letter framework.
FinCEN Real Estate GTOs Geographic Targeting Orders
US · Covered jurisdictions
Beneficial owner identification reporting for all-cash residential purchases via legal entities at the $300K+ threshold in covered metros. SoM signature supports beneficial-owner attestation by the natural-person signers.
State RON acts Remote Online Notarization statutes
US · 47 states
Documented "personal appearance + free and voluntary act" attestation. Portable across state-by-state RON act variations; survives interstate recognition challenges.
TILA-RESPA Integrated Disclosure TRID · Loan Estimate · Closing Disclosure
US · Federal
Documented borrower acknowledgment of Loan Estimate and Closing Disclosure at the moments mandated by Reg X / Reg Z. Disclosure-acknowledgment evidence beyond a signed checkbox.
State elder abuse statutes e.g., CA WIC 15630.1, NY EAA, FL § 415
US · State-by-state
Documentation supporting mandatory APS reporting for elder property transfers. Reasonable-grounds language portable across state variations of mandatory-reporter obligations.
Uniform Real Property Transfer on Death Act State adoption: 30+ states
US · State-level
Capacity-relevant decision documentation for TOD deed executions. Not a clinical capacity ruling — supplemental evidence for the existing capacity-attestation chain in state probate procedure.
GDPR Article 17 Right to erasure
EU + UK signers
Cryptographic erasure of biometric provenance on signer request. Signature chain remains for the title company's E&O retention and state probate record requirements; underlying capture rendered unverifiable.
06 · Review questions

What title operations, lender compliance, and RON platform owners ask.

From conversations with title-company operations leaders, mortgage compliance counsel, RON platform engineering, and state-level elder-protection coordinators.

Q1 Where should we integrate first — title company, bank, or both?

It depends on which side you're operating on. For title companies, the closing-surface integration (Pattern 01) is the natural starting point — your signing moments are where consent provenance has the highest leverage. For lenders, mortgage-origination signing (Pattern 04) is typically first. For banks, wire authorization (Pattern 02) folds into the existing bank-side SoM integration; real estate is one of several use cases that integration serves. You don't need all five patterns in place to derive value — each is independently authoritative. Most design partners ship one integration in v1.0 and expand from there.

Q2 Will this slow down closings? Closings are already complex.

At the signing surface: no. Quick Scan latency is ~200ms p95; the notary or settlement agent's verbal "are you signing freely" exchange becomes the capture window — no separate step, no app switch. For the bank-side wire authorization, the 30-second Deep Scan happens during the existing wire-confirmation review screen, which buyers typically read for longer than that anyway. The friction the system adds is in the cases where it should add friction — when the SoM indicators show distress, scripted speech, or payee mismatch. Those cases get a 24-hour hold; the rest proceed as today.

Q3 How does this work with Remote Online Notarization platforms specifically?

RON platforms already host an authenticated video session with the signer and the commissioned notary; that same camera frame is the SoM capture surface. The integration sits at the consent step — after the platform's standard ID verification (typically a credential analysis + knowledge-based authentication), before document signing. The notary's required free-will verbal exchange becomes the capture moment. We have reference integrations in progress with two leading RON platforms; the SDK is also designed to work with proprietary RON stacks at title companies that build their own.

Q4 What about foreign buyers and FinCEN GTO reporting?

FinCEN's Residential Real Estate GTOs (and the rule that replaces them in 2026) require beneficial owner identification for all-cash purchases via legal entities at the $300K+ threshold in covered jurisdictions. SoM Sig at the natural-person signer's attestation moment supports the beneficial-owner certification — the signature provides documented consent provenance from the actual natural person, hardware-attested, distinguishable from a remote signer-of-convenience. Especially load-bearing for cross-border transactions where in-person notarization isn't practical and RON via a foreign-jurisdiction signer is the path.

Q5 How does this integrate with our title insurance and E&O coverage?

The signature artifact lives in your case file with the rest of the closing documentation, retained per ALTA Best Practices for the policy's effective period. Title insurance underwriters and E&O carriers we've spoken with have been receptive — the signature reduces the unquantified-consent exposure that drives a meaningful share of post-closing forgery and undue-influence claims. We're not making coverage-pricing claims yet (the data needs more closings to be credible), but conversations with several underwriters are ongoing.

Q6 Reverse mortgage origination — different integration than forward mortgages?

Same integration pattern, different policy. Reverse mortgages have outsized predatory-pitch surface area and an exclusively elder borrower base — both factors that warrant elevated SoM policy at signing. Standard Deep Scan at HUD-required counseling completion attestation, again at the closing disclosure acknowledgment, again at the deed-of-trust signing. Three signatures, one origination. The borrower's understanding at each moment is independently documented.

Q7 State-by-state variation — how do we handle 50 different RON acts and elder statutes?

The signature documents observable affective indicators — those don't vary by state. What varies is the policy applied to those indicators (cooling-off length, reporting obligations, who gets notified) and the language of the documentation. Our compliance library ships state-specific policy templates and documentation language as configurable artifacts. We don't claim to be a 50-state legal authority — the firm's compliance counsel reviews and approves the policy for each jurisdiction in which it operates. We provide the substrate; the firm decides the policy.

Q8 All-cash deals — any different integration story?

All-cash deals lose the lender-side integration point but gain prominence on the title-company and bank-wire integrations. They also disproportionately surface FinCEN GTO reporting (Pattern 03 + Q4 above), beneficial-owner attestation, and source-of-funds questions. The title company's role becomes correspondingly more central — they are often the only institutional party in the chain who sees both buyer and seller. SoM at the title company's closing surface is the highest-leverage single integration for all-cash deals.

See the integration

Bring your closing process. We'll show you where the signature fits.

Title operations leaders, lender compliance, RON platform engineering — a 30-minute working session walks through your specific signing surface, your existing case-file structure, and the one or two integration points that would yield the most consent-provenance leverage in your stack. No deck. Your closing, our SDK, working signatures.