Seller Impersonation and Deed Fraud: What a Title Office Should Check

What is seller impersonation fraud?

Seller impersonation fraud is when a criminal poses as the real owner of a property, hires a real agent and a real title company, and sells land they don’t own. The buyer pays, the fraudster takes the proceeds, and the actual owner finds out later. Deed fraud is the wider family: forged or fake deeds used to take or sell property. Seller impersonation is the version that comes through your front door as a normal order.

The FBI’s June 2026 alert lays out the playbook. Criminals “create fake identifications (drivers licenses and/or U.S. passports), Outlook email addresses, and Voice over Internet Protocol (VoIP) generated phone numbers and use them to impersonate landowners.” They pull owner details from county websites, data brokers, stolen accounts, and the dark web. Then they “contact a local realtor and title company, pose as the property parcel owner,” and ask for the money to go to a co-conspirator attorney in another state.

It is getting more common. ALTA’s Seller Impersonation Fraud Study, released September 2026 from 245 title professionals, found 59% of firms reported at least one attempt in 2025, “more than double the 28% reported in ALTA’s 2024 study.” Among firms with an attempt, one-quarter had a paid claim. Half of those reporting amounts said their average claim cost was over $100,000.

How does it reach a title company?

It reaches you looking like a clean file. That’s the problem. The property is usually one nobody is watching. In ALTA’s study, 82% of respondents named vacant land as a frequent target. Vacation homes (51%), rentals (48%), agricultural land (36%), and primary residences (25%) were all up from 2024. Nearly three-quarters flagged absentee owners, 68% flagged properties owned free and clear, and more than half flagged property belonging to someone recently deceased.

No mortgage means no lender payoff, so nobody else in the chain is checking who the owner is. An absentee owner won’t see the sign in the yard. And a seller who “lives out of state” explains why everything happens by email, text, and a notary in another city.

The fraudster also brings real information. 87% of ALTA’s respondents named spoofed contact information as a common part of attempts. The study also notes fraudsters using the owner’s real birth date, Social Security number, and financial details. Nearly six in ten said deepfaked voice or images are becoming common. Your closer can’t catch this by just being careful on the phone.

What are the red flags?

The most reported red flag in ALTA’s study was a seller who avoids meetings, phone calls, or video. After that: mail-away signings with the seller’s preferred notary, cash deals, no mortgage on the property, a below-market price, and odd behavior in conversation.

The FBI alert adds a few more worth posting at every desk:

• The seller only uses email, text, or VoIP numbers and won’t meet, citing illness, travel, or an emergency.
• Pressure to close fast, sometimes with a below-market price to get it done.
• The seller knows little about the property or is missing basics like a survey or tax information.
• Proceeds requested by international wire, to an account in a different name, or to an account somewhere unrelated to the property.
• A deed notarized in a foreign country, or other unusual documents.

One flag is a reason to look. Three on the same file is a reason to stop.

How do you verify a seller you'll never meet?

You verify them through a channel you found, not one they gave you. Every phone number, email, and ID in the file came from the person you’re trying to verify. If they’re a fraudster, all of it checks out.

ALTA’s respondents rated these tools highest: identity verification systems (92%), direct contact with sellers through independently verified channels (90%), multifactor authentication (89%), approved notary networks (88%), and knowledge-based authentication (86%). In practice that looks like:

• Find the owner yourself. Look up the mailing address on the tax record and reach out there. The FBI’s own tip for buyers is to “send a certified letter to the address of record on the land tax record to verify legitimacy of seller.”
• Run ID verification on the seller, not just a photo of a license. A scan of a fake license looks exactly like a scan of a real one.
• Use your notary, not theirs. If the seller can’t sign in person, the signing goes to a notary from your approved network.
• Get on video. A seller who won’t, for any reason, goes on the stop list until someone senior signs off.
• Match the payee to the owner. Proceeds go to an account in the seller’s name, verified by phone to a number you found independently. No exceptions for “my attorney handles my money.”
• Ask questions the record can answer and a stranger can’t. How they got the property, what’s on it, who pays the tax bill.

Some counties also offer free recording alerts to owners. Ours is the Knox County Register of Deeds Fraud Alert Program. It doesn’t help you verify a seller today, but it’s worth handing to every buyer at closing.

Where does IT fit in?

Most of this is process, and process belongs to the title agent. Nobody’s firewall decides whether a seller is real. But IT decides whether the process holds up on a busy Friday, and whether your own systems become part of the fraud.

Here’s the split as I see it for title companies:

• Process (yours): the verification checklist, who can override it, the notary network, the stop-the-file rule.
• IT (ours): the email system that every one of those steps runs through. Enforced MFA across the tenant, not just enrolled. DMARC, SPF, and DKIM so nobody can spoof your domain to the buyer’s agent. Monitoring for the forwarding rules and inbox filters attackers set up to hide a thread.
• Both: writing it down. The verification steps live in a documented procedure, the procedure lives in the file, and staff are trained on it.

Seller impersonation and business email compromise are different crimes that end the same way: money wired to the wrong person. We stopped one of the second kind for a title company and wrote it up in our BEC wire fraud incident report. The fix there was a phone call to a known number before the wire moved. Same rule applies here.

What this looks like when we do it

We haven’t published a seller impersonation case. What we do publish is how we run IT for title and escrow offices:

• Enforced MFA, tenant-wide, checked on day one of every account we take over.
• Email authentication and filtering, plus monitoring for the mailbox rules and odd sign-ins that show up in a compromise.
• Your out-of-band verification steps written down as a procedure, so the new closer follows the same one as the 20-year veteran.
• Staff training on closing-day social engineering.
• Documentation of the controls for ALTA and underwriter review.

That runs on our managed IT baseline: month-to-month, 24/7 monitoring, and under 15 minutes response on anything critical.

If you want a second set of eyes on how your office verifies sellers and protects the inbox around it, get in touch and we’ll walk through it on a call.