{"success":true,"data":{"id":"mortgage-escrow-shortage-phish","label":"Fake mortgage servicer claiming an escrow analysis identified a shortage and requiring payment via email link or the monthly mortgage payment will increase significantly next month — credential-harvest and payment-diversion fraud; real escrow shortage notices are delivered by USPS under RESPA requirements and through authenticated servicer portals.","description":"Fake mortgage servicer (impersonating Wells Fargo Home Mortgage, Chase Mortgage, Mr. Cooper/Nationstar, PHH Mortgage, loanDepot, Rocket Mortgage, or generic \"Mortgage Servicing\") claiming an annual escrow analysis has identified a shortage and requiring the homeowner to pay the escrow shortage amount via email link or their monthly mortgage payment will increase significantly starting next month — credential-harvest and payment-diversion fraud targeting homeowners. Real escrow shortage notifications are delivered by mortgage servicers via authenticated online portal and USPS first-class mail under RESPA (12 USC 2609 / Regulation X) requirements, which mandate written disclosure; cold emails with \"escrow analysis identified shortage — pay via link or your monthly payment increases next month\" are payment-diversion attacks. Annual escrow analysis is a routine event all homeowners expect, making this lure highly plausible. Distinct from realestate-earnest-money-wire-fraud (earnest money / closing pretext) — this targets the annual escrow analysis / escrow shortage identified / pay shortage amount or monthly payment increases pretext. Detection: escrow shortage/escrow analysis + pay shortage + or monthly payment increases next month vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R29; CFPB mortgage escrow guidance; RESPA 12 USC 2609; FTC mortgage servicer impersonation advisory 2025; CISA real estate wire fraud patterns.","tier":"danger","category":"phishing","isThin":false}}