Comment by 293984j29384
6 days ago
What sensitive data do you think is on a loan estimate? I've received a dozen over the years and it's literally just your name and the address of the property you want to buy. Both of which are public information if you do purchase the property.
We're talking about enough information to create a list of people who are in the process of making the largest purchase of their lives, coupled with the name of the businesses that they're considering sending money to and the exact dollar amounts that they're considering sending.
Scammers pay a lot of money to people who can get them those kinds of lists.
Except that's not how it works. You don't pay the mortgage company, you pay the seller.
As others have mentioned, title fraud. My recent closing disclosure has buyer, seller, agent, and title company. It'd be pretty easy to call the buyer claiming to be the title company and request a wire for exactly the right amount to a fraudulent location.
I'm skeptical anyone here has actually bought a house. That's not how it works at all.
Because every country has agreed on a standard procedure
1 reply →
Public info that you bought a property is entirely different from info about all the properties you are searching for and seriously considering. Especially being able to couple that with what you eventually did later.
If you're uploading a loan estimate you've already made a loan application for a specific house- this isn't going to give them information on every house you were considering, it is probably just the single house which accepted your offer and are shopping around for financing.
Why would a name and a random property address have value before the transaction, but not after it?
Well, one is before they spend a lot of money, and the other is after. In only one of those scenarios are they prone to spear-phishing wire fraud on the Title deposit. The victim is already primed, and has indicated they have gobs of money set aside.
You are also signalling that you have enough money to buy said house and are actively in the process of doing so which makes you a mark. And if there is a whole DB of this info readily available...
Anyways the security could be fine. But if a user's primary action is uploading that document then maybe wanna have more than a quick sentence on it.