Mortgage / Refinance Rate Scam

How This Attack Works

Scammers send emails or mailers impersonating legitimate mortgage lenders offering refinancing at impossibly low rates. To lock in the rate, victims pay upfront application, appraisal, or closing cost fees. After collecting fees, the lender becomes unreachable. Some variants steal personal and financial information to commit identity theft or apply for credit in the victim's name.

Red Flags to Watch For

• ✗
  Advertised rate is significantly below current published market rates
• ✗
  Offer arrived unsolicited with no prior relationship to the lender
• ✗
  Upfront fees are required before any loan approval or paperwork is formalized
• ✗
  Lender cannot be verified through the NMLS Consumer Access registry
• ✗
  No physical office address, phone number, or licensed loan officer name provided
• ✗
  Pressure to commit immediately or lose the rate offer

Known Malicious Domains

These domains have been associated with this attack. Never click links going to these addresses.

• low-rate-refinance-now.comMALICIOUS
• mortgage-rate-alert.netMALICIOUS
• refinance-offer-apply.comMALICIOUS
• home-equity-unlock.netMALICIOUS

Glance automatically blocks emails from domains on this list. Domain list is not exhaustive — attackers register new domains continuously.