HELOC Scams in 2026: 7 Red Flags and How to Protect Your Home Equity

The Fraud Has Moved to Where the Equity Is

If you're picturing a HELOC scam as a lender talking you into a bad rate, widen the picture. Bad terms exist, and comparing lenders is the right defense against them. The fraud that drains home equity today works differently. Someone steals enough of your identity to open a line in your name, or someone hijacks the email chain at your closing and redirects the money. Neither one cares what rate you were quoted.

The complaint numbers point the same way. Real-estate-linked fraud complaints reached at least 12,368 in the most recent annual FBI Internet Crime Complaint Center report, with more than $275 million in reported losses, figures the National Association of REALTORS® (NAR) summarized from that report. A year earlier it was $173 million across 9,359 complaints. The peak, three years before the latest report, was $397 million across 11,727 complaints, so losses fell for a stretch and are climbing again. I read those figures the way I read a pipeline report. The trend tells you where to put your attention.

Home equity scams show up at three different points, and each one needs a different defense. The first target is you, the homeowner, before any application exists, while a criminal assembles your identity from public records. The second target is the closing, where money is in motion and one spoofed email can redirect it. The third target is the line itself, where a fake lender sells you an approval that never existed, or a real line gets opened by someone who isn't you. I've organized the seven red flags by those three targets, because the habit that stops one does almost nothing against the others. At AmeriSave, my team's job is to verify income, credit, and assets against documents and third-party data before anything closes.

What a Legitimate HELOC Looks Like From the Inside

Most scams imitate one piece of a legitimate process and skip the rest, so it helps to know what the whole thing looks like.

A HELOC moves in two halves. Your loan officer's job is to find the right program for what you're trying to do with your equity. Operations takes it from there. When I moved into operations, my first mandate was overseeing the vendors that verify a borrower's income, employment, and assets, including through the Day 1 Certainty pilot we ran with Fannie Mae. The philosophy we built the team around was turning documents into data: a pay stub, a bank statement, and a credit report stop being paper and become facts an underwriter can decide on.

That sequence matters for spotting fraud, because a real lender can't skip it. Income, credit, and assets get verified first. The third-party items follow: title work on your property, a payoff demand if there's an existing lien (the statement of what it takes to pay that lien off), and a valuation of the property. Then come the Regulation Z disclosures, including the notice of your right to cancel, which Red Flag 7 covers. Then the closing gets scheduled, documents get signed, and funds move, often by wire.

Every step in that chain leaves a record, and at AmeriSave the file gets reviewed at each one. A criminal can imitate a single link, say a lender's letterhead or a title company's email address. Imitating the whole chain is much harder, and each flag below points at the piece that's missing.

Target One: Your Identity, Before Any Application Exists

Criminals build a fake owner identity from information pulled off county and state public records, data brokers, phishing, and stolen data, then pose as the owner to a real estate professional and route the proceeds to accounts they control. That's the mechanism the FBI's Internet Crime Complaint Center lays out in a public service announcement on what it calls parcel owner impersonation. The documented cases involve sales of property, often vacant land, rather than a HELOC opened on an occupied home. I'm citing it because it describes the mechanism plainly. Your ownership is a public record, and a criminal holding that record plus enough of your identity can transact against your property. The common label for this is home title theft.

Red Flag 1: Your Home Is Free and Clear and Nobody Has Looked at the Record in Years

If you've paid off your mortgage, or you're close, you're the profile this fraud is built for. A home with no lien on it has plenty of equity to borrow against, and with no servicer sending monthly statements, nothing routine would surface a change to the record. There's nothing wrong with owning your home outright. It does mean you're the only one watching.

In my years on the operations side, the way I most often see a title record surprise a homeowner has nothing to do with crime. A prior refinance was supposed to remove an ex-spouse from title and never fully did. The vesting problem (vesting is who holds title, and how) sits there for years and surfaces at the worst time, when the homeowner needs clean title fast, and sometimes the title company that handled the old paperwork no longer exists to answer for it. That's a process failure rather than a scam, and it teaches the same lesson. A record can sit wrong for a long time when nobody's looking at it.

The defense is to look. Pull up your county's land records (the office might be called the recorder, the register of deeds, or the county clerk) and search your own name and address. If your county offers a free automated alert that notifies you when a document is recorded in your name, the FBI recommends enrolling, and so do I. Many county offices offer one and some don't yet, so ask yours.

Red Flag 2: A Credit Inquiry, Lender Letter, or Recorded Document You Didn't Start

A HELOC opened in your name by someone else leaves tracks, because a lender that pulls credit and records a lien generates paperwork. A hard inquiry on your credit report from a lender you never contacted, a welcome letter or disclosure package for a line you didn't apply for, and a recording notice for a document you never signed are all the same flag. A file exists somewhere with your name on it and your signature missing.

See How Much Cash You Qualify For

Our AI calculates your top personalized loan options in minutes.

Calculate My Options

If you see one of those, treat it as a live file. Call the lender named on the letter, using a number you find independently rather than one printed on the letter, and ask a specific question: "Is there an open application or line in my name, and what address and phone number are on it?" The contact details matter, because if someone else opened the file, the address and phone number on it won't be yours, and that mismatch is your evidence when you report it.

The defense that sits in front of this flag is a credit freeze. I'll walk through it in the defenses section, because it's the one procedural step that blocks a new line before it exists.

Target Two: The Closing, Where the Money Moves

Identity fraud is slow. HELOC wire fraud at the closing is fast, and it's the mechanism both the CFPB and NAR describe when they talk about real estate wire fraud. A criminal compromises or spoofs the email of a title company, closing agent, real estate agent, or attorney, then sends wiring instructions that route funds to an account the criminal controls, sometimes as a last-minute change. If you're bringing funds to a HELOC closing to pay off an existing lien, or you've been asked where the line's proceeds should be deposited, the account details in that exchange are what the criminal wants.

Email is never a secure way to send financial information, and the CFPB states that as a plain rule. For a closing, the working version is that email is where instructions arrive and the phone is where they get confirmed.

Red Flag 3: Wiring Instructions Arrive by Email or Change at the Last Minute

Instructions arrive by email, or corrected instructions arrive by email after the originals. Every case in the CFPB's and NAR's descriptions starts that way. The message looks right because it may come from a real mailbox that's been compromised, or from a lookalike address. A legitimate closing team will have told you in advance how instructions will be delivered and how they'll be confirmed. If they arrive any other way, or if they change, stop.

The decision rule is the one we give at AmeriSave: call the person back on a phone number you already had before the transaction started. Your original loan documents have one. The number in the email doesn't count, and the number in the email signature doesn't count either, because the criminal may have written both.

Red Flag 4: You're Being Pressed to Send Funds Before You Can Make One Call

The email lands near the closing date and references the right property and the right people, and it makes a delay sound expensive. Pressure to move fast is on the FBI's list of impersonation red flags, and it runs through the closing-scam pattern too. That urgency is doing the criminal's work. The one call that would catch the fraud takes five minutes, and the scam depends on you not having five minutes.

A real closing team has no problem with you pausing to verify. A verification call to the title company or to your lender costs a real transaction a few minutes. It costs a fraudulent one everything. If anyone on the other end objects to you making that call, the objection is the flag.

Red Flag 5: The Receiving Account Name Doesn't Match the Company You're Closing With

Funds for a closing go to the settlement or title company's account, in that company's name. Wiring instructions to an account under a different name are on the FBI's list of impersonation red flags, and this one is the easiest to check. If the instructions name an individual, a business you've never dealt with, or a company whose name is close to your title company's but spelled differently, stop and confirm by phone before anything moves.

Before closing, identify two trusted contacts in the transaction and agree on a phone number for each; that's the habit the CFPB recommends. When it's time to move money, confirm the receiving account name and account number by phone on that agreed number. The words are simple: "I'm calling to confirm wiring instructions. Please read me the account name and the last four digits of the account number." If what they read doesn't match what you have, hold the wire and sort out which version is wrong first.

Target Three: The Line Itself

The third target is the HELOC as a product: the criminal either sells you a line that doesn't exist or opens a real one in your name. The second version is identity theft, and the credit freeze handles it. The two flags in this group are about the first version, an advance-fee scam dressed in lending language, because it's the one that asks for your participation.

Red Flag 6: Approval Is Promised Before Anyone Pulls Credit, or a Fee Is Due Before Funding

No legitimate lender guarantees approval before checking your credit report and your application, and the FTC says so directly. A demand for a fee before the line is funded, framed as insurance, processing, or paperwork, is the hallmark of an advance-fee loan scam, and it's illegal for a telemarketer to promise you a loan and ask for payment before delivering it. The FTC's summary is short: don't pay for a promise.

Check the order of events. In a real file, income, credit, and assets get verified first, and approval follows the verification. A legitimate lender, AmeriSave included, can't call you approved before that work is done, because nobody knows yet. Legitimate HELOCs can carry costs, and you'll see them in writing in the disclosures on a file that's been through verification. A fee demanded as the price of releasing an approval you never applied for is a different thing entirely. A caller who leads with "you're already approved" and follows with "we just need the processing fee to release the funds" has reversed the sequence, and the reversal is the scam.

If you've been offered a HELOC by phone or email and you didn't start the contact, ask one question: "What did you review to approve me?" A real lender can describe the credit pull and the documents. A scammer describes the fee.

See Your Top Loan Options In Minutes

Get Started

Red Flag 7: The Offer Skips the Disclosures and the Three-Business-Day Right to Cancel

A HELOC on a home you already own is open-end credit secured by your principal dwelling, and Regulation Z gives you a right of rescission on it. You can cancel until midnight of the third business day after the last of three events: the transaction itself, delivery of the two required rescission notices, and delivery of all the material disclosures. The lender has to give you two copies of a notice that describes the security interest it's taking in your home, your right to rescind, how to exercise it, what happens when you do, and the date the period expires. This applies to a line placed on a home you already own. A loan that finances the purchase of the home itself works under different rules.

A scammer skips this paperwork, because the paperwork takes time and hands you an exit. If you're being walked toward signing anything on a HELOC and nobody has mentioned a cancellation right or given you disclosures, you're missing the part of the process a regulated lender can't leave out. AmeriSave, like every HELOC lender bound by Regulation Z, delivers those notices. If you haven't received them, ask for them before you sign anything, and if they don't appear, walk away.

If you've already signed with a lender you now doubt and you're inside the three business days, the right of rescission is your exit. Follow the instructions on the notice to exercise it, then start the reporting steps below.

The Defenses Are Procedural

None of the seven flags gets solved by shopping rates, and I say that as someone who works for a lender that would like your business. The defenses are habits. Do the hard things first is the principle I run my teams on, and it applies here without much translation. What I see most often is the easy thing done first: comparing rates and reading offers, with the freeze and the record check treated as paperwork that can wait. Run it the other way. Freeze and check first, and the rate conversation gets easier once nobody else can open a line in your name.

Check the County Record Twice a Year

Search your county's land records for your name and address twice a year, and more often if your home is free and clear or sits empty for part of the year. If your county's recorder offers a free alert when a document is recorded in your name, enroll. Availability varies, so ask your county rather than assuming. If a document shows up that you didn't sign, that's the moment to start the reporting steps below, before anyone borrows against it.

Freeze Your Credit at All Three Bureaus

A security freeze is free to place and free to lift at each of the three nationwide credit bureaus, Equifax, Experian, and TransUnion. While it's in place, no new creditor can open an account in your name, a HELOC lender included, until you lift it. It has no effect on your credit score. When you want to apply for credit yourself, you lift it, and when you're done, you put it back.

The freeze protects against a new line. It doesn't watch an existing one. If you already have a HELOC open, read the statements and call your servicer about any draw you didn't make. The freeze and the recorder check cover different ground. Do both.

Confirm Every Wire by Phone on a Number You Already Had

Before a closing, pick two trusted contacts in the transaction and agree on a phone number with each. When instructions arrive, call one of them on the agreed number and confirm the account name and account number by voice. Then, and only then, send.

Nothing moves until the callback.

That's the whole defense in five words, and I'd put it on a whiteboard if I were you. It's the step every version of HELOC wire fraud needs you to skip.

If Something Already Went Wrong

There will be cases where a flag gets spotted after the money moved or after the line got opened. Fraud that's built to look normal sometimes works, and speed is what you control from that point.

If you wired funds to an account that turns out to be fraudulent, contact your bank immediately and tell them the wire is fraudulent, then file a complaint with the FBI's Internet Crime Complaint Center. NAR frames roughly 72 hours as the window that gives the FBI and partner banks the best chance to intercept or freeze the funds. That's a best chance, and nobody can promise recovery, which is why the same day beats the next day.

If a HELOC you didn't open shows up, confirm the lender is real through an independent search, call it on a number from that search, tell them the account is fraudulent, and ask for it to be flagged and closed. Then file a complaint with the CFPB, which accepts complaints about mortgage products and forwards them to the company; companies generally respond within 15 days. For suspected fraud, the CFPB also points you to your local police, your state attorney general, and the FTC. Do all of it within days, while the records are fresh.

If you're an AmeriSave customer and any of this touches your loan, the number to call is the one on your existing loan documents. That rule holds for every lender. The notice or email that raised the alarm is the last place to take a phone number from.

The Bottom Line

HELOC fraud today aims at your identity, your closing funds, and the line itself, and the defense against each is a habit rather than a comparison shop. Checking the record and freezing your credit file are the slow defenses; the callback is the fast one. Those are the hard, unglamorous things, and doing them first is what keeps the rest of the process easy. If a HELOC offer, a closing email, or an unexpected notice ever feels off, the call you make before you move money or sign anything is the cheapest step in the whole transaction. I'd rather you make one call that turns out to be unnecessary than skip the one that mattered.