CERTIDOX USE CASE · REAL ESTATE WIRE FRAUD
The signature, stamp and QR code stay unchanged. Four bank details on page 1 have been replaced.
A buyer preparing to transfer $85,000 receives two pages of escrow instructions. The second page looks completely authentic. But the account beneficiary, receiving bank, routing number and account number on the first page have changed.
Controlled fraud simulation using fictional names and deliberately non-functional banking details. Neither PDF is valid for payment.
Both PDFs describe the same fictional property transaction and the same $85,000 escrow deposit. In the fraudulent version, four payment fields on page 1 have been substituted. The complete pages are shown below, without cropping or hiding their contents.
Certified original · Page 1 of 2
Altered copy · Page 1 of 2
The change is on page 1, where the money would go. Nothing about the transaction amount, property or signature page alerts the recipient.
These enlarged extracts come directly from the supplied document images. They show why checking only the signature or the amount would miss the substitution.
| Field | Certified original | Altered copy (fictional) |
|---|---|---|
| Beneficiary | Harborstone Title & Escrow, LLC, Client Escrow | Midwest Closing Services, LLC, Settlement Account |
| Receiving bank | Chicago Harbor Settlement Bank (fictitious) | Northlake Settlement Bank (fictitious) |
| ABA routing number | 991023456 (invalid test number) | 991845207 (invalid test number) |
| Account number | 730019845602 (fictional) | 884200731659 (fictional) |
The entire second page is identical in both PDFs. The original signature, specimen stamp and Certidox QR code remain where they were. The two complete page 2 views below show what an unsuspecting recipient might see.
Certified original · Page 2 of 2
Altered copy · Page 2 of 2
The trap: scanning the unchanged QR code opens the certification record for the original PDF. Even a valid certification record does not establish that the first page of the copy you received has not been altered.
Use the Certidox app to check the certification record, then compare both pages of the document received with the certified reference. The screenshots are genuine captures of the demonstration, not live verification results.
Step 1
Open the complete original or altered PDF on another screen, or print it. Scan the Certidox QR code using the free mobile app. The code on page 2 is the same in both files, so both lead to the certification record for the original document.
Step 2
The captured result identifies Rémy Eisenstein as certifier and CERTIDOX as certifying organization. It shows the original certification as VALID at the time of capture.
In this fictional example, CERTIDOX, not Harborstone Title & Escrow, is the organization recorded by the application. A fresh scan is needed to check the status now.
Step 3
Open the certified reference and read page 1 and page 2. Compare all four payment fields with the received instructions before relying on them. The mismatch on page 1 exposes the altered copy, even though the signature and QR code on page 2 are unchanged.
The two iPhone captures show the actual pages displayed in the Certidox application. They have not been cropped or modified.
Scan. Check. Compare. A green checkmark alone does not verify the contents of the document in your hands.
Before sending any real payment, independently confirm all receiving-bank details using a telephone number obtained from a trusted source, such as the executed agreement. Never rely on a number supplied only with the unexpected instructions.
All escrow entities, banking instructions and the specimen signature shown in the PDFs are fictional. The original Certidox-certified demo document and the app captures are supplied examples. No banking transfer is possible using the test details.
Each PDF contains both pages. Download them and compare page 1, then inspect page 2 to see that the signature, specimen stamp and Certidox QR code are identical. No document pages have been removed.
Two full pages, containing the fictional original escrow account details and a genuine Certidox certification QR code.
Download the original PDFTwo full pages. Four payment fields were replaced on page 1; page 2 remains identical to the original.
Download the altered PDFThese are controlled, non-transactional documents. Neither should be used as payment instructions. Status displayed in historical screenshots is not a live verification result.
A fraudulent closing email directed a homebuyer's payment to a different account.
In November 2025, Johanna Berkowitz was buying a home in Dewey Beach, Delaware. According to a federal lawsuit, she received an email purporting to come from her closing law firm's coordinator. It requested a wire transfer of $2,209,240.11, matching the amount on her settlement statement, but directed it to an account allegedly controlled by fraudsters.
Her brokerage executed the transfer on November 19, 2025. In a lawsuit filed on January 29, 2026, she alleged that the money was then withdrawn or redirected. These are allegations, not findings by a court.
The reported incident is separate from the fictional Certidox demonstration above. It illustrates why recipients should verify the origin and exact content of payment instructions before relying on them, then independently confirm bank details. The lawsuit does not establish that a signed PDF or QR code was altered.
Sources: WBOC-TV, February 16, 2026; CoastTV, February 16, 2026; Berkowitz v. John Doe Nos. 1-100, Case No. 1:26-cv-00106.
The reported parties did not participate in or endorse this demonstration.
A fraudster may alter page 1 while reusing an unchanged page 2 carrying the genuine QR code. The code opens the original certification record. Its valid status does not prove that the received copy matches the certified reference.
Scan the QR code, check the recorded certifier, date and current status, then tap View document. Compare every page of the received PDF or printed copy with the certified reference, particularly the beneficiary, receiving bank, routing number and account number.
No. The captured Certidox verification screen identifies CERTIDOX as the certifying organization. Harborstone Title & Escrow is fictional. The demonstration proves how to compare a received copy against a certified reference, not that a real escrow company authorized payment.
No. VALID describes the status of the certification record at the time of verification. The received content must match the certified reference, and payment details must also be confirmed using an independently trusted telephone number.
Yes, when the Certidox QR code remains readable. After checking the certification record, compare the entire printed or scanned copy with the certified reference before relying on it.
A new scan displays the current certification status. Revocation changes the live status but does not modify or recall the content previously certified.
In a dispute over the certified content or certification date, a bundle may be used to independently examine historical cryptographic and timestamp evidence. Current certification status still requires a live check.
No. Both PDFs are non-transactional demonstration documents with fictional organizations, accounts and deliberately invalid test routing numbers. Neither document must be used to transfer money.
No. The alleged wire fraud described in the January 2026 federal lawsuit is separate from Certidox. The two escrow PDFs on this page are fictional demonstration documents, created independently of the people and organizations involved in the reported case.
A familiar signature and a valid QR code are not enough. Verify the certification record, compare the entire received document with the certified reference and independently confirm the beneficiary’s banking instructions.
