Four Ways an Agreement Gets Stolen

A title search will tell you almost everything about a parcel of land: every owner, every lien, every easement going back decades. It will tell you nothing about the person sitting across the table signing the deed.

That gap is not an accident. Over the last century, the industries that move high-value assets built excellent tools for inspecting the thing being transferred. Title searches and appraisals for property. Vehicle histories and odometer registries for cars. Loss registers and grading services for art and collectibles. Credit checks and identity programs for borrowers. The asset is examined from every angle.

The person transferring it, the authority they claim, and the account the money goes to are still authenticated the way they were in 1950: a paper signature, a rubber notary stamp, an email, a phone call.

We spent the last two years reading prosecutions, civil enforcement actions, regulator studies, and insurance claims data across real estate, probate, law firms, family offices, and auctions. The schemes look different on the surface. Underneath, they sort into four mechanisms, and each one demands a different defense.

1. Fabricated authority

Someone with no legal rights manufactures the document that grants them. A forged deed. A forged power of attorney. A falsely notarized estate renunciation. A certificate of authenticity for a painting that was never near the artist.

The most instructive recent case came out of Allegheny County, Pennsylvania in 2026. A man on leave from a government job lifted notary names from older recorded deeds, bought counterfeit notary stamps online, and mailed quitclaim deeds to the county in unmarked envelopes. Each deed recited a $1,000 sale price. Each transferred a vacant or free-and-clear home, some worth close to half a million dollars, to a shell company. Three of the supposed sellers had died years earlier. Forty-three properties changed hands on paper before anyone noticed.

The county's opt-in fraud alert did not catch it. A notary did, when a homeowner tried to refinance and the notary recognized her own forged seal on a deed she had never seen. The middle initial was wrong.

The control that matters: bind every signature, including witnesses and notaries, to a verified identity at the moment of execution, and give the registry a way to check that binding on intake. In Goiás, Brazil, a registry office stopped a R$1 million transfer in 2025 because the power of attorney carried a QR seal that did not match the issuing court's records. The forgery never got recorded.

2. Abused legitimate authority

Here the credentials are real. An attorney, a court-appointed guardian, a valid power-of-attorney agent, an adviser, an auctioneer, or a family-office executive uses lawful access to take what they were trusted to protect.

The numbers on this category are stark. The Consumer Financial Protection Bureau's analysis of suspicious activity reports found that when a fiduciary is the thief, the average loss is $83,600, against roughly $17,000 when the thief is a stranger. The Financial Crimes Enforcement Network found that one in five elder financial exploitation reports involved a trusted person, most often an adult child.

The pattern repeats at every scale. A business manager at a guardianship nonprofit writing checks against five wards' accounts. An attorney serving as power-of-attorney agent, estate fiduciary, and sole signatory at the same time, draining an estate through an ATM. A family-office technology chief approving his own invoices for eight years. Nobody forged anything. Nobody needed to.

The control that matters: no single person can initiate, approve, and reconcile the same payment. Distribution forms require a second verified signer. Bank and custodian statements go directly to beneficiaries, not through the fiduciary. Identity verification helps here, but segregation of duties does the heavy lifting.

3. Process exploitation

The third mechanism involves no technical forgery at all. The actor uses a real identity, or a cheaply obtained one, to exploit a rule.

Pennsylvania's attorney general sued a group of investors in 2026 for "selling" homes they did not own. The mechanics were simple: promise a pressured homeowner you will take over the mortgage, redirect the lender's mail, then sell the house to a new buyer on a land installment contract without ever holding title. One buyer, a public school teacher, put $70,000 down on a house the seller had no right to sell.

In another case, a thirteen-defendant ring used fabricated paperwork to obtain genuine state ID cards, then used licensed tag agencies and notaries to wash the titles on stolen luxury cars before selling them at auction. Every stamp on every document was real.

The control that matters: verify the chain of title and the authority to sell, not just the signature. Automated deceased-grantor checks at the recorder. Ownership verification at listing intake. Plain-language disclosure in the closing room of what a document actually conveys.

4. Transaction hijacking

In the fourth mechanism, everything is legitimate: the deal, the parties, the documents. An attacker simply compromises the email thread, or spoofs a voice or a face, and changes where the money goes.

The FBI's Internet Crime Complaint Center logged more than $3 billion in business email compromise losses in 2025, with 86% of it moved by wire or ACH. A law firm wired $1.1 million from its trust account to a scammer. A family office wired $500,000 on instructions from a hacked email and had its insurance claim denied because nobody made a callback. An engineering firm wired $25.6 million after a video call with a deepfake of its chief financial officer.

The control that matters: payment instructions should never arrive as an attachment. They should be issued inside the same tamper-evident record as the agreement, by a sender whose identity has been verified, and confirmed through a channel the attacker does not control.

What this means for the record

No single control stops all four. A forged deed defeats a title search. A trusted insider defeats identity verification. A hijacked wire defeats both.

Inkset is built for the first and fourth mechanisms, and for the signing half of the second. Every person in a room has proven who they are. Every signature is bound to that identity and sealed in a record nobody can quietly edit. Wire instructions and distribution authorizations live inside that record, issued by a verified sender, requiring the verified co-signers the organization chooses.

It is worth being equally clear about what the platform does not do. It cannot stop someone from mailing a forged paper deed to a county recorder. It does not replace a title search, a notary, or a bank's callback. It does not move or hold money. Those controls belong to registries, title companies, banks, and the organizations themselves, and the strongest defense is all of them working together.

The asset has been inspected for a hundred years. It is time to inspect the signer.