When Is Fraud Not Fraud? The Peculiar Problem of Loan Stacking

How can fraud systems determine whether an applicant intends to pay back a loan? Is it possible to filter for intention?

Christopher Watkins
Nov 5 · 6 min read

Successfully distinguishing between legitimate consumer behavior and malicious fraud activity is one of the core requirements of any fraud detection system. Whether discussing application fraud, fake accounts, or promo abuse, the challenge is the same — how to separate the good from the bad.

It is especially important to do this in a way that does not add friction for consumers. However, this is easier said than done — particularly when it comes to practices like “loan stacking.”

Authentication vs. Friction

When it comes to weighing the benefits and risks of layered security measures — and trying to determine how much friction we can afford to impose — we could simply do the equivalent of what the TSA does, and demand that everyone take off their shoes before going through the metal detector at the airport. But as anyone who’s endured this experience knows, the process is both maddening and ineffective. We do succumb, but only because we have to. We have no choice. That doesn’t apply when you’re talking about online services.

It’s safe to say that consumers generally feel the same way about verification methods online as they do about airport security. While we might objectively appreciate the need for two-factor authentication (2FA), it nonetheless drives us crazy having to go through extra steps before we can shop, particularly when these steps involve remembering an old phone number, or the city of our aunt’s birth, or the password to our password manager.

Just like when we’re in the airport, we want to get where we’re going, and we don’t want friction along the way. We especially don’t want to fall on the wrong side of authentication, as anyone who’s ever locked themselves out of their own account can attest.

Fortunately, there are more advanced solutions that are proving to be simultaneously more successful and less obstructive. Biometrics, and Zero-Factor Authentication, for example, hold promise. But even if we solve the authentication problem, what happens when authentication isn’t enough? For example, how do you filter for intention?

This is a critical question for those instances when the legality or illicitness of a particular action depends on the intention behind the act.

The Peculiar Problem of Loan Stacking

This is the challenge loan providers face when dealing with loan stacking fraud. It all comes down to intention. Is the applicant stacking loans because they need more money, or because they’re trying to get better overall rates? Or, are they stacking loans with no intention of paying them off? Are they just trying to get as much money as they can, while they can? In each case, the action is the same (applying for a loan) — what differentiates them is the intention of the user.

So again we ask, how do you filter for intention?

What is Loan Stacking?

To answer this question, let’s first establish our definition of loan stacking: “Loan stacking refers to the practice of getting approval for multiple loans or lines of credit simultaneously within a short period.”

As noted above, not all loan stacking behavior is illegal. For example, there is something called “credit shopping,” where borrowers apply for multiple loans to try and get the best interest rate possible. This might be a bit sneaky, but it’s certainly not illegal. We also have “credit stacking.” This is where legitimate buyers apply for credit without realistically having the means to repay. Problematic? Certainly. But illegal? No. (You can’t really fault them for trying, can you?)

It’s the third type of loan stacking that is the real problem. We call it “fraud stacking,” and it happens when fraudsters apply for multiple loans with no intention of paying them back.

How Damaging is Loan Stacking?

Loan stacking of all kinds presents serious challenges to lending institutions, as a recent article from the Economic Times made clear:

“Stacked loans by borrowers have a higher potential of turning into Non-Performing Asset (NPAs), reveals the recently released TransUnion CIBIL- SIDBI MSME Pulse Report. The latest report noted that the default rates in borrowers taking multiple loans from lenders within a period of 60 days have increased from 2.5% to 4.4% during Sep’15 to Sep’18 period.”

A recent Forrester study added fuel to the statistical fire by noting that “67% of financial institutions reported slightly or significantly more loan stacking” in 2018.

A $200,000 Loan Stacking Use Case

As a fraud technique, loan stacking becomes exponentially more worrisome when you assess it in the context of a world in which massive data breaches are a near-weekly occurrence, and one in which digital fraud is scaling rapidly. A recent story from ABC7 Eyewitness News detailed a massive loan stacking scam targeting thousands of victims, that resulted in over $200,000 in losses. The entire effort was made possible through the use of stolen personal data. The details of the fraud offer a textbook use case of how loan stacking works, and why it’s so damaging:

“Over the course of a year, the alleged ringleader of the “highly sophisticated” operation filed more than 100 credit union loan requests using stolen identities of people with good credit, from all over the country, officials said.

The ring apparently found the identities of its victims from various sources, including school and hospital websites, and harvested additional information about them from the Dark Web. It then created profiles with their information and ran their credit reports.

The loans, taken out in amounts ranging from $7,500 to $35,000, were filed electronically under the stolen identities, using the names and social security numbers of the individuals. In many of the cases, a money order was used to open the loan, and once the credit union approved it, the loan money was deposited into bank accounts opened in the victims’ names.”

Uncovering Coordinated Fraud Attacks with Unsupervised Machine Learning

While these kinds of attacks are complex, sophisticated, and highly coordinated, it’s these very characteristics that also make it possible to proactively thwart them — provided you have the right solutions and technologies in place.

AI-driven fraud solutions such as DataVisor’s dCube incorporate contextual detection and holistic analysis — and leverage the power of unsupervised machine learning — to expose coordinated attacks by revealing patterns and connections across hundreds, even thousands, of accounts and actions. These capabilities make it possible to flag suspicious activity before attacks launch and damage is caused.

dCube, from DataVisor

In the case of loan stacking, dCube can correlate patterns and surface cross-account links that indicate coordinated application activity, at the point when an attack is still being planned, thereby preventing downstream damage.

Is it Possible to Filter for Intention?

This brings us back to the question of filtering for intention. The only consistently accurate and reliable way to filter for intention, when it comes to fraud attacks like loan stacking, is to expose the coordination behind the applications.

Fortunately, unsupervised machine learning makes this possible. Using contextual detection and holistic analysis to reveal patterns and connections across users, actions, and events, we can see attacks as they form. We can identify accounts that are being marshaled for malicious purposes, and even if these accounts seem perfectly normal when viewed in isolation, we can expose them as fraudulent by exposing their association to a coordinated fraud ring.

Coordination is intention. And we can see that. We can see it when it’s malicious, we can filter for it, and we can stop it.

DataVisor

AI-powered fraud management solutions that move faster than the speed of fraud.

Christopher Watkins

Written by

I type on a MacBook by day, and an Underwood by night. I carry a Moleskine everywhere.

DataVisor

DataVisor

AI-powered fraud management solutions that move faster than the speed of fraud.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade