Loan application fraud and low-intent traffic in six guides

Bad traffic costs a lender in three places

A paid lead is not a funded loan. Between the click and the first repayment, fraudulent applicants and real people who were never serious about borrowing each cost the lender something.

• Underwriting effort. Every application that reaches the lender consumes verification and credit-check effort and, depending on the lender's process, manual review, whether or not the applicant ever meant to borrow.
• Defaults. Some fraudulent applicants are approved and never repay, and the loss can arrive as a first-payment default. Some do not default at once: the Federal Reserve notes that synthetic identities in the US can behave like legitimate accounts, may not be flagged by conventional fraud detection models, and can build credit histories before busting out.
• Wasted spend. Media, affiliate and partner budget that buys duplicate applications, applicants who never finish KYC or people outside the lender's criteria produces nothing the lender can fund.

The number that decides a budget is the lender's own, by source: measuring lead quality sets out how to track it.

Fraud and low intent are different problems

In this guide, fraud means the applicant is not who or what they appear to be, or applies with no intention to repay. Low intent means a real person who was never likely to borrow or never fitted the product, such as someone paid to click. The bill is shared but the answers differ: fraud calls for checks on device, identity and behaviour, low intent for a review of the traffic source, the incentive offered and the placement.

The Media Rating Council's invalid-traffic standard for ad-measurement vendors grades detection difficulty in two. General invalid traffic, such as known data-centre traffic and bots and crawlers that do not pose as users, is caught by routine filtration using lists or standard parameter checks. Sophisticated invalid traffic, such as emulators, click farms, bots posing as users and falsified measurement events including conversion attribution, needs advanced analytics and multi-point corroboration. It is written for ad measurement, not lending, but the split is a useful model for applications: emulators and device farms sit in the harder group.

Each pattern shows up differently in the funnel

Each guide takes one pattern or measure: how it shows up in lender data and what a lender can check.

• Emulators and device farms are found by patterns, not one device checkHow emulators, rooted or cloned devices and device farms appear in loan applications and installs, which signals expose them and what lenders can control.
• Duplicate, recycled and synthetic identities hide between applicationsHow duplicate applications, recycled identities and synthetic identities appear in lead flows, and why de-duplication should run before billing.
• Loan stacking works in the gap before a bureau record existsHow one borrower takes loans from several lenders before bureau records update, how it shows, and which controls shorten the blind spot.
• Incentivised traffic can inflate applications and hide weak outcomesRewarded installs and offerwall traffic can inflate application counts without intent; source signals point to them and contract terms limit them.
• Velocity and behavioural signals expose scripted loan applicationsHow velocity windows and form-fill behaviour expose bots and rings, where they misfire on shared devices and networks, and how to tune them.
• Measure loan lead quality by source, from approval to delinquencyHow a lender measures lead quality by source: approval, disbursal, first-payment default, 30+ DPD, fraud rate and cost per disbursed loan.

Screening and measurement work together

CYBERTECH screens applicants against the lender's criteria before routing them, with rules agreed per market and product during onboarding, and the lender keeps the final credit decision. How CYBERTECH screens sets out the five checks.

Screening does not replace measurement. Compare every source on approval rate and first-payment default, not on volume. Paying on a later outcome such as disbursal, rather than on the lead, means the lender does not pay for applications that never reach that stage; pricing compares the models. The market pages cover India, Kazakhstan and Peru; to talk one through, get in touch.

Related guides

• Screen loan leads for fraud and fit before they reach youFive checks, including fit to your own criteria, screen applicants before handoff. No single signal decides, and a stopped applicant is not delivered to you.
• How CPL, CPA and CPD price loan leadsHow CPL, CPA and CPD differ on risk and reporting, and which terms to fix in writing: billable event, validation window, caps.

Sources

1. Federal Reserve Banks: Mitigating Synthetic Identity Fraud in the U.S. Payment System (2020)
2. Media Rating Council: Invalid Traffic Detection and Filtration Standards Addendum, June 2020 update (2020)