Fraud

Measure loan lead quality by source, from approval to delinquency

The source that sends the most applications is not always the one that sends the best borrowers. Track each sub-source from approval to first payment, cohort by cohort.

Updated 29 October 2026

Source quality shows in what happens after delivery

A lead is counted when it arrives, but whether it was a good lead is known only weeks or months later, once the loan has been approved, funded and either repaid or missed. The US Office of the Comptroller of the Currency (OCC) gives one illustration in its handbook for bank examiners: aggregated data should be segmented wherever performance could reasonably be expected to differ, for instance by acquisition source and vintage, so that weak segments stand out. The same handbook notes that risk tends to rise as a channel moves further from direct contact with the applicant, so a partner's traffic should be measured apart from direct applications.

That is supervisory guidance for US banks, so treat it as a reference and not as a rule in your market. Any partner's screening before handoff is a claim about the front of the funnel, and the measures below test it at the back. How CYBERTECH screens is described on anti-fraud.

Six measures describe a source

Each measure needs a stated numerator, denominator and point in time. Without all three, two reports with the same label cannot be compared.

MeasureHow it is calculatedWhen it can first be read
Approval rateApplications approved divided by applications received from the source. See approval rate.When the lender's decisions are made
Disbursal rateLoans disbursed divided by applications approved. See disbursal.After approved applicants accept and funds are released
First-payment default (FPD)Disbursed loans that miss the first scheduled payment divided by disbursed loans in the cohort. See FPD.After the first due date and the lender's grace window
30+ days past due (DPD)Disbursed loans 30 or more days past due at a fixed month on book, divided by disbursed loans. See DPD.No earlier than 30 days after a missed due date
Fraud rateApplications or disbursed loans that the lender confirms as fraud under its own policy, divided by applications or disbursed loans. State which one is used.When the lender's review confirms it, which can be after disbursal
Cost per disbursed loanAmount billed for the source divided by loans disbursed from it.When the cohort's disbursals are complete

Approval and disbursal rates describe the lender's own funnel as much as the source, because approval follows the lender's policy. Read them beside the lender's rejection reasons and not on their own.

FPD and DPD need one definition across all sources

First-payment default

Experian defines first-payment default as a consumer failing to make the initial payment on a loan or credit agreement, and describes it as often seen as an early signal. It lists ordinary financial hardship among the causes, and says early default may also reflect misrepresented income, overextension across several credit lines, or synthetic identity and first-party fraud that slipped through origination controls. For fraud patterns that can show up as early default, see recycled identities and loan stacking. The OCC's handbook on instalment lending lists volumes and trends of first and early payment defaults among the credit-performance measures to review, and, in the same procedure, asks examiners to review differences in performance by source.

Neither document fixes a day count, so the lender decides whether a payment counts as missed on the due date or after a grace period, and applies that one rule to every source and cohort. A missed first payment is not proof of fraud: the OCC's instalment lending procedures caution that an account that did not make the first payment should not automatically be identified as fraudulent, so confirm fraud through the lender's own review.

Days past due

The Basel Committee defines an exposure as past due from the first day of a missed payment on any amount due under the contract, material or not. It treats an exposure as non-performing when it is more than 90 days past due and material, or when full repayment is unlikely without the bank realising collateral, whatever the days past due. These are prudential definitions for banks, and the details differ by jurisdiction. Lenders can read an earlier line as well: the OCC handbooks, for instance, use loans 30 days or more past due as a delinquency numerator when they explain lagged analysis.

Fix two choices for any DPD figure. First, the month on book at which it is read, the same for every cohort. Second, whether it counts loans that ever reached 30 days past due or only those still 30 or more days past due. An ever count can only rise from one month on book to the next; a still count can fall when borrowers catch up. If the product has a single repayment, the first payment is also the last, so FPD is the whole repayment read; use an earlier past-due bucket that the lender already reports in place of 30+ DPD.

Cut every measure by sub-source and by cohort

A partner's blended average hides its weakest part. Ask for each measure by sub-source, meaning the campaign, placement, app or publisher behind a lead, passed as sub_id or UTM values on the click (see the postback guide).

Then group leads by cohort: the week or month in which they were delivered, compared at the same age. The OCC's instalment lending handbook calls the loan-level version vintage analysis: it groups loans by origination period and compares each vintage with others at similar time on book. The same handbook notes that rapid growth can distort portfolio performance measures, because new loans that are not yet delinquent enlarge the denominator of a delinquency ratio. A scaling source therefore looks better on a blended ratio than it is.

  • Approval rate and FPD: the earliest reads, so use them to judge a new sub-source.
  • 30+ DPD: read at a fixed month on book, and compare only cohorts of the same age.
  • Fraud rate: restate each cohort as confirmations arrive, including those that land inside the validation window, instead of freezing it at delivery.
  • Cohort size: set a minimum number of disbursed loans before acting, because a few borrowers can swing the FPD rate of a small cohort.

The biggest source is not always the best one

Volume is the easiest number to read. The figure sets four fictional sub-sources side by side on volume, approval rate and FPD rate.

  1. Sub-source P
    Applications received500
    Approval rate30%
    First-payment default rate25%
  2. Sub-source Q
    Applications received250
    Approval rate60%
    First-payment default rate5%
  3. Sub-source R
    Applications received180
    Approval rate40%
    First-payment default rate15%
  4. Sub-source S
    Applications received90
    Approval rate50%
    First-payment default rate10%
Fictional figures for one cohort, not partner data. Approval is out of applications received, first-payment default out of loans disbursed.

Cost per disbursed loan can mislead as well. A derived seventh read, cost per loan with a first payment made, shows why: in the table below, two fictional sub-sources cost the same per disbursed loan.

MeasureSub-source PSub-source Q
Spend1,0001,000
Applications received500250
Cost per application2.04.0
Approval rate30%60%
Applications approved150150
Disbursal rate80%80%
Loans disbursed120120
FPD rate25%5%
Loans with first payment made90114
Cost per disbursed loan8.38.3
Cost per loan with first payment made11.18.8

Fictional figures for one cohort, to show the arithmetic only. Spend is in fictional currency units.

Sub-source P is cheaper per application, yet dearer for each loan that makes its first payment. Adding FPD to the cost line is what separates them.

The billable event, the event on which a partner is paid, decides how much of this the lender still carries after paying. The lender and the partner define it together, and pricing covers the models. Whichever it is, hold the source to the later measures as well.

Outcomes must travel back to the source

A source cannot improve against results it never sees, and results mature at different ages: approval and disbursal come first, while a missed first payment, where it is among the agreed statuses, shows only after the first due date. Referral delivery returns outcomes by S2S postback matched to the click ID, carrying an identifier, a status, a time and, on rejections, a reason code; direct API delivery uses webhooks. The mechanics are in the postback guide, the API guide and pricing. At CYBERTECH, partner feedback from postbacks helps tune the checks over time.

Sharing repayment status with a partner is a data-sharing decision for the lender's compliance team, including whether a status keyed to a click ID counts as personal data in your market. This is general information, not legal advice.

Ask every acquisition partner for these reports

If a partner cannot give the counts behind its ratios, you cannot check its quality claims.

  • Every measure above by sub-source and by delivery week, with identifiers you can match in your own system.
  • The counts behind each ratio, so you can recompute it with your own definitions of FPD and DPD.
  • How it defines a qualified application, and which checks run before delivery.
  • How many applicants were stopped before delivery and why, to compare with your own rejection codes.
  • Which sub-sources use rewards, and how incentivised traffic is identified.
  • Which outcomes it receives back from you, how late they arrive and what it changes when they do.
  • What it does when a sub-source breaches your FPD or 30+ DPD threshold: pause, throttle or review, and how quickly.

Agree each threshold with the partner before launch and anchor it to the lender's own result at the same cohort age, such as its direct applications, so that a pause follows a written rule.

Sources

  1. Office of the Comptroller of the Currency: Comptroller's Handbook, Retail Lending, version 2.0 (2021)
  2. Office of the Comptroller of the Currency: Comptroller's Handbook, Installment Lending, version 1.3 (2018)
  3. Basel Committee on Banking Supervision: Prudential treatment of problem assets - definitions of non-performing exposures and forbearance (2017)
  4. Experian: What lenders need to know about first payment default (2024, updated 2026)

Agree outcomes and caps before launch

Tell us your market and product. The billable event, the outcomes your server returns by postback and the caps are agreed before launch.

Discuss your market