Stop Waiting for the Credit Report: Put the Fraud Alert in the LOS

Bust-Out Fraud May Cost Auto Lenders $250–$350 Million a Year. The Applications Already Contain the Clues Needed to Catch It.

–

For CUCollector readers, the vulnerability isn’t new. We’ve already documented borrowers obtaining multiple vehicles before their rapidly growing debt becomes visible to the next lender.

In The 30-Day Blind Spot: How Straw Buyers Financed Nearly 100 Cars Before Lenders Could See Them Coming, federal trial testimony described how approximately 16 straw buyers obtained 90 vehicles using $3.6 million in financing. One participant testified that a borrower with sufficient credit could potentially obtain “10 or 15 cars” before lenders caught up.

We’ve seen the same vulnerability in Ten Cars, Eight Days, One Waitress.

So another explanation of the 30-day credit-reporting lag isn’t particularly useful.

Something has changed.

Point Predictive announced September 1 that it estimates auto-loan bust-out fraud is producing $250 million to $350 million in annual losses and launched a real-time Bust-Out Alert designed to identify applicants simultaneously obtaining financing from multiple lenders.

That raises a more interesting question:

Where should the industry put the alarm?

The answer may be sitting on the screens lenders already use every day.

The loan origination system.

–

The 30-Day Blind Spot Isn’t Necessarily 30 Days

Credit reporting has traditionally operated on monthly furnishing cycles. But the loan itself moves through an entirely different timeline.

Consider a smaller credit union. An application arrives Friday night. It waits through the weekend. An underwriter reviews it Monday, requests documentation and eventually approves it. Documents are completed Wednesday and funding occurs Thursday.

Meanwhile, a fraudster isn’t waiting.

Applications can be going to other dealers, banks, credit unions and finance companies throughout that period. Once those loans fund, the accounts still must be boarded and eventually furnished to the credit bureaus.

Application lag. Underwriting lag. Funding lag. Credit-reporting lag.

Put them together and the “30-day” window can become considerably longer.

But one thing existed from the beginning:

The application.

–

Catch the Application Instead of Waiting for the Loan

Before there is a tradeline, payment history or first-payment default, there is an application. And before a repossession department starts searching for a vehicle that has disappeared, somebody entered information about that vehicle into the lending process.

That makes origination potentially the industry’s best choke point. The complication is fragmentation.

Auto lending runs through MeridianLink, RouteOne, Dealertrack, Origence CUDL, defi SOLUTIONS, Baker Hill, Abrigo, Fiserv, Finastra, CRIF, SYNC1 and numerous other origination, dealer and lending platforms.

Every lender sees its own application. Every platform sees activity within its own environment. Credit bureaus may see accumulating inquiries.

But inquiries don’t tell the entire collateral story.

A legitimate buyer might generate six auto-finance inquiries while shopping one vehicle among several lenders.

Now change one variable.

The same borrower generates six applications involving six different VINs in four days.

That’s a very different event.

The important question isn’t simply: How many lenders looked at this borrower?

It’s: How many vehicles is this borrower trying to finance?

–

The VIN Changes Everything

One of the most valuable potential loan-stacking signals may therefore be: BORROWER + APPLICATION + VIN + TIME

Six lenders + one borrower + one VIN?

Probably rate and underwriting shopping. Not unusual.

Six lenders + one borrower + six VINs?

Something may be very wrong.

That doesn’t justify an automatic decline. Families replace multiple vehicles. Businesses acquire fleets. Deals fall apart and borrowers change cars.

But compressed multi-VIN activity should trigger additional review, particularly when combined with questionable employment, unusually high stated income, synthetic-identity indicators, changing addresses or suspicious documentation.

–

Point Predictive Is Already Closer Than It Might Appear

This isn’t entirely hypothetical.

Point Predictive says its Bust-Out Alert identifies applicants with other loans funding simultaneously at participating lenders and can deliver alerts within 400 milliseconds as loans are approved for funding.

Its consortium contains more than 300 million historical applications representing approximately $5 trillion in consumer loans, with another 3 million to 5 million applications added monthly.

Point Predictive’s own fraud research offers another clue. In describing a coordinated bot attack, it identified the:

“Same VIN and borrower submitted to multiple lenders within seconds.”

In other words, the technology can already connect borrower, vehicle and activity across participating lenders.

Point Predictive also has published relationships involving RouteOne, MeridianLink and defi SOLUTIONS, while Dealertrack announced a Point Predictive integration for BorrowerCheck earlier this year.

Pieces of the necessary infrastructure already exist.

–

Don’t Make the LOS Companies Talk to Each Other

It would be tempting to say MeridianLink should communicate directly with RouteOne, Dealertrack, CUDL and every other platform. That’s probably the wrong solution.

These companies compete. Their architectures, clients and data arrangements differ. Creating one interconnected LOS database would introduce significant commercial, privacy, compliance and governance issues.

Fortunately, it may not be necessary.

The LOS doesn’t need to be the database. It needs to be the tripwire.

A more realistic model is an independent fraud consortium receiving standardized, appropriately governed signals from participating lenders.

Imagine a borrower appearing Monday morning with VIN A, Monday afternoon with VIN B, Tuesday morning with VIN C and Tuesday afternoon with VIN D.

The fourth lender doesn’t need to know who the other lenders are, their pricing, underwriting policies or loan amounts.

It needs a warning:

POSSIBLE MULTI-VEHICLE LOAN STACKING

RECENT APPLICATIONS ASSOCIATED WITH MULTIPLE VINS

ADDITIONAL REVIEW RECOMMENDED BEFORE FUNDING

That warning appears inside the LOS the loan officer already uses.

Now the fraud alert has moved from weeks after funding to potentially seconds after application activity.

–

The LOS Becomes the Dashboard, Not the Clearinghouse

MeridianLink doesn’t need access to RouteOne’s database. Dealertrack doesn’t need access to defi SOLUTIONS.

The lender’s LOS becomes the place where the warning is displayed and acted upon, while an independent consortium performs the cross-lender matching behind it.

Point Predictive says its Bust-Out Alert can already send and receive data through an API, while existing integrations demonstrate that external fraud intelligence can be embedded into different origination environments.

This isn’t science fiction. Pieces of it are already operating.

Don’t Stop at Approval

There is another opportunity here that particularly matters for smaller lenders.

Run the check twice.

The first check occurs when the application enters underwriting. The second occurs immediately before funding when enough time has elapsed.

Call it a funding refresh.

Suppose a Friday applicant receives a clean result. The loan sits over the weekend. By Wednesday, when the credit union is ready to fund, that applicant may have submitted three more vehicle applications elsewhere.

The original credit report might not show them. A consortium application-velocity check might.

If an application exceeds a predetermined age, crosses a weekend, changes collateral or develops additional risk indicators, rerun the fraud-velocity check before releasing funds.

The credit union doesn’t necessarily need another hard credit pull. It needs to know whether something material has changed since it first looked.

–

Why the Credit Bureaus Aren’t Enough

Credit bureaus can see inquiries across institutions, but inquiries alone can’t necessarily distinguish between someone shopping six lenders for one car and someone attempting to finance six cars.

The VIN provides context to velocity.

And the origination process is where the borrower and VIN naturally meet before funding.

There are already signs of this concept developing from the collateral side. ShieldVIN markets a real-time cross-lender VIN and HIN clearinghouse intended to identify when the same collateral has already been pledged or fraud-flagged elsewhere.

That addresses one VIN pledged to multiple lenders.

Loan stacking is almost the mirror image:

One borrower financing multiple VINs through multiple lenders.

Both point toward the same need: better real-time visibility into relationships between people, applications and collateral before the money moves.

A Three-Layer Defense

For credit unions, the architecture could be relatively straightforward.

Layer One: Application Check

Query consortium fraud intelligence for unusual borrower/application/VIN velocity when the application arrives.

Layer Two: Underwriting

Combine that signal with income, employment, identity, dealer, credit and other fraud indicators. Multi-VIN activity triggers review, not automatic decline.

Layer Three: Funding Check

For aged or higher-risk applications, refresh the fraud signal immediately before releasing funds.

That last layer is especially important for lenders whose applications don’t move from submission to funding in minutes.

A fraudster can do a lot between Friday afternoon and Wednesday morning.

–

Put the Warning Where the Fraud Appears

Perhaps the industry’s biggest opportunity isn’t another fraud score. It’s a standardized auto-finance application-velocity signal that works regardless of which origination platform a lender uses.

Think of it as a smoke detector rather than another underwriting engine.

The LOS asks:

Has this borrower recently appeared in connection with other vehicle applications?

The consortium returns a risk indicator.

The lender decides what to do about it.

Credit reporting remains essential. Faster furnishing would help. Better income and employment verification would help. Identity-fraud detection matters.

But none addresses the problem quite as early as recognizing the applications themselves. We’ve spent years asking how to close the 30-day blind spot.

Maybe that’s the wrong question.

Don’t wait 30 days to discover the loans.

Put the warning where the fraud first appears, in the loan origination system.

–

Kevin Armstrong

Publisher