The Weak Links: One Loan, Many Points of Attack

Fraudsters only need to exploit one link in the collateral-security chain. Lenders have to protect them all.

–

A chain has a simple purpose. It connects one thing securely to another, and its strength depends on every link holding. Most can be forged from hardened steel, but if one is weak, that’s where the chain breaks.

A secured automobile loan works much the same way.

The lender’s money is connected to its collateral through a chain of people, documents, databases and legal rights: Borrower → Dealer → Lender → DMV → Insurer → Servicer → Collections → Recovery → Transport → Auction → Buyer

Every link carries part of the load.

The borrower and income have to be real. The dealer has to have the right to sell the vehicle. Its identity and history have to be accurate. The title must establish ownership, the lien must be perfected and remain intact, and if the loan defaults, the collateral must remain recoverable and saleable.

The lender needs every link to hold.

The fraudster doesn’t.

An identity thief can attack underwriting. A title fraudster can attack ownership. An exporter can exploit timing. A transport fraudster may not enter the picture until after repossession.

They don’t need to know one another or understand the entire chain.

Each only needs to find the link he knows how to break.

Fraudsters get to choose which link to attack.

The lender has to protect them all.

–                                                                

Many Specialists Against One Lender

One specializes in stolen or synthetic identities. Another manufactures financial documents. Someone else understands dealer funding. Others know titles, mechanic’s liens, vehicle exports or transportation systems.

They may never meet and may know nothing about each other’s methods.

But collectively, they’re attacking the same chain.

A fraudster can become very good at exploiting one narrow vulnerability. The lender has to defend the entire collateral lifecycle against all of them.

And we’ve already seen examples at almost every link.

–

The Borrower

The first target is obvious: get the loan approved.

In the Calvin Lynn Roddy Jr. case, investigators described stolen identities, counterfeit driver’s licenses and fabricated income documentation used in connection with fraudulent loans.

Synthetic identities, purchased tradelines and manufactured financial documentation make the problem more complicated. CUCollector has examined both fabricated tradelines and the larger ecosystem of manufactured financial identities in The Fraud Factory.

The danger is no longer simply one fake document. Several manufactured documents can corroborate one another.

The pay stub supports the employment. The employment supports the income. The bank statement supports the pay stub.

Everything agrees. Everything can still be wrong. The fraudster specializing here doesn’t need to understand titles or repossessions.

He just needs to get past underwriting.

–

The Transaction

Sometimes the borrower is real and the transaction isn’t.

CUCollector examined a Wisconsin case involving a consumer who believed he was purchasing a 2019 Chevrolet Silverado from what appeared to be a legitimate Texas dealership.

There was a website, inventory and banking information. A credit union reportedly financed the purchase and more than $22,000 was wired. The truck never arrived.

The borrower was real. The credit union was real. The money was real.

The seller wasn’t.

The weakness wasn’t the borrower. It was another participant in the transaction.

–

The Perfection Gap

Even when the borrower, dealer and vehicle are legitimate, another vulnerability appears immediately after funding.

The vehicle leaves the dealership. The title paperwork begins moving through the system.

Those two things don’t travel at the same speed.

We examined that problem in Your Collateral Just Left the Country and Financed Monday. Exported Friday..

A vehicle can cross several states or reach a shipping terminal while the lender’s lien is still working its way through the title system.

The fraudster doesn’t have to defeat underwriting or the DMV. He exploits the time between them.

–

When the Vehicle’s History Changes

A related vulnerability appears when the physical history of the collateral and the information available to a lender don’t tell the same story.

A recent case in Utah provides a remarkable example.

Police alleged that Edgar J. Diaz Rincon attempted to obtain more than $30,000 in financing using paperwork connected to a late-model Ford Mustang that had already been totaled and sold at a salvage auction for approximately $7,600.

Investigators reportedly connected him to several similar financing attempts, including one that resulted in an estimated $25,000 loss.

The available reporting doesn’t establish precisely how or when the Mustang’s salvage history was reflected in the title and databases available to the lender, so it would be premature to blame a particular reporting system.

But the vulnerability is clear.

A lender evaluating collateral is dependent upon accurate and current information about what that vehicle actually is.

A VIN can identify the correct automobile while the information attached to that VIN may still fail to tell the lender everything it needs to know.

–

When the Title Becomes the Target

Eventually the lender’s lien is perfected. Now the attack can move somewhere else.

In Lien Stripping: Mechanic’s Lien Loopholes and the Ticking Time Bomb, we examined how lien-sale procedures can collide with secured lenders’ interests.

One example involved a roughly $90,000 Corvette. The borrower reportedly made one lease payment and disappeared. Eventually the VIN surfaced in a small newspaper advertisement announcing a lien sale.

The collections problem had become a title problem.

Then there is Operation Gingerbread Man.

Prosecutors alleged that forged lien releases and fraudulent out-of-state documentation helped move more than 120 vehicles through a scheme involving millions of dollars in financing. Some eventually emerged with New York titles stating: NO LIENS RECORDED.

That’s a particularly dangerous transformation.

Once an authoritative government record accepts false information, everyone downstream may begin treating that information as legitimate.

The original lender sees collateral subject to its lien. The next buyer sees a clean title. Both can be looking at the same automobile.

–

The State Line

The United States doesn’t have one title system.

Vehicles move between jurisdictions with different laws, documents and procedures. One state inevitably relies to some degree upon information created by another.

Operation Gingerbread Man illustrates the danger. So does the Miami bust-out scheme we examined involving fictitious lien releases, mechanic’s liens and movement of fraudulently financed vehicles.

The vulnerability may not exist entirely inside either state’s system. It can exist between them.

What information is independently verified? What is inherited?

And what happens when the information being inherited was already wrong?

–

Turning Possession Into Ownership

Mechanic’s liens, storage liens and abandoned-vehicle procedures exist for legitimate reasons. They also provide legal mechanisms capable of converting possession into ownership.

We saw how that process can allegedly be manipulated in our coverage of Prestige Towing in Paragould, Arkansas.

The investigation later expanded into what police described as “lien washing.” In several cases, investigators alleged that vehicles carrying legitimate lender liens were run through fraudulent towing or abandoned-vehicle paperwork before new titles were issued without those liens.

One case involved a 2015 Ford F-150. Police alleged the borrower supplied the vehicle’s VIN, mileage and lender information and paid to obtain an abandoned-vehicle title. Investigators later obtained confirmation from the lender that it still had a financial interest in the truck even though its lien had disappeared from the title.

That’s the weak link in unusually clear form. The lender didn’t fail to obtain a lien.

Someone allegedly found another process capable of removing it.

–

Default Doesn’t Stop the Clock

Eventually fraud becomes delinquency. But while collections investigates an account and recovery waits for an assignment, the automobile remains mobile.

It can cross state lines, enter a repair shop, be retitled, loaded onto a transporter or shipped overseas.

The fraudster doesn’t necessarily have to outrun the repossession agent. He may only have to outrun the lender’s realization that it needs one.

–

Even Recovery Isn’t the End

Once the vehicle is recovered, the lender finally knows exactly where its collateral is.

Then another chain begins: Recovery Lot → Transporter → Auction → Sale

CURepossession’s The Yerevan Connection examined how transportation identities and credentials can be compromised or impersonated.

The truck can be legitimate. The driver can be legitimate. The carrier and insurance can be legitimate.

The deception can exist somewhere else in the dispatch chain.

That means a lender can identify the default, locate the collateral, successfully repossess it and place it behind a locked fence and still face another vulnerability before the vehicle reaches auction.

–

The Weakest Points May Be Between the Links

Look across these cases and another pattern emerges. Many vulnerabilities don’t exist entirely inside one institution.

They exist in the handoffs.

The lender relies on the dealer.

The DMV relies on submitted documents.

One state relies upon records from another.

The lender relies on the title.

The recovery company relies on the assignment.

The transporter relies on the dispatch.

The auction relies on authority to sell.

The buyer relies on the title.

Each participant can perform its own job correctly while relying upon false information introduced somewhere upstream.

Collateral security therefore isn’t merely a chain of legal rights. It’s a chain of inherited trust.

And sometimes the weakest point isn’t one of the links.

It’s the space between them.

–

The Fraudster Gets to Choose

That’s what makes the contest so uneven. The identity fraudster doesn’t care how strong the lender’s title controls are. The title fraudster doesn’t care how sophisticated its identity verification is.

The exporter doesn’t have to defeat either if he can move the vehicle before those systems react. And the transport fraudster may wait until everybody else has successfully done their jobs.

Each specialist chooses the link he understands best. The lender doesn’t have that luxury.

It has to protect identity, income, dealer legitimacy, vehicle history, funding, title, lien perfection, servicing, recovery, transportation and disposition.

Against different people. Using different methods. At different times in the life of the same loan.

–

The Weak Links

A secured automobile loan isn’t ultimately secured by steel. It is secured by the lender’s legally enforceable connection to that steel.

That connection begins at origination and has to survive every handoff until the loan is paid off or the collateral is converted back into money.

Somewhere along that chain, different fraudsters specialize in finding different weaknesses.

They don’t have to cooperate.

They don’t even have to know one another.

They share only one enormous advantage: Each fraudster gets to choose which link to attack.

The lender has to protect them all.

The Weak Links: One Loan, Many Points of Attack – The Weak Links: One Loan, Many Points of Attack – The Weak Links: One Loan, Many Points of Attack

The Weak Links: One Loan, Many Points of Attack – Credit Union Collections – Credit Union Collectors – Lending – Fraud – Fraud – Auto Loan – Dealer– Dealer – Straw Buyer – Skip – Skip – Transport