Lending and Institutional Fraud

The Perfect Borrower Who Never Existed

Regional Credit Union's loan officer, Jennifer Walsh, had processed thousands of auto loan applications in her career. This one looked solid. The borrower, "Michael Torres," had a credit score of 740, steady employment at a manufacturing company, and was buying a modest used Honda from a local dealership.

The application sailed through. The loan funded. Michael Torres picked up the car and drove away.

Three months later, the loan went delinquent. No payments, no contact. The credit union tried to repossess, but the car had vanished. The "employment verification" phone number went to a prepaid cell, now disconnected. The address on the application was a vacant lot. And Michael Torres, as Jennifer would learn, was a synthetic identity built from a real Social Security number belonging to an eight-year-old child in another state.

Because the identity was synthetic rather than stolen from an adult who might notice, no one had complained. The car was probably overseas by now, or stripped for parts.

Jennifer's case wasn't unique. It was part of a coordinated operation that had hit fourteen lenders across the region using variations of the same technique. Same pattern, different synthetic names, different dealerships. By the time investigators connected the dots, the group had extracted over $2 million.

This story is fictional, but the patterns are real.

---

Why This Matters

Throughout this module, you've seen how criminals exploit payment rails: the authorization-settlement gap in card transactions, the irreversibility of wires, the chargeback system in e-commerce. Those attacks target money in motion.

This article covers a different category: fraud that targets money at the source. Instead of intercepting or redirecting payments, these schemes convince institutions to hand over money based on false pretenses. Loan applications with fake income. Payroll systems with fake employees. Tax returns with stolen identities.

What connects these frauds isn't the payment method. It's the shared criminal infrastructure. The same stolen Social Security numbers used for synthetic identity loan fraud also appear in tax refund schemes and unemployment claims. The same document forgers who create fake pay stubs for mortgage applications create fake invoices for expense fraud. Understanding one helps you recognize the others.

---

Lending Fraud

Lending fraud occurs when someone obtains a loan they don't intend to repay, using false information to qualify. The mechanics vary by loan type, but the core pattern remains: deceive the lender about identity, income, or intent.

Mortgage Fraud

Mortgages are high-value targets. A single fraudulent mortgage can net hundreds of thousands of dollars. The complexity of real estate transactions creates multiple points of vulnerability.

Income falsification. Borrowers overstate income to qualify for larger loans. This ranges from inflating salary figures to fabricating entire employment histories. Some schemes use "employer verification" services that confirm fake jobs for a fee. The stated income looks legitimate because someone answers the phone and vouches for it.

Straw buyers. When someone can't qualify for a mortgage due to bad credit or existing debt, they recruit someone else to apply on their behalf. The straw buyer might be compensated with a few thousand dollars for lending their identity and credit score. They sign the paperwork, the loan funds, and the real buyer takes possession. When the mortgage defaults, the straw buyer's credit is destroyed, but they often had little to lose.

Appraisal fraud. Inflated appraisals allow larger loans against properties worth less than claimed. A corrupt appraiser might value a $200,000 home at $280,000, enabling a larger loan with a smaller down payment. When the borrower defaults, the lender can't recover the full amount because the collateral was never worth what they thought.

Occupancy fraud. Investment properties carry higher interest rates than primary residences. Borrowers claim they'll live in properties they actually intend to rent out or flip. The false occupancy declaration reduces their interest rate and down payment requirements.

Auto Loan Fraud

Auto loans move faster than mortgages. Decisions happen in hours, not weeks. This speed creates opportunity.

Synthetic identity fraud. Jennifer's case illustrates the pattern. Criminals build synthetic identities by combining real Social Security numbers (often belonging to children, the elderly, or deceased individuals) with fabricated personal details. Sophisticated operations nurture these identities over months, establishing credit history with small accounts that get paid on time. Others skip the buildup and apply directly, accepting lower approval rates in exchange for speed. Either way, the endgame is the same: get the loan, take the car, disappear.

Dealer collusion. Some fraud involves the dealership itself. A corrupt dealer might inflate a vehicle's value to enable a larger loan, pocketing the difference. Or they work directly with fraudsters, processing loans for synthetic identities and splitting the proceeds. The lender sends money for a car sale that was fraudulent from the start.

Straw purchases. Similar to mortgage straw buyers, someone with poor credit pays a person with good credit to apply for the loan. The car goes to the person who can't qualify. When the loan defaults, the straw buyer faces collections and credit damage.

Personal and Student Loan Fraud

Unsecured personal loans and student loans present different vulnerabilities.

Application fraud. Without collateral to verify, lenders rely heavily on stated income and employment. Falsifying these details is straightforward for criminals with access to document templates. Fake pay stubs, fake employer letters, fake tax returns.

Student loan schemes. Some fraud involves fake students enrolling in real schools to collect loan disbursements. Others involve real students at fake schools that exist only to harvest federal loan dollars. The "school" collects tuition, provides minimal or no education, and closes before regulators catch on.

Instant Credit Fraud

Buy Now, Pay Later services represent a distinct fraud category covered in depth in E-commerce Fraud. BNPL has a different risk model than traditional lending: the BNPL provider bears the loss, not the merchant. This creates unique abuse patterns including merchant collusion schemes.

---

Internal Employee Fraud

Not all fraud comes from outside. Sometimes the threat is already on the payroll.

Ghost Employees

A ghost employee is someone on the payroll who doesn't actually work for the company. The fraud works because payroll systems assume HR records are accurate.

The mechanics. Someone with access to HR or payroll systems creates a fake employee record. The ghost might have a plausible name, a real-looking Social Security number (often stolen), and direct deposit to an account the fraudster controls. Paychecks flow to the ghost. The company pays for work that never happens.

Who does this. Ghost employee fraud typically requires insider access. Payroll clerks, HR administrators, or managers with system permissions can add records without oversight. In smaller companies, a single person might handle both hiring and payroll, eliminating the segregation of duties that would catch the fraud.

How it's discovered. Ghost employees often surface during audits, when physical headcounts don't match payroll records. They might also appear when the fake Social Security number triggers a mismatch with the IRS. Some ghosts persist for years before discovery, especially in large organizations with high turnover.

Timesheet and Overtime Fraud

Real employees can also defraud their employers through inflated hours.

Timesheet padding. Employees report hours they didn't work. This is easiest in environments with manual timekeeping and minimal supervision. A field service technician might report eight hours for a job that took four. A remote worker might log full days while actually working elsewhere.

Overtime schemes. Some employees manipulate their schedules to generate overtime. They work slowly during regular hours, then clock overtime to finish tasks they could have completed in standard time. Supervisors who approve timesheets without scrutiny enable this fraud.

Buddy punching. One employee clocks in for another who isn't actually present. Time clocks that rely on PINs or cards rather than biometrics are vulnerable. The absent employee might be running a side business, working another job, or just not showing up.

Expense Fraud

Business expense systems assume employees submit legitimate costs. Many don't.

Fake receipts. Employees submit receipts for expenses they didn't incur. Template receipts are widely available. Creating a convincing-looking receipt for a business dinner or hotel stay takes minutes.

Inflated expenses. Real purchases get marked up. A $50 cab ride becomes $80. A $200 client dinner becomes $400. Small inflations across many expense reports add up.

Personal expenses as business. The line between business and personal spending blurs. A "business trip" includes personal vacation days. A "client gift" goes to a family member. The expense is real, but the business purpose is fiction.

---

Government Program Fraud

Government programs disburse trillions of dollars annually. The scale attracts organized fraud.

Tax Refund Fraud

The IRS processes hundreds of millions of tax returns each year. They can't verify every single one. Criminals exploit this scale problem.

The pattern. Criminals obtain stolen personal information: names, Social Security numbers, dates of birth. They file fraudulent tax returns claiming refunds based on fabricated income and withholding. The IRS issues refunds, often via direct deposit to accounts the criminals control. Most fraudulent returns slip through because there's no practical way to verify them all.

Why early filing helps. The IRS generally accepts the first return filed for a given Social Security number. Criminals often file early in the season, before legitimate taxpayers get around to it. When the real taxpayer files, their return gets rejected as a duplicate. They face months of delays proving they're the real person.

Scale. Tax refund fraud has declined from its peak due to IRS countermeasures, but it remains substantial. The same stolen identity data sold on criminal marketplaces for credit card fraud also enables tax fraud.

Unemployment and Benefits Fraud

Unemployment systems face a tension between speed and verification. People who lose jobs need money quickly. But fast disbursement creates fraud opportunities.

Pandemic-era explosion. During 2020-2021, unemployment systems nationwide were overwhelmed. States prioritized speed to get money to legitimate claimants. Criminals exploited this, filing millions of fraudulent claims using stolen identities. Estimates suggest tens of billions of dollars in fraudulent unemployment payments.

Ongoing patterns. Even outside crisis periods, unemployment fraud continues. Criminals file claims using stolen identities, directing payments to accounts they control. Some schemes involve people who are actually employed filing claims, essentially double-dipping.

Benefits Fraud

SNAP (food stamps), disability benefits, Medicaid, and other programs face similar vulnerabilities.

Eligibility fraud. Applicants misrepresent income, household composition, or other factors to qualify for benefits they shouldn't receive. A household might hide income or claim non-existent dependents.

Trafficking. SNAP benefits can be exchanged for cash at complicit retailers. The retailer processes a fake purchase, gives the beneficiary cash at a discount, and keeps the difference. The retailer receives government reimbursement for goods never sold.

---

Gig Economy Fraud

Rideshare, delivery, and gig platforms face their own fraud patterns. Drivers and riders both exploit these systems.

Driver-Side Fraud

Phantom rides. A driver creates fake rider accounts and completes trips that never happen. They request a ride from themselves, accept it, and mark it complete. GPS spoofing tools make the fake trip appear legitimate. The platform pays for a ride that never occurred.

Distance inflation. Drivers manipulate GPS or take unnecessarily long routes to inflate fare amounts. On rides where the passenger isn't paying close attention, extra miles mean extra money.

Promotion abuse. Platforms offer bonuses for completing a certain number of rides or signing up new drivers. Fraudsters create multiple driver accounts, complete fake rides between their own accounts, and collect the bonuses.

Rider-Side Fraud

Refund fraud. Riders claim trips never happened, or that drivers took wrong routes, to get refunds for legitimate rides. Some riders abuse refund policies systematically, getting free rides repeatedly before being caught.

Promo stacking. Riders create multiple accounts to abuse new-user promotions. Each account gets a first-ride discount, then gets abandoned.

Delivery Platform Fraud

Food delivery platforms face similar issues.

Phantom deliveries. Drivers mark orders as delivered when they weren't. They keep the food or never picked it up at all. The customer complains, gets a refund, and the platform eats the loss.

Restaurant collusion. A restaurant and delivery driver work together. The driver marks fake orders as picked up and delivered. The platform pays the restaurant and the driver for food that was never made.

These patterns mirror the institutional fraud covered earlier. False claims for payment, exploiting verification gaps, disappearing before anyone catches on. The difference is scale: gig platforms process millions of small transactions daily, making individual fraud hard to spot.

---

The Shared Infrastructure

What connects a fake auto loan in Ohio to a fraudulent tax return in Florida? Often, the same criminal networks.

The criminal supply chain that provides stolen card data also provides the raw materials for institutional fraud: Social Security numbers, identity documents, employment verification services, and money movement infrastructure.

A synthetic identity might be used first to open a bank account, then to apply for credit cards, then to take out an auto loan, and finally to file a fraudulent tax return. The same fake identity, multiple fraud types, maximum extraction before the scheme collapses.

---

Key Takeaways

• Lending fraud targets money at the source. Instead of intercepting payments, these schemes convince lenders to hand over money based on false applications.
• Synthetic identities are hard to detect because no real person notices the fraud. The identity was built to defraud.
• Internal fraud requires insider access but can persist for years in organizations with poor controls.
• Government program fraud scales with program size. Larger benefit programs attract more organized fraud.
• Gig platforms face the same patterns at high volume. Phantom rides, fake deliveries, and promotion abuse mirror institutional fraud but across millions of small transactions.
• The same criminal infrastructure enables multiple fraud types. Stolen identities used for loans also work for tax refunds and benefits.

What's next: The Investigation Techniques article covers how investigators trace money after fraud occurs.

---

Key Terms

---

Generated with AI assistance. Reviewed by humans for accuracy.