To raise industry awareness, Informed’s Fraud Watch will periodically share analyses of fraud rings uncovered by our research teams. This issue digs deep into an auto loan fraud ring located in South Florida.
The Auto Loan Fraud Ring
In late 2023, a fraud ring went after auto dealers operating out of the cities of Doral, Hialeah, and Coral Gables in the Miami Metro Area. Forty-percent of the fake applications targeted Ford cars and trucks, but the fraudsters also sought loans for BMWs, Mazdas and Kias.
This is a case where fraudsters identified a security flaw – an inability to detect tampered bank statements – and then aggressively and immediately exploited it. Sometimes they completely duplicated legitimate bank statements (only swapping in new personally identifiable information). Other times, they manipulated transactions by swapping in deposit transactions from another person’s bank statement to simulate income. Informed identified over 134 loan applications connected to the ring.
Method of Attack: Income Verification Fraud
To bypass dealer and lender defenses, the fraudsters leveraged multiple strategies.
- Used bank statements to verify income: The ring used bank statements as sources for lender’s income calculations. By avoiding paystubs, they prevented employment details from being passed along, making verifications more challenging.
- Used hard to verify job occupations: The ring used generic job titles such as ‘construction contractor” to fill out employment fields in their applications. Often, the applicant would simply write “construction” as the name of their employer. By doing so, the ring selected a source of income that would be very difficult for lenders to evaluate. Construction work is notorious for having a high level of variability due to variations in payment method (cash, direct deposit, check), payment amounts (hours vary by job) and skill levels. Additionally, because construction contractors are typically self-employed, they do not have pay stubs and need to have their income flow validated through bank statements and cash (…or cash-like, venmo/zelle etc.) transactions.
- Realistic income claims: Members of this ring made realistic income claims (that would tie out with deposit transactions on their bank statements) – typically approximately $4,500 a month – which passed ‘reasonability’ checks.
- Applicants came from across the credit spectrum: The fraudsters tried to disguise their efforts by posing as applicants across the credit spectrum.
- Multiple targets: They hit multiple lenders – banks, finance companies, and even credit unions. By targeting varied institutions, the ring masked the scope of the fraud, minimizing the chance that any individual lender would detect patterns.
- Common Bank Statements: They used mostly Bank of America(46.5%), Wells Fargo, (22.4%) and Chase (19.4%) bank statements – these three banks are targeted because they’re nationally recognized, common in Florida and have widely available templates online.
How The Fraud Ring Was Identified
Theoretically, these frauds could have reflected actions by a number of independent criminals. How did we link them? The key was a string of improbable connections among the income documents in these applications. The fraudulent applications shared overlapping transaction identifiers and bank statement account numbers that shouldn’t have existed.
The graphic above provides an example of what these connections look like: Applicant 1 (John Smith) might share an account number with Applicant 2(James Lee), while applicant 2 (James Lee) might share a transaction with applicant 3 (Sara White), and so on and so on.
We were also able to capture some (<5%) through formatting issues (bad fonts / alignments).
We see several take home points:
- Solutions such as Informed Defender which can monitor transaction manipulation across the lending ecosystem can be a powerful tool to stop these frauds.
- Fraudster are constantly probing lending system for vulnerabilities, and when they find one, they exploit it quickly to maximum effect;
- Lenders need to understand the vulnerabilities of the income verification documents the use
