Welcome to the latest edition of Informed’s Fraud Watch: Informed’s blog on the latest fraud trends.
Generative AI is changing how lenders’ screen for fraud. Document fakes are rapidly getting so good that they will pass even the most careful visual inspection.
To identify fraud, lenders now need to go beyond the four corners of a proof-of-income document and look at context. At Informed, we are seeing promising results by checking for “illegitimate data collisions.”
The power of seeing illegitimate data collisions
An illegitimate data collision refers to the existence of a unique identifier found in two or more unrelated documents. For example, an ATM id number, which is the id for an ATM in a physical location, should rarely appear in bank statements in different states. It’s hard to imagine a scenario where an ATM physically pulls itself out a wall and transports itself across state lines. Similarly, identical paystub voucher numbers or employee codes should rarely be present in multiple consumer loan applications.
Unique identifiers appear frequently in loan documents
It turns out there are a surprisingly large number of unique identifiers in consumer loan documents. These numbers include:
- On Bank statements:
- Transaction ID numbers
- Bank account numbers
- ACH trace numbers
- ATM ID numbers
- Card numbers (last 4 digits)
- Wire transfer confirmation numbers
- Paystubs:
- Employee ID codes
- Paystub voucher numbers
- Payroll company codes
- Direct deposit trace numbers
- On Utility & Phone Bills:
- Account numbers
- Phone numbers
- Meter reading numbers
Fraudsters re-use these identifiers because they have few other options. These documents are populated with unique identifiers, so a plausible fake has to have them. To get away with their scheme, fraudsters assume/hope lenders lack the capacity to identify their misappropriated data out of the millions of lender documents actively passing through the lending ecosystem.
Illegitimate data collisions account for 16% of the fraud Informed sees
Fortunately, scans of income documents across data networks surface these collisions. Today, illegitimate data collisions account for 16% of the fraud Informed identifies for our clients. This is up from 10 percent at the beginning of 2025. The trend here has been very steady and very consistent growth, month-over-month. While individual lenders can observe these collisions occur with documents entirely within their portfolio, the results are much more powerful when documents are screened from across multiple companies. As our cross-industry coverage grows, we are seeing comparative growth in the number of detected “illegitimate data collisions.”
Here are a few examples:
Employment code collision: The two pay statements below show several suspicious data collisions. First, the employer purportedly issued the same check and check number for two different employees on two different dates. Additionally, the two employees have the same employee number!
Voucher number collisions: Below is an example where an employee presented two different payment vouchers for the same employment period, but the two different statements had the same voucher number!
We believe tracking “illegitimate data collisions” is a powerful technique to counteract the new generative tools fraudsters now can use. While it’s getting easier to fake an image, it’s much, much harder to fake how a unique identifier behaves in an active informational ecosystem. Fraudsters are going to continue to be vulnerable to solutions that evaluate submitted loan documents for context.
