Auto loan fraud detection that catches fake income and washed credit before the dealer is paid
Fraud stopped before the money leaves, not at first missed payment.
See one case, screen by screen ↓Software that screens auto loan applications and their funding packages for fraud — inflated income, fake employers, synthetic or stolen identities, credit washing and straw buyers — before the lender funds the dealer. Auto Loan Fraud Detection uses six agents to test income, identity, credit history, the deal and the links between applications, and a fraud analyst makes the decision.
How to choose AI solutions for lending →
Updated
Most auto fraud today is first-party: a real buyer who inflates income, invents an employer, washes charged-off accounts off the bureau file with false identity-theft claims, or signs for someone else. Each piece looks fine on its own — a clean-looking pay stub, a decent score, a stated job — so the application passes the credit model.
The fraud desk only has time for a sample. Recomputing a pay stub, calling an employer, re-reading a bureau file against last month's pull and searching for the same phone on other deals is slow, and the 15:00 funding cutoff decides how deep anyone goes. What gets through is booked as a credit loss: the first payment is missed, it looks like hardship, and it lands in the delinquency line with the car already gone.
Estimated split for one flagged indirect deal, in working hours, by hand and with the solution.
Six specialist agents put every document under a forensics lens and test income, identity, credit and links; the fraud analyst decides before funding.
Jordan T. Ellery signed for a 2024 Ford F-150 Lariat at Gateway Motor Cars on Saturday: $48,960 financed over 72 months. The funding package lands Monday at 07:15, and the dealer expects to be paid by 15:00. Here is what happens next, screen by screen, in the working solution.
Before Tasha opens the case, the agents have read the funding package — 9 documents. The pay stub from Brightwater Logistics LLC comes back altered with 6 findings; the bank statement is genuine but shows no payroll; the Illinois driver's licence is genuine. The first finding is pure arithmetic: year to date is $61,250.00, which is 14 semi-monthly pay periods, and 30 Sep is the 18th.
“Year to date is 14 pay periods, not 18” — 99% confidence · Math
Switched to Edit traces, the lens shows the areas saved separately from the page. Net pay of $3,220.00 is set in a different typeface, 0.4 pt larger and 1 px above the line, at a different compression from the page. The employer logo was pasted on top. Social Security is withheld at 6.0% — $262.50 instead of $271.25 — so net pay comes out round.
“Digits re-rendered, different font from surrounding text” — 96% confidence
The Lakeview Community Credit Union statement has no edits: one font, one compression level, every running balance ties. What it shows is the problem. The “pay” arrives as $3,140.00 Zelle transfers “from B LOGISTICS”, not payroll direct deposits, and each is $80 less than the stub's net pay.
“Pay arrives as app transfers, not payroll” — 98% confidence
The fraud queue holds 47 open cases — $1.94M to be financed — with 19 contracts the dealers expect paid before 15:00. Jordan Ellery sits at the top with a fraud score of 912: income not supported, credit washed, shared employer phone. Further down the list: a credit profile number in place of an SSN, a co-buyer who makes the payments and a licence photo that differs from the state record.
Tasha opens the evidence board and presses Investigate. The application screener re-scores the contract package from 14 sources; the income verifier recomputes the stubs; the identity checker confirms a real person — SSN issued in 2008, consistent with a 1992 birth, licence passes; the credit history analyst compares the 18 Aug and 9 Oct bureau files; the link analyst searches 60 days of applications.
The case recommender drafts the decision — it never declines, files or moves money.
The evidence board sorts every flag into five lanes — income and employment, credit history, links, deal and identity — each with the document, page or record it rests on. The loan is 118% of the truck's book value; the payment is 14% of income on deposits; the phone moved to a new carrier on 1 Oct. And one card is green: identity verified, a real person, not synthetic, not stolen.
The pay stub is recomputed line by line: year to date $61,250.00 against $78,750.00, Social Security $262.50 against $271.25, net pay off by $8.75. The employer was formed in Wyoming on 9 Jun 2026, four months before the application that claims four years and two months; its website domain was registered 21 Aug 2026; its phone, (815) 555-0147, is an internet number that goes to voicemail.
The application's own phone number never counts as proof of employment.
On 18 Aug the bank declined Jordan through Northfield Auto Plaza at a score of 541. Between 27 Aug and 2 Oct, five accounts — $26,815 of charged-off debt — were removed under identity-theft blocks, with an identity theft report filed online and no police report on file. One of them, a Kestrel Auto Credit loan, was paid on time for 19 months before it defaulted.
“A thief does not make 19 payments.”
The Brightwater phone and employer appear on three other applications at two dealers: Dante Rowe at Gateway today, Alicia Moreno at Prairie State Auto, declined on 2 Sep — and Shawn Pruitt at Gateway, funded on 14 Sep for $39,880 with the first payment due 29 Oct. The same pay-stub layout, misspelling and all, is on 11 applications at 4 dealers in 90 days. Tasha opens an early review of the funded loan.
Tasha asks the assistant whether this is credit washing or a real identity-theft victim, and gets the five removals, the 19 payments and the 18 Aug decline, each cited. She signs the decline at 10:38; because it is above $25,000, Owen Pak co-signs at 10:42 from his phone. The contract goes back to Gateway unfunded, the adverse action notice is queued, the BSA team gets the referral, and the pattern goes to dealer review.
“$48,960 stopped before the money left. Decided 3 h 27 min after the contract package arrived.”
The same deal, seen by the five people who carry it — what their day looked like, and what it looks like now.
Six specialist agents put every document under a forensics lens and test income, identity, credit and links; the fraud analyst decides before funding.
Scores every application at submission and again when the contract and stipulations arrive, and ranks the fraud queue by score and the funding cutoff.
Puts each pay stub and bank statement under the lens — fonts, compression, file history — recomputes every line, reads the statements for payroll deposits, and checks the employer's state filing, domain age and phone.
Checks the driver's licence barcode and photo, SSN issue date against birth date, phone and email age, address history and synthetic-identity markers.
Compares the bureau file with every earlier pull the lender holds: accounts removed or blocked since, dispute bursts and score jumps, against the credit washing rule in Settings.
Finds shared phones, employers, emails, addresses and document layouts across applications and dealers.
Builds the evidence board and recommends clear, verify or decline, with the adverse action reasons, the dealer notice and the BSA referral drafted, and routes declines above the analyst's limit to the fraud manager.
Decides; fraud manager co-signs above $25,000. The agents propose; a named person decides.
The fraud team can ask about any case, red flag or pattern — or tell it what to do. Every answer points to its source.
Is this credit washing or a real identity-theft victim?
Credit washing, on the evidence. Five accounts — $26,815 of charged-off debt — were removed under identity-theft blocks between 27 Aug and 2 Oct. One of them, the Kestrel auto loan, was paid on time for 19 months before it defaulted; a thief does not make payments. We declined the same person, SSN and address at 541 on 18 Aug. If a police report or a creditor's fraud confirmation arrives, I will reopen the case.
Why don't the pay stubs add up?
Three reasons. Year to date on the 30 Sep stub is $61,250 — 14 pay periods — but 30 Sep is the 18th semi-monthly pay date. Social Security is withheld at 6.0%, $262.50 instead of $271.25. And the bank shows no payroll: the pay arrives as $3,140 app transfers from “B LOGISTICS”.
What else is tied to Brightwater Logistics?
Three other applications in 60 days use the same employer and phone: Dante Rowe at Gateway, in the queue at $36,480; Shawn Pruitt at Gateway, funded 14 Sep at $39,880; Alicia Moreno at Prairie State, declined 2 Sep. I have opened an early review of Shawn Pruitt's loan — a payroll check and a welcome call before the first payment on 29 Oct.
Draft the decline and send it to Owen
Drafted. Decline for fraud on $48,960: income not supported, credit history misrepresented. The adverse action notice gives “unable to verify income” and “unable to verify credit references”. Because it is above $25,000, Owen Pak co-signs after you, and the BSA referral goes with it.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules every application is screened against. Changes are versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Send to the fraud queue from | Score 700 | Any score from 500 to 900, in steps of 25 |
| Decline review from | Score 850 | 800 · 850 · 900 |
| Proof of stated income above $6,000 a month | Payroll data or IRS transcript (4506-C) | Payroll data or IRS transcript (4506-C) · Two pay stubs and a bank statement · IRS transcript only |
| Pay-stub arithmetic tolerance | $5 per line | $1 · $5 · $25 per line |
| Credit washing rule | 2 or more identity-theft blocks in 90 days | Any block · 2 or more · 3 or more blocks |
| Fraud analyst declines alone up to | $25,000 | $15,000 · $25,000 · $40,000 |
| Second signature | Owen Pak | Owen Pak · Linda Marchetti |
| Funding cutoff | 15:00 CT | 14:00 · 15:00 · 16:00 CT |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, including the 2-day baseline and the hours split · “typical” = published figures (Point Predictive, Auto Lending Fraud Trends 2025 — 43% of exposure is income and employment misrepresentation; up to 70% of early payment defaults show fraud on the application). People, lenders, dealers, employers and applicants named on this page are fictional — characters and sample data in the working solution.
Software that screens auto loan applications and their funding packages for fraud — inflated income, fake employers, synthetic or stolen identities, credit washing and straw buyers — before the lender funds the dealer. Auto Loan Fraud Detection uses six agents to test income, identity, credit history, the deal and the links between applications, and a fraud analyst makes the decision.
Each pay stub is put under a forensics lens: fonts and sizes character by character, areas saved at a different compression from the page, and the file's history. Every line is recomputed — gross, year to date against the pay dates, each tax at its rate, net pay — and checked against payroll deposits on the bank statement.
The credit history analyst compares today's bureau file with earlier pulls and lists every account removed under an identity-theft block, with its payment history. The credit washing rule is a setting — by default two or more blocks in 90 days on accounts with an on-time history. A documented victim, with a police report or a creditor's confirmation, is never treated as a suspect.
No. The agents score, investigate and recommend; they never decline, file a SAR or move money. The fraud analyst decides every flagged application, and a decline above the analyst's limit or a referral to the BSA team needs the fraud manager's second signature.
The link analyst finds shared phones, employers, emails, addresses and document layouts across applications and dealers. Patterns go to a dealer feed for the dealer relationship manager to review — a reason to look at a dealer's deals, not a finding against the dealer.
On signing, the contract goes back to the dealer unfunded, the adverse action notice is queued with its reasons, the BSA team receives a referral with the case file attached, and the pattern goes to dealer review. Linked loans that already funded can be opened for an early review.
Yes. The score that sends a deal to the fraud queue, the decline-review band, the proof required for higher stated incomes, the pay-stub tolerance, the credit washing rule, the analyst's decline limit, the second signer and the funding cutoff are all settings.
The Agentic Solution Engine builds and deploys it from your requirements — your fraud policy, score bands, approval limits and a sample of past flagged deals — and it goes live once every quality gate has passed. We will walk you through it on your own deals first.
We'll run Auto Loan Fraud Detection on a sample of your own flagged deals.