Auto loan fraud detection, explained.

How a car loan built on a lie gets approved and paid out

The life of one indirect car loan, in five steps

1. The buyer applies at the dealershipThe dealer sends the application to several lenders at once. Jordan Ellery states $8,750 a month at an employer he has worked for four years.
2. A lender approves in secondsA credit score and the lender's rules decide. Jordan's file shows 702, so the deal clears.
3. The funding package is checkedThe signed contract, pay stubs, bank statement and license arrive. This is where the 14 pay dates, the missing payroll and the washed credit file are found, or missed.
4. The lender pays the dealerOnce the dealer is paid, the money is gone; what is left is a loan and a car.
5. The first payments come dueA fraud that slipped through shows up here, as a missed first payment, and is booked as a credit loss unless someone looks back.

Step 3 is the subject of this guide. The people, lenders and figures in this example are fictional.

What surprises fraud teams: the real buyer lies and fake stubs add up

Stipulations, first-party fraud, credit washing and early payment default defined

Fourteen terms are defined in the one-page summary.

Seven kinds of auto loan fraud, who commits each, and what it leaves behind

In shortAuto loan fraud splits by who lies and about what. Income and employment lies are the largest share, followed by synthetic identities and washed credit, stolen identities, inflated collateral, straw buyers and bust-out rings. Each kind leaves different traces, which is why one fraud score cannot settle a case on its own.

The industry's most quoted breakdown comes from Point Predictive, which scores applications for lenders and keeps a shared database of confirmed fraud. Its 2026 report, released in April and covering 2025, estimates $10.4 billion of auto lending fraud exposure, up from $9.2 billion in 2024.1,5 The report does not define "exposure", say how much of it lenders lose or explain in detail how it builds the estimate, so treat it as one vendor's measure of risk from its own data; no regulator publishes a national figure.

The rules a fraud decline must satisfy in October 2026, after the CARS Rule fell

In shortNo rule tells a lender how to screen for fraud. The Red Flags Rule makes it keep a written identity theft program; the credit reporting law sets fraud alerts and identity theft blocks; Regulation B sets the notice a declined buyer gets; and banks and credit unions report suspected crimes. The FTC's dealer rule is gone, enforcement moved to case-by-case actions and the states, and the model and fair lending guidance changed in 2026.

Where suspicious activity reporting stops

Suspicious activity reports bind banks, credit unions and some other financial businesses. FinCEN's definition of a "loan or finance company" covers only residential mortgage lenders and originators, so a nonbank auto finance company has no federal duty to file one.22 Many still report fraud to law enforcement and share it with the lenders and vendors they work with.

A bank's threshold depends on the facts: the OCC's rule requires a report for any amount when an insider is involved, $5,000 or more when a suspect can be identified, and $25,000 or more when none can.19 An attempted fraud counts, so a deal declined before funding can still call for a report.

The October 2025 FAQs from FinCEN and the four bank agencies say there is no legal requirement to document a decision not to file, that no separate review is required after a report to see whether the activity continued, and that filing continuing-activity reports on FinCEN's 90-day cycle is optional. They "do not alter existing BSA legal or regulatory requirements", BSA being the Bank Secrecy Act, the anti-money-laundering law behind these reports.8

How income fraud works on a car loan, and how a pay stub gives itself away

In shortIncome and employment lies are the largest kind of auto fraud and are growing fastest. A pay stub is tested four ways: its arithmetic, the payroll deposits on the bank statement, whether the employer exists, and the file itself. Arithmetic alone is no longer enough, because the tools that make fake stubs now compute the taxes.

Point Predictive puts income and employment misrepresentation at $4.68 billion of 2025 exposure, up 21% on the year.1 It keeps a list of more than 17,300 employers it has confirmed as fake; in 2025 applicants naming them filed 16,973 applications that scored as near-certain fraud, about $412.9 million of loans.1

In March 2026 the same vendor told dealers that one in five pay stubs submitted with auto loans is fake and that stub generators cost about $10 online.23 Those are a vendor's figures from its own lenders; they say the problem is common, and the exact share at your lender is something only your own files can tell you.

Four tests for one pay stub

One stub worked through

In the example at the top of this page, Jordan Ellery's employer pays twice a month, $4,375.00 gross each time, which is the $105,000 a year he stated. His stub is dated September 30.

Stated income was $8,750 a month; deposits were $6,280. On stated income the $894.48 payment is 10% of income; on what was deposited it is 14%. The lender would not have approved the second number on the same terms, which is the point of the lie.

Why the arithmetic will not catch the next one

Point Predictive's 2026 report, citing the document-fraud firm Inscribe, says AI-generated fraudulent documents rose about 500% between April and December 2025, and that the newer pay stub tools calculate "withholdings, deductions, and net pay", "eliminating math errors that used to catch fakes".1

A fake made that way passes test 1. It still has to be paid into a bank account by an employer that exists, which is why tests 2 and 3, and an income source the applicant cannot edit, carry the weight. That source can be payroll data from a verification service, or an IRS income transcript requested with the applicant's consent on Form 4506-C.

An applicant who tells one lender $80,000 and another $55,000 has made at least one false statement. Lenders that see the applications sent to other lenders, through a shared database, can catch it; a lender that sees only its own cannot.

Stolen, invented or washed: three identity problems and the tests that tell them apart

In shortA stolen identity uses a real person's good file; a synthetic identity is a person who does not exist; a washed file belongs to a real person who has hidden his own debts. They need different tests and different responses, and one rule outranks the rest: a real victim of identity theft is never treated as a suspect.

Synthetic identities

The Federal Reserve's industry definition of synthetic identity fraud is "the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain".24 A synthetic borrower often starts as a Social Security number with no history, or a "credit privacy number" sold online, and is fed small accounts until the file looks established.

Point Predictive found 142,465 synthetic applications among nearly 19 million it scored in 2025, an attack rate of 0.75%, about 1 in 133, with an average of 14.5 months between building the identity and using it.1 TransUnion estimated lenders' exposure to synthetic identities at $2.4 billion at the end of June 2026, the largest share, $1.5 billion, in auto lending.25

Two things cut synthetic attacks after 2024, by the vendor's account: SSA's electronic Consent Based SSN Verification service, which lets a lender check, with the applicant's consent, that a name, birth date and number match SSA's records, and fraud scoring before funding.1 SSA lowered the service's yearly fees from April 7, 2025; the smallest tier, up to 10,000 checks a year, costs $5,100.26

One old test has weakened: since 2011 SSA assigns numbers at random, so the digits of a newer number say nothing about where it was issued.27 A number first issued to an adult in 2019 is a reason to look closer, because many legitimate new arrivals get their first number as adults.

Credit washing

Under §605B of the Fair Credit Reporting Act, a consumer who gives a bureau proof of identity, an identity theft report, the items in question and a statement that they are not his transactions gets those items blocked within four business days.2

The bureau then tells the creditor. It may decline or remove the block if it was made in error, rested on "a material misrepresentation of fact by the consumer", or if the consumer received goods, services or money from the blocked accounts.2 A washed file looks like any good file; the accounts are simply not there.

Point Predictive's credit washing alert, applications whose score jumped while negative accounts fell away, rose from 0.34% in 2019 to 1.70% in 2024 and was 1.54% in 2025.1 Its 2026 report adds a newer route, the "data breach method": telling a bureau one's data was exposed in a breach and asking for negative accounts to be investigated or removed, without filing an identity theft report at all.1

Fraud at the dealership: straw buyers, power booking, phantom cars and packed add-ons

In shortIn indirect lending the dealer fills in the application, describes the car and sells the add-ons, so some fraud starts there: options added to raise the book value, income "adjusted" to fit a program, cars that do not exist, buyers who sign for someone else, and products the buyer never agreed to. A few dealers account for a large share, which makes patterns across deals the strongest evidence.

How each dealer scheme works, and what catches it

Straw buyer and dealer fraud cases, 2024 to 2026

Point Predictive counted more than 400 dealers in "extreme risk conditions" and 255 dealers with more than 50 confirmed fraud incidents in the past year, at an average of $45,000 per incident.23 Its survey of more than 35 auto finance companies found that 60% require dealers to buy back loans that prove fraudulent or default early, and 15% never do.23 A buyback demand is only as strong as the evidence behind it, which is the same evidence that would have stopped the loan before funding.

A pattern across a dealer's deals is a reason to review that dealer's deals; any finding comes from the review. Dealers are victims of fraud too: the same 2026 report describes rings that clone dealer websites to sell cars that do not exist.1

Which warning signs predict a first payment default, ranked by how much they raise the risk

In shortA loan that misses its first payments was very often never true. Point Predictive's index of auto loans defaulting within 90 days stood at about twice its 2017 level at the end of 2025, and the vendor says more than 70% of early defaults carry evidence of fraud at origination. The strongest warning signs are the ones that link an application to other applications.

A first payment default is a loan whose first payment is never made; an early payment default stops within the first few payments, 90 days in Point Predictive's index. Credit trouble rarely arrives that fast, so lenders treat an early default as a fraud question first. Point Predictive's index was 212 at the end of 2025, against 100 in 2017 and a peak of 216 in late 2022, and its 2026 report states that "Over 70% of early payment defaults contain evidence of origination fraud".1 Its 2025 report put the figure at "up to 70%".31

Every signal in that list is invisible on a single application read alone. A phone number that also appears on three other deals, an employer that recurs across two dealers, a home address that is a private mailbox used by five applicants: each needs a search across applications, the lender's own and, where it shares data, other lenders'. The Red Flags Rule's own examples include an address or phone number "the same as or similar to" one given by "an unusually large number of other persons opening accounts or by other customers".14

What an early default costs, and who pays

Regulator, attorney general and court actions from 2024 to 2026, and the lesson in each

In shortFederal rule-writing on auto finance stopped in 2025, but enforcement did not: the FTC kept bringing dealer cases under its general powers, state attorneys general took the largest action, prosecutors charged straw-buyer and dealer schemes, and the collapse of a subprime lender showed fraud aimed at a lender's own funders. Every case turns on documents someone could have checked.

The FTC's 2026 actions concern advertising and add-ons. They show where federal attention went after the CARS Rule fell: case-by-case enforcement under Section 5, warning letters first.9,35

Funded fraud hides in record delinquency; over-flagging sends dealers to faster lenders

In shortFraud that funds becomes a loss hidden in delinquency at a time when the share of auto loans turning seriously delinquent is the highest since 2010. Too much flagging costs too: dealers send their next deal to a faster lender, honest buyers wait, and declines must still be explained in specific words. A fraud program is judged on both.

Auto loan balances stood at $1.713 trillion at the end of June 2026, and $211 billion of new auto loans appeared on credit reports in the second quarter alone.36 When more honest borrowers fall behind, a fraudulent loan that never paid looks like one more hardship case, and the fraud is never counted.

Which check catches which fraud

Slow flags, fair lending and the other risks of fraud screening

A $10 billion fraud estimate on a $1.7 trillion auto book: what the vendors measure and what nobody does

In shortNo government agency measures auto loan fraud. The figures come from vendors that see applications or credit files across many lenders: Point Predictive puts 2025 exposure at $10.4 billion, TransUnion's credit data shows fraud losses in auto lending rising sharply since 2018, and SentiLink finds auto lending the one industry where first-party fraud outruns identity theft. Read them as directions, from each vendor's own data.

Average car loans and payments behind the fraud estimates

Experian put the average new-vehicle loan at $43,610 with a $765 payment in the second quarter of 2026, and the average used-vehicle loan at $27,852 with a record $542 payment; 60-day delinquency was 0.90%.39 Banks held 27.15% of auto financing, captive finance companies 26.26% and credit unions 20.38%.39,40 Bigger loans and longer terms raise what a single fraudulent deal costs.

Mortgage lending has a long-running public index for comparison: Cotality, the company formerly named CoreLogic, estimates that 1 in 119 mortgage applications carries indications of fraud, and lists income among its six fraud types.41 It publishes no auto figure; we found no CoreLogic or Cotality auto fraud index as of October 2026.

Which funding-package checks software can run, and which decisions SR 26-2 and the Red Flags Rule leave with people

In shortSoftware can read every document in every funding package, redo the arithmetic, look for payroll in the bank statement, test the employer and the file, compare credit files over time and link applications across dealers. It cannot decide what a person intended. Model guidance, the Red Flags Rule and Regulation B set what a lender must still own: the program, the validation, the reasons and the decision.

What changes when every package is read

What SR 26-2 and the Red Flags Rule expect of fraud scores

SR 26-2, issued on April 17, 2026 with OCC Bulletin 2026-13 and FDIC FIL-15-2026, replaced SR 11-7. Statistical and machine-learning fraud scores fall inside its definition of a model and need validation and monitoring in proportion to their risk; generative AI and AI that acts on its own are outside its scope and governed by each bank's own controls.10

The Red Flags Rule makes the identity theft program the lender's own, approved by its board and kept current.15 Regulation B keeps decline reasons specific, whatever produced the decision.17 Colorado's SB26-189 adds notice, a plain-language explanation and human review for automated decisions in "financial or lending services" from January 1, 2027.13

What an AI-made pay stub and a fraud score still leave to an analyst

• A document made by AI from scratch, with correct arithmetic, passes the arithmetic test. The payroll source, the employer and the links still have to be checked.1
• A fraud score is a signal. It is never the reason on a decline notice, and a high score on a real victim calls for a phone call before anything else.16,17
• Shared fraud data covers only the lenders that contribute to it. A ring that uses lenders outside the network is seen only by the links inside your own book.
• Every rule that flags by place, age or occupation should be reviewed for fair lending before it goes live.

A day on an auto fraud desk: the queue, the hand-offs and the checks skipped at cutoff

In shortA score flags the deal at the dealership, the funding package arrives a day or two later, and a fraud analyst works the flagged deals against a funding cutoff: recomputing stubs, calling employers, reading credit files and searching for links. A manager signs the larger declines, a BSA team files reports at a bank, and a dealer manager handles the dealer. Most of the hours go to gathering evidence; the decision itself is the short part.

Fraud analyst, fraud manager, funder, dealer manager and auto credit risk

Four people between a flagged deal and the dealer's payment

Gathering evidence fills most of a hand-worked fraud review

Few teams spend 16 hours on one deal. With 40 or 50 flagged deals and a single funding cutoff, analysts choose what to skip: the employer call that goes to voicemail, the credit file from last month, the search for the same phone number. That choice is where fraud gets through.

Bureau and score tools, verification vendors or automated package review

Jordan Ellery's $48,960 truck loan: three lies found and the contract sent back before the 3:00 p.m. cutoff

In shortThis is the example from the top of the page, inside the product. Before the fraud analyst opens the case, the funding package's documents have been read under a forensics lens. She runs the investigation, reads the evidence board, checks the credit history, and declines for fraud; because the loan is above her $25,000 limit, the fraud manager co-signs. The contract goes back to the dealer unpaid.

1

The pay stub, already under the lens

The funding package from Corvelle Motor Cars arrived at 7:15 a.m.: nine documents. By 7:16 the pay stub from Brightwater Logistics LLC is marked altered, with six findings. Tasha Greer, the fraud analyst, moves the round lens over the page. Where it crosses net pay, the figure glows red: "Digits re-rendered, different font from surrounding text", 96% confidence.

The other findings sit in the right-hand list with a plain explanation each: year to date is 14 pay dates where September 30 is the 18th, Social Security at 6.0%, a pasted logo, and a misspelling, "Medicare Tax Withold", seen on 11 applications at four dealers.

2

A real bank statement with no pay on it

The statement from Marlbrook Community Credit Union passes every forensic test: one font, one compression level, all nine running balances add up. What it shows is the problem. The "pay" arrives as two app transfers of $3,140.00 "from B LOGISTICS", on September 1 and 16, each $80 less than the stub's net pay. There is no payroll deposit in August or September.

The driver's license is genuine too: the barcode matches the printed details and the photo matches the dealer's picture. The buyer is a real person.

3

Six checks run, 14 red flags with their sources

Tasha opens the evidence board and presses Investigate. In 1 minute 22 seconds the run reads 14 sources, from the contract and both bureau files to 60 days of other applications. The fraud score is 912 of 999, driven by income (310), credit history (280) and links (190).

The board holds 14 red flags, nine red and five amber, each in a lane with the document it rests on. The identity lane carries one green card: a real person, so this is first-party fraud and no identity theft victim is involved.

4

Declined at 541 in August, 702 in October

The credit history tab sets the bank's own August 18 pull beside today's file. In August, through another dealer, the same man, number and address were declined at 541 with five charged-off accounts. An identity theft report was filed online on August 24; between August 27 and October 2 all five accounts, $26,815 of charged-off debt, were blocked as identity theft. One was a car loan paid on time for 19 months before it defaulted.

No police report is on file. Tasha asks the assistant whether this is washing or a real victim; it answers with the five removals, the 19 payments and the August decline, each cited.

5

Declined, co-signed, and the contract back unpaid

Tasha signs "Decline for fraud" at 10:38 a.m. The amount is above her $25,000 limit, so Owen Pak, the fraud manager, co-signs at 10:42 from his phone. On the second signature the contract goes back to the dealer unfunded, the decline notice is queued with the reasons "unable to verify income" and "unable to verify credit references", the bank's BSA team gets a referral, and the pattern goes to dealer review.

$48,960 never left the bank. The decision came 3 hours 27 minutes after the package arrived, with 4 hours 18 minutes to spare before the 3:00 p.m. cutoff.

The solution's design targets are that every high-risk application is decided by an analyst before funding, and a median of 3.4 hours from a flag to a signed decision, against an estimated two days when a sample is worked by hand. They are targets, to be measured on your own deals.

The rest of the fraud desk on thirteen screens: the morning queue, the lens, the links and the lender's fraud policy

In shortOne deal is the story. These screens show the rest: the queue ranked by score and cutoff, the lens's other modes, a license that passes, the investigation as it runs, every red flag in its lane, the income and employer checks, the removed accounts, the links to other deals, what happens on signing, the patterns across weeks and the policy settings.

Select any screen to open it larger. The lender, dealers, employer, applicants, people and figures are fictional sample data.

What each of the six agents checks, and the two signatures a fraud decline needs

In shortEach agent has one job and limits it does not cross. None of them declines a deal, files a report, contacts an employer on its own or moves money. A fraud analyst decides every flagged application before funding; a decline above the analyst's limit and every referral to the BSA team need the fraud manager's second signature.

Screener to case recommender: six fraud checks on every funding package

Who signs a fraud decline, who co-signs it and who owns the Red Flags program

Signatures record the name, the decision, what it means and the time. Agent steps and human decisions are kept apart on the activity record. A deal still open at the funding cutoff is held, never funded by default.

Harrow Valley Bank's fraud desk, funding analyst and dealer manager

What the fraud review reads from dealers and bureaus, and what it hands to funding, BSA and dealer teams

In shortIt reads what dealers and bureaus already send: the application, the contract, pay stubs, bank statements, the license and the credit files. It leaves behind a ranked queue, an evidence board per flagged deal, signed decisions with their reasons, referrals, and a pattern feed for dealer review. Your origination system and bureau connections stay where they are.

Origination, dealer platform, bureaus and BSA case tools the review reads

For each, check whether it has an API, a file feed or only screens, and who owns it.

Your fraud scores, earlier credit pulls and Red Flags program stay in place

Every red flag with its document, victims protected, a person deciding

Auto fraud costs hide in your credit losses and your funding times: how to find your own number

In shortStart from your own numbers. Nobody publishes what auto fraud costs a given lender, how long a review takes or how often a flag is wrong, so the figures that matter are in your own files. A few published figures frame them: the industry's estimated exposure, how fast auto loans are going bad, and what an analyst hour costs.

Funded fraud, held clean deals and lost dealers: costs to count yourself

A ring seen one deal at a time, a misread reserve, a declined victim

Analyst hours and stopped losses: estimating the return on automated fraud review

In shortPut in your own numbers. The return has two parts: analyst hours released on every reviewed deal, and fraud losses stopped before funding. The first you can measure in a month; the second needs a year of early defaults, so treat it as the larger and less certain part.

Six ways package review pays, from analyst hours to backed buyback demands

Analyst hours and stopped fraud losses on your own deal volume

A lender that reviews 6,000 deals a year at 2.5 hours each spends about $840,000 of analyst time on them at $56 an hour; saving 1.75 hours a deal releases about $588,000. Losses stopped are the less certain half: measure them on a year of early defaults before you count on them.

How ready your auto fraud desk is: score eight questions, reflect on a ninth

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Baseline, back-test or full desk: where your fraud score points

Auto loan fraud detection software: eighteen questions on pay stubs, washed files, victims and proof

In shortAsk every vendor the same questions, us included. The answers show what the tool reads, how it treats victims, what evidence you keep, whose policy applies and how you would measure it on your own deals.

We found no published independent test of any auto fraud vendor's catch rate, as of October 2026. A blind back-test on your own past deals, with outcomes you already know, is the fairest comparison, and the same test measures your current process.

Start with last year's early defaults: a back-test, a parallel run and a decision in twelve weeks

In shortMeasure first, then back-test on past deals with known outcomes, then run in parallel on live deals, then decide with three numbers. None of these steps commits you to a vendor.

1. Review 30 early defaults from last year for fraud on the application, and time ten current reviews. That is your baseline.
2. Build a back-test set: about 200 past funded deals, including confirmed fraud, early defaults and clean loans, with their funding packages and the credit pulls you held at the time.
3. Write your policy as settings: score bands, proof required, the washing rule, signing limits, decline reasons.
4. Run in parallel on live deals for five weeks, with your analysts deciding every case as today.
5. Decide with three numbers: catches by kind of fraud, false flags on clean deals, and analyst minutes to a signed decision.

Catches by fraud type, false flags, analyst minutes and time to decision

Auto loan fraud questions people ask, from fake pay stubs to the CARS Rule

In shortThe questions fraud teams, funding desks and buyers search for most, each answered on its own.