First payment default fraud: how to tell it from a credit miss

First payment default fraud is the first question a credit risk team asks when a vintage turns: how much of this is fraud? The honest answer is usually "the biggest branch, not the whole tree". A loan that misses its first payment can be fraud — a borrower who was never going to pay — but it can just as easily be a credit miss the policy admitted knowingly, an onboarding slip the bank caused itself, or a borrower hit by real hardship. Each cause has a different owner and a different fix, and Early Payment Default Review exists to tell them apart from the evidence in each file before the wrong team tightens the wrong lever.

The examples come from a fictional sample bank — Lanternfield Bank, whose August vintage of 4,812 personal loans produced 87 early defaults that the solution's agents split into four causes. Every figure from that vintage is sample data on invented people and partners, offered as an illustration of the method, never as a base rate another lender should expect. The research figures come from regulators and peer-reviewed studies, linked where they appear.

Four reasons a loan defaults on its first payment — and why mixing them up costs twice

Sort 87 early defaults by cause and the single number becomes four problems of different sizes. In the sample vintage: fraud, 34 loans and $551,300, of which 19 turn out to be one ring; credit, 29 loans and $389,250, of which 21 were approved only because a July rule change lifted a debt-to-income cap; onboarding, 16 loans and $214,700, of which 13 chose autopay that the bank's app never saved; and hardship, 8 loans and $113,200, split between job loss and medical events. The mix is sample data; the structure is the point. Every vintage of any size contains some of all four, and the proportions decide which meeting the month requires.

Mixing the four up costs twice. Treat fraud as a credit problem and the score cut-off rises, good borrowers are declined, and the ring — whose applications all passed the old score anyway — keeps lending itself money. Treat a credit miss as fraud and the fraud team burns weeks on files that say what they say, while the rule that actually caused the losses stays in force. The OCC's Retail Lending handbook names the underlying discipline: "Policy exceptions for retail lending typically fall into three categories: Credit policy: Loan-to-value (LTV), debt-to-income, pricing, verification, etc. Credit scoring: High- and low-side overrides. Documentation: Loan application, transaction information, and collateral perfection or valuation" (Comptroller's Handbook, Retail Lending). An early default is the loudest exception a book can raise, and it deserves the same three-category reading.

Is it fraud? The signals that separate a ring from bad luck

Fraud's signature is that the file was never real. The signals repeat across loans and point at infrastructure someone built: a device fingerprint appearing on several applications that claim to be strangers; receiving bank accounts opened days before the applications and taking several loans each; pay stubs from different "employers" produced from one template, down to the same fonts and the same pay-date error; employer phone numbers that are internet lines registered the same month. In the sample vintage, the file of Tyler R. Quinlan — $18,500, approved automatically at a score of 702 — carried all of these: device DV-7F3A on 6 other applications, a pay stub matching 18 others, an employer phone registered 9 July, an account opened 19 days before applying. Not one payment was ever attempted.

Single signals are weak; the constellation is strong. One shared device can be a household; a shared device, a shared template, a fresh account and a voice that answers for two employers is a ring. FinCEN's definition of the identity fabricator behind many such files is precise: synthetic identity is "the use of a combination of real and fake PII to fabricate a person or entity" (FinCEN, Identity-Related Suspicious Activity, January 2024). The tell is that the borrower exists only on paper assembled for the application.

The file that says it: one loan, end to end, with the cause to confirm

Is it a credit miss? What “the policy let in a borrower it shouldn’t have” looks like

A credit miss is honest paperwork admitting a risky loan. The income is real, the employer exists, the account is old — but the ratios were stretched at the edge of policy, or past it, when a rule changed. In the sample vintage, rule CP-26-07 raised the debt-to-income cap for scores 640–679 from 40% to 45% on 14 July; August booked 412 loans in that band above the old cap, and 21 of the early defaults were approved only under the new line. Those loans defaulted early at 5.10%, against 1.62% for similar loans below 40%. Nothing on those files is fake. The policy decided to carry more risk, and the vintage reported back.

The regulatory floor for what verification must look like is the ability-to-repay rule: "A creditor must verify the information that the creditor relies on in determining a consumer's repayment ability under Section 1026.43(c)(2) using reasonably reliable third-party records" (12 CFR 1026.43(c)(3)). Notice what the rule does not do: it does not decide the credit appetite. A lender may lawfully approve a 44% debt-to-income loan with verified income; the question an early default asks is whether the policy meant to carry that risk in that band, and what changing it back would cost — a replay question, not a blame question.

Is it onboarding? When the lender, not the borrower, causes the first missed payment

Onboarding is the branch nobody wants to find, because the borrower did everything right. They chose autopay at funding; the app version released that week never stored the instruction. They signed a contract with one first due date; the statement said another. In the sample vintage, 13 borrowers chose autopay on Android app 6.14 between 3 and 21 August, no debit authorisation was stored, and nothing was drafted — each became 30 days late on a payment they believed was automatic. The tell is in the bank's own logs, not the borrower's file: the authorisation request that never completed, the due date mismatch against the signed contract, the welcome letter never sent.

This branch matters beyond its count, for two reasons. First, it is the cheapest to fix and the most damaging to ignore: re-enrol the autopay, waive the fee, correct the late mark with the bureaus — three actions that erase a harm the bank caused. Second, it poisons the count if left mixed in: a vintage that includes bank-made lates overstates credit risk and understates fraud's share, and any tightening response misfires on both.

Is it hardship? The smallest and most misread branch

Hardship is the branch everyone pictures first and finds last. Job loss and medical events do put borrowers 30 days late on new loans, but they are the smallest share of a typical early-default vintage — 8 of 87 in the sample — and they arrive with an honest file: long-standing account, real employer, years of address history, payments attempted and reversed for insufficient funds rather than never attempted at all. The borrower in trouble usually pays once. A loan that never pays once is rarely hardship.

Misreading hardship runs in both directions. Treating hardship as fraud invites a complaint; treating fraud as hardship gives the ring another month. The evidence distinguishes them cleanly — hardship's files show a life event, fraud's files show fabrication — which is why the cause has to come from the file and not from the narrative the borrower or the branch supplies.

Why misrepresented loans default at a much higher rate than honest ones

The reason cause-sorting beats score-sorting is measurable. In the NBER study of non-agency mortgage sales, loans whose disclosures were flattered — occupancy reported as primary when it was not, a second lien omitted — "ex post delinquencies of such loans are more than 60% higher when compared with otherwise similar loans" (NBER Working Paper 18843). Otherwise similar is the operative phrase: same score band, same vintage, same size. The misrepresentation itself carried the risk. A score built on verified-looking numbers cannot see that risk, because the numbers it sees were composed for it. The study is about mortgages sold to investors, and the authors place at least part of the misreporting with intermediaries rather than borrowers, but the lesson carries: whoever flattered the file, the loan's risk followed the truth, not the disclosure.

That is the strongest argument for reading causes before moving cut-offs. If a third of the early defaults trace to fabricated files, tightening the score cut-off prunes honest volume while the ring's applications — which were always engineered to pass — keep arriving. The waste is measurable in two places: the good loans declined, and the fraud still funded.

What happens when a lender tightens the score cut-off instead of finding the cause

The failure mode is familiar to every credit committee. The early-default rate rises; the fastest lever is the score cut-off; it moves; next month's rate improves slightly and the underlying problem continues. In the sample vintage the reflex would have been especially wrong: the ring's applications scored well, because a composed file scores well, and the credit misses sat in a band the score barely touched — scores 640–679 admitted by a debt-to-income change. The what-if in the solution replays the vintage under a 42% cap with a $1,800 residual-income floor: 268 of the 412 loans are declined, 17 of the 21 early defaults are avoided, and the 144 loans kept default at 2.8%. That is the conversation the committee needed — priced, owned by the credit policy manager, and passed through fair-lending review first — not a cut-off moved in the dark.

How to build a cause taxonomy your team will actually use

A taxonomy fails when it is too fine to agree on. Four causes — fraud, credit, onboarding, hardship — with a written evidence standard for each, is coarse enough that two analysts sort the same file the same way, and fine enough to route each fix. The build order that works: start with the file's own documents, not the borrower's story; require each cause to cite the document, record or check it rests on; record the runner-up cause so disagreement has somewhere to live; and let a person confirm every cause, with bulk confirmation only above a confidence threshold the bank sets.

In the sample run the taxonomy held up under load: 79 of 87 proposed causes were confirmed together at the configured confidence threshold, and the remaining 8 were read one by one. The split — and what it cost the bank that skipped it — is followed through to the money in what fraud actually costs a bank, and the rings in the fraud branch are followed into how a synthetic-identity ring is actually found. To see the four causes proposed, confirmed and routed on a working vintage, start from Early Payment Default Review.

Questions people ask

What causes early payment defaults?

Four things, in most vintages: fraud — a borrower who was never going to pay; a credit miss — a policy that admitted more risk than it meant to; an onboarding slip — the bank breaking a step between approval and the first payment; and genuine hardship. The vintage rate alone cannot say which; only the files can.

How can you tell first payment default fraud from a credit miss?

Fraud's evidence is fabrication: shared devices and accounts, document templates reused across "employers", phone numbers that are internet lines, no payment ever attempted. A credit miss's evidence is an honest file with a stretched ratio, usually clustering in the band a rule change touched. The file, not the borrower's story, decides.

Is loan fraud a felony?

It can be. Knowingly making a false statement to influence a loan decision at an FDIC-insured bank is a federal crime under 18 U.S.C. 1014, punishable by a fine of up to $1,000,000, up to 30 years in prison, or both (18 U.S.C. 1014). For a lender, though, the immediate question is evidentiary — separating fabricated files from honest misses — because the fix for each belongs to a different team.

What are credit policy exceptions?

Loans approved outside a standing policy line — the OCC groups them as credit-policy exceptions (loan-to-value, debt-to-income, pricing, verification), credit-scoring overrides on the high or low side, and documentation exceptions. An early default is often the exception coming due, which is why exception volumes belong in board reporting.

Do early payment defaults mean the credit policy is broken?

Not by themselves — some credit misses are the policy working as written and admitting priced risk. The question the files answer is whether the rule that admitted the loans meant to carry that risk, and what changing it back would cost in volume and avoided defaults.

What should we fix first: the ring or the rule?

Whichever the vintage's split says, and usually both, owned separately. Close the ring's door and refer it to the BSA team while it is still open; replay and amend the rule that admitted the credit misses. Treating one as a substitute for the other is how rings stay open and rules stay loose.