Fake employer loan applications and when concentration warrants review
You have the list of new hires open, and the same kind of employer appears beside name after name in the same region. The pattern is familiar enough that your first move is already taking shape: add the cluster to the blocklist before more applications come through. But the list gives you a category and a place, not yet the story behind each person. You are trying to decide whether this is a group acting through fake employers, sales staff sending applications through the same channel, or simply a run of people whose work looks alike on paper. Where does the useful signal end and the block begin?
Most crowded cell new hires defaulted below expectation
The new hires in the lender’s most striking type-and-region cluster defaulted below expectation. This is the same consumer lender introduced in its analysis of second attempts, with its name changed. The book holds about 310,000 current applications for cash and revolving loans. Every client compared holds a current loan, and default is the lender’s own flag for payment difficulty on that loan. Fraud losses and credit losses receive the same flag.
Across cells with at least 50 clients, default stayed broadly level as the excess share of new hires increased. In the cells with excess of two or more, new hires had adjusted odds of default of 0.94. The most crowded cell looked stronger as a fraud lead: 64% of its clients were new in the job and 43% were first-time clients at the lender. Its new hires defaulted at 7.7%, against 11.8% expected.
Blocking that cell would change approvals and could remove borrowers whose credit risk the score already priced. The book cannot show how much fraud loss a block would prevent, because it has no separate fraud outcome. Treat a crowded cell as a reason to examine the applications, and compare its default experience with the risk already carried by type, tenure and score.
Compare employer concentration with scored risk
Employer type carries real differences in credit risk, so a concentration check needs to account for it before it changes an approval. Across the types with at least 1,000 clients, default ranged from 4.9% to 15.8%. Those differences remained within each outside-score third.
For this comparison, the expected rate is the rate for clients with the same employer type, tenure band and outside-score third. It asks whether a cluster adds information beyond risk the lender already observes. Employer type added 0.003 to ranking power after the outside score, region rating, product and tenure band were included.
Time in the job helps set expected credit performance, so assess new-hire status alongside other evidence. Clients under six months in the job defaulted at 10.6%, while clients one to two years in the job defaulted at 11.4%. Clients new in both the job and at the lender defaulted below their expected rate.
A common mistake is to treat a higher raw default rate as new evidence of fraud because it fits the suspicion. That can turn risk already accounted for in the expected rate into a reason to block an applicant. Compare clusters with type, tenure and score, and use new-in-job status as context rather than a standalone fraud trigger.
Capture employer names to count concentration
The lender’s records identify the employer’s type and the client’s region, so they group applications into broad cells rather than individual firms. A typical client shares a cell with about 300 other clients. In a cell of that size, a ring of ten new hires moves the new-hire share from about 11% to 14%, which sits within the variation across ordinary cells. Ten applications naming the same employer can be counted together.
Employer concentration is a fraud check, but the type-and-region proxy groups firms within a cell. The book has no employer name or registration number, so it cannot separate firms inside a type-and-region cell. Capture both identifiers on the application to build counts around the employer applicants name.
Keep the employer type as a separate risk attribute. The checks inside one application also depend on recording the information needed to assess what the applicant has stated. Choose a suitable source for checking employer identifiers in the lender’s jurisdiction before treating them as verified.
Use payment history for identifiable employers
Earlier payment performance can help assess an established employer, but the comparison has to separate employer history from regional risk. In this book, a cell’s earlier clients appeared to predict later defaults. Once the region’s earlier performance was included, the region carried the relationship and the cell added little.
For a named employer with enough earlier clients, define the earlier group in one period and measure its payment performance on a later group. Hold the region constant, and check whether the employer’s history adds information beyond it. After the application captures employer identity, test whether named-employer history adds information beyond regional risk. This book measures the relationship at cell level.
The current records contain no named-employer histories, and they lack application dates. Use earlier-client performance for employers with enough history, and treat a newly seen employer through the first-seen check instead.
Named employer rules detect rings and create referrals
In simulation, rules using a named employer caught more planted rings than the type-and-region proxy, but some rules referred many real applications. Employers, application weeks and rings were simulated on the lender’s real clients, cells, tenure and scores. The ring default rate used to estimate the payoff was an assumption.
| Rule | Ring 5 | Ring 10 | Ring 20 | Ring 40 | False alarms |
|---|---|---|---|---|---|
| Cell proxy | 16% | 42% | 67% | 95% | 8.9 |
| First seen 90 | 0% | 0% | 0% | 0% | 0 |
| First seen 180 | 86% | 70% | 50% | 26% | 0 to 0.3 |
| First seen 365 | 100% | 100% | 100% | 100% | 0 to 7.7 |
| New-hire share | 100% | 100% | 100% | 100% | 0.8 to 110 |
| Either | 100% | 100% | 100% | 100% | 0.8 to 110 |
| Weekly count | 100% | 100% | 100% | 100% | 2,100 |
| Careful ring, either | 0.6% | 0% | 0% | 0% | 0.8 to 110 |
The cell proxy caught 16% of simulated rings of five. A rule referring an employer with at least three applications in one week, first seen within a year, caught every planted ring in this simulation. Depending on how real new hires were grouped into employers, it referred from zero to 7.7 real applications per 10,000. A 90-day first-seen window caught none, because the simulated applicants’ claimed time in the job put the employer’s first-seen date further back.
A separate rule referring an employer with at least five applicants, at least half of them under six months in the job, also caught every planted ring of five or more. Its referrals ranged from 0.8 to 110 real applications per 10,000, depending on how new hires were grouped. Test this starting rule against referral volume before using it as a fraud threshold. Measuring an employer’s share of new hires against its type gives another comparison. The simulation provides no threshold for this measure.
Weekly count alone caught every planted ring in the main simulation and referred about 2,100 real applications per 10,000. A careful ring claiming seven to eighteen months in the job and spreading applications over eight weeks defeated the cell and new-hire-share rules. The first-seen rule at a year caught 0.6% of those simulated rings of five and none of the larger ones. Weekly count caught 12% of those rings of five and all of those with twenty or more, at the same high referral rate.
The trade-off is simulated rings caught against legitimate applications sent for review. Balance detection against review load, and test referral volume and application outcomes before release. Use the fraud rule backtest tool to test candidate rules.
Concentration flags need investigation
Use a flag to send an application for review, then determine its outcome from the review. In the simulation, real applications referred by the rules defaulted at or below their expected rates, so about nine in ten repaid.
Jo and Max are invented names for clients in the lender’s book. Jo defaulted at a rate the score had already predicted. Max repaid, like 60 of the 65 new hires in the same cell. Kai, a self-employed client, defaulted at a rate the score had already priced.
For a referred application, check whether the employer name and registration number match the source the lender has chosen, then compare the application with the employer-level count and the reason the rule fired. Treat a mismatch or an unusual cluster as a lead to examine alongside other available evidence. Review the referral against other available evidence to determine whether fraud is confirmed.
Set employer checks on the application form
Return to the list of new hires. Jo’s default was already predicted by the score, Max repaid like most new hires in the same cell, and Kai’s default was already priced by the score. The type-and-region cluster cannot identify which applicants belong to a ring. Set up the application form and the checks that follow it in this order:
- Capture the employer’s name and registration number. Select a suitable source for checking those identifiers in the lender’s jurisdiction, and define what counts as a match before treating them as verified.
- Count applications per named employer per week. Capture application dates so the count can be calculated.
- Record the day each employer is first seen. Set the first-seen window to cover the time in the job applicants claim. A year caught the planted rings in the main simulation, while ninety days caught none.
- Measure each named employer’s share of new hires against its own employer type. Test a referral threshold against lender data before using it. The simulation offers no threshold.
- For employers with earlier clients, measure their payment performance out of sample with the region held. Use this as an additional check for established employers, and assess it alongside other evidence before concluding that an employer is fake.
- Do not treat a new job or a first application at the lender as evidence on its own. Assess either alongside other evidence.
- Refer applications flagged by the checks. Record whether the employer details matched the chosen source, whether the count and tenure pattern were accurate, and what other evidence supported or weakened the concern.
Questions about employer verification for loan fraud
How can I tell whether a shared employer points to a fake-employer scheme?
Treat a sudden rise in applications naming the same employer as a reason to investigate, especially if the employer is newly registered or only recently appeared in your records. Compare application dates with claimed job start dates and check whether applicants’ details fit the same pattern. A fraud group may use a fake company, while sales staff may route applications through a shared identity, so establish what is happening before taking action against individual applicants.
What employer information should the loan application capture?
Capture the employer’s legal name, registration number and jurisdiction, along with the applicant’s employment status and claimed start date. Record the application date so you can count applications naming that employer over time and record when the employer first appears in your records. Give self-employed applicants a separate way to provide business and income details rather than treating a missing employer registration number as suspicious.
How should I verify an applicant’s employer and income?
Check the registration number against the relevant official registry, then compare the company’s registration date with the applicant’s claimed start date. A registry entry confirms that a company exists, not that the applicant works there. Contact the employer using a phone number found independently, and compare payslips or bank statements with the income stated on the application.
How far back should employer monitoring look?
Use a rolling 12-month view as a starting point, and extend it when applicants claim longer job tenure. Record the date each employer first appears, then compare the application spike with the employer’s history and applicants’ claimed start dates. A short window can miss a ring that spreads applications over several months, so do not rely on a recent first appearance alone.
