Lending and Institutional Fraud

Lending and institutional fraud is the use of false identities, fabricated income, or insider access to extract money from lenders, employers, and government programs. Unlike payment fraud, the criminal isn't intercepting a transaction in flight. They're convincing an institution to originate a payment that should never have been made. The targets range from auto loans and mortgages to payroll, tax refunds, and unemployment benefits.

The Perfect Borrower Who Never Existed

The loan went delinquent at three months. No payments, no contact. When the credit union tried to repossess, the car had vanished.

Terrence pulled the original application. Borrower named Michael Torres. Credit score of 740. Steady employment at a manufacturing company. Modest used Honda from a local dealership. Everything had checked out.

He called the employment verification number. Prepaid cell, disconnected. He checked the address. Vacant lot since 2019. He searched for Michael Torres in public records. Nothing matched.

The credit bureau file looked real. Two years of payment history on a secured card, a small installment loan paid off early. But the person behind it didn't exist.

Terrence started pulling similar cases. Same pattern at fourteen lenders across the region. Different names, different dealerships, same playbook. Thin credit files that looked just good enough. Employment that couldn't be verified after the fact. Addresses that led nowhere. Cars that vanished.

By the time he connected the dots, the group had extracted over $2 million. The cars were probably overseas by now, or stripped for parts.

This story is fictional, but the patterns are real.

Why This Matters

Throughout this module, you've seen how criminals exploit payment rails: the authorization-settlement gap in card transactions, the irreversibility of wires, the chargeback system in e-commerce. Those attacks target money in motion.

This article covers a different category: fraud that targets money at the source. Instead of intercepting or redirecting payments, these schemes convince institutions to hand over money based on false pretenses. Loan applications with fake income. Payroll systems with fake employees. Tax returns with stolen identities.

What connects these frauds isn't the payment method. It's the shared criminal infrastructure. The same stolen Social Security numbers used for synthetic identity loan fraud also appear in tax refund schemes and unemployment claims. The same document forgers who create fake pay stubs for mortgage applications create fake invoices for expense fraud. Understanding one helps you recognize the others.

Lending Fraud

Lending fraud occurs when someone obtains a loan they don't intend to repay, using false information to qualify. The mechanics vary by loan type, but the core pattern remains: deceive the lender about identity, income, or intent.

Mortgage Fraud

Mortgages are high-value targets. A single fraudulent mortgage can net hundreds of thousands of dollars. The complexity of real estate transactions creates multiple points of vulnerability.

Income falsification. Borrowers overstate income to qualify for larger loans. This ranges from inflating salary figures to fabricating entire employment histories. Some schemes use "employer verification" services that confirm fake jobs for a fee. The stated income looks legitimate because someone answers the phone and vouches for it.

Straw buyers. When someone can't qualify for a mortgage due to bad credit or existing debt, they recruit someone else to apply on their behalf. The straw buyer might be compensated with a few thousand dollars for lending their identity and credit score. They sign the paperwork, the loan funds, and the real buyer takes possession. When the mortgage defaults, the straw buyer's credit is destroyed, but they often had little to lose.

Appraisal fraud. Inflated appraisals allow larger loans against properties worth less than claimed. A corrupt appraiser might value a $200,000 home at $280,000, enabling a larger loan with a smaller down payment. When the borrower defaults, the lender can't recover the full amount because the collateral was never worth what they thought.

Occupancy fraud. Investment properties carry higher interest rates than primary residences. Borrowers claim they'll live in properties they actually intend to rent out or flip. The false occupancy declaration reduces their interest rate and down payment requirements.

How does auto loan fraud work?

Auto loans move faster than mortgages. Decisions happen in hours, not weeks. This speed creates opportunity.

Synthetic identity fraud. Terrence's case illustrates the pattern. Criminals build synthetic identities by combining real Social Security numbers (often belonging to children, the elderly, or deceased individuals) with fabricated personal details. The Federal Reserve's payments security initiative describes synthetic identity fraud as the fastest-growing type of financial crime in the United States.^[1] Sophisticated operations nurture these identities over months, establishing credit history with small accounts that get paid on time, a pattern identity verification at account opening is designed to catch but often misses. Others skip the buildup and apply directly, accepting lower approval rates in exchange for speed. Either way, the endgame is the same: get the loan, take the car, disappear.

Dealer collusion. Some fraud involves the dealership itself. A corrupt dealer might inflate a vehicle's value to enable a larger loan, pocketing the difference. Or they work directly with fraudsters, processing loans for synthetic identities and splitting the proceeds. The lender sends money for a car sale that was fraudulent from the start.

Straw purchases. Similar to mortgage straw buyers, someone with poor credit pays a person with good credit to apply for the loan. The car goes to the person who can't qualify. When the loan defaults, the straw buyer faces collections and credit damage.

Personal and Student Loan Fraud

Unsecured personal loans and student loans present different vulnerabilities.

Application fraud. Without collateral to verify, lenders rely heavily on stated income and employment. Falsifying these details is straightforward for criminals with access to document templates. Fake pay stubs, fake employer letters, fake tax returns.

Student loan schemes. Some fraud involves fake students enrolling in real schools to collect loan disbursements. Others involve real students at fake schools that exist only to harvest federal loan dollars. The "school" collects tuition, provides minimal or no education, and closes before regulators catch on.

Instant Credit Fraud

Buy Now, Pay Later services represent a distinct fraud category covered in depth in E-commerce Fraud. BNPL has a different risk model than traditional lending: the BNPL provider bears the loss, not the merchant. This creates unique abuse patterns including merchant collusion schemes.

Internal Employee Fraud

Not all fraud comes from outside. Sometimes the threat is already on the payroll.

What is a ghost employee?

A ghost employee is someone on the payroll who doesn't actually work for the company. The fraud works because payroll systems assume HR records are accurate. The ACFE's Occupational Fraud 2024: A Report to the Nations found that asset misappropriation (the category that includes ghost employees, falsified wages, and other payroll schemes) appeared in 89% of the 1,921 occupational fraud cases studied, with a median per-case loss of $120,000.^[2]

The mechanics. Someone with access to HR or payroll systems creates a fake employee record. The ghost might have a plausible name, a real-looking Social Security number (often stolen), and direct deposit to an account the fraudster controls. Paychecks flow to the ghost. The company pays for work that never happens.

Who does this. Ghost employee fraud typically requires insider access. Payroll clerks, HR administrators, or managers with system permissions can add records without oversight. In smaller companies, a single person might handle both hiring and payroll, eliminating the segregation of duties that would catch the fraud.

How it's discovered. Ghost employees often surface during audits, when physical headcounts don't match payroll records. They might also appear when the fake Social Security number triggers a mismatch with the IRS. Some ghosts persist for years before discovery, especially in large organizations with high turnover.

Timesheet and Overtime Fraud

Real employees can also defraud their employers through inflated hours.

Timesheet padding. Employees report hours they didn't work. This is easiest in environments with manual timekeeping and minimal supervision. A field service technician might report eight hours for a job that took four. A remote worker might log full days while actually working elsewhere.

Overtime schemes. Some employees manipulate their schedules to generate overtime. They work slowly during regular hours, then clock overtime to finish tasks they could have completed in standard time. Supervisors who approve timesheets without scrutiny enable this fraud.

Buddy punching. One employee clocks in for another who isn't actually present. Time clocks that rely on PINs or cards rather than biometrics are vulnerable. The absent employee might be running a side business, working another job, or just not showing up.

Expense Fraud

Business expense systems assume employees submit legitimate costs. Many don't.

Fake receipts. Employees submit receipts for expenses they didn't incur. Template receipts are widely available. Creating a convincing-looking receipt for a business dinner or hotel stay takes minutes.

Inflated expenses. Real purchases get marked up. A $50 cab ride becomes $80. A $200 client dinner becomes $400. Small inflations across many expense reports add up.

Personal expenses as business. The line between business and personal spending blurs. A "business trip" includes personal vacation days. A "client gift" goes to a family member. The expense is real, but the business purpose is fiction.

Government Program Fraud

Government programs disburse trillions of dollars annually. The scale attracts organized fraud.

How does tax refund fraud work?

The IRS processes hundreds of millions of tax returns each year. They can't verify every single one. Criminals exploit this scale problem.

The pattern. Criminals obtain stolen personal information: names, Social Security numbers, dates of birth. They file fraudulent tax returns claiming refunds based on fabricated income and withholding. The IRS issues refunds, often via direct deposit to accounts the criminals control. Most fraudulent returns slip through because there's no practical way to verify them all.

Why early filing helps. The IRS generally accepts the first return filed for a given Social Security number. Criminals often file early in the season, before legitimate taxpayers get around to it. When the real taxpayer files, their return gets rejected as a duplicate. They face months of delays proving they're the real person.

Scale. Tax refund fraud has declined from its peak due to IRS countermeasures, but it remains substantial. The same stolen identity data sold on criminal marketplaces for credit card fraud also enables tax fraud.

Unemployment and Benefits Fraud

Unemployment systems face a tension between speed and verification. People who lose jobs need money quickly. But fast disbursement creates fraud opportunities.

Pandemic-era explosion. During 2020-2021, unemployment systems nationwide were overwhelmed. States prioritized speed to get money to legitimate claimants. Criminals exploited this, filing millions of fraudulent claims using stolen identities. The U.S. Government Accountability Office estimated total UI fraud during the pandemic (April 2020 to May 2023) at $100 billion to $135 billion (between 11% and 15% of all UI benefits paid in that period).^[3]

Ongoing patterns. Even outside crisis periods, unemployment fraud continues. Criminals file claims using stolen identities, directing payments to accounts they control. Some schemes involve people who are actually employed filing claims, essentially double-dipping.

Benefits Fraud

SNAP (food stamps), disability benefits, Medicaid, and other programs face similar vulnerabilities.

Eligibility fraud. Applicants misrepresent income, household composition, or other factors to qualify for benefits they shouldn't receive. A household might hide income or claim non-existent dependents.

Trafficking. SNAP benefits can be exchanged for cash at complicit retailers. The retailer processes a fake purchase, gives the beneficiary cash at a discount, and keeps the difference. The retailer receives government reimbursement for goods never sold.

Gig Economy Fraud

Rideshare, delivery, and gig platforms face their own fraud patterns. Drivers and riders both exploit these systems.

Driver-Side Fraud

Phantom rides. A driver creates fake rider accounts and completes trips that never happen. They request a ride from themselves, accept it, and mark it complete. GPS spoofing tools make the fake trip appear legitimate. The platform pays for a ride that never occurred.

Distance inflation. Drivers manipulate GPS or take unnecessarily long routes to inflate fare amounts. On rides where the passenger isn't paying close attention, extra miles mean extra money.

Promotion abuse. Platforms offer incentives like guaranteed earnings, completion bonuses, or surge multipliers. Most major platforms ended cash referral bonuses for new drivers in 2022 and 2023, but quest bonuses (complete X rides in Y hours), peak-hour multipliers, and new-market launch incentives remain. Fraudsters create multiple driver accounts, complete fake rides between their own accounts, and collect whatever promotional payouts are active.

Rider-Side Fraud

Refund fraud. Riders claim trips never happened, or that drivers took wrong routes, to get refunds for legitimate rides. Some riders abuse refund policies systematically, getting free rides repeatedly before being caught.

Promo stacking. Riders create multiple accounts to abuse new-user promotions. Each account gets a first-ride discount, then gets abandoned.

Delivery Platform Fraud

Food delivery platforms face similar issues.

Phantom deliveries. Drivers mark orders as delivered when they weren't. They keep the food or never picked it up at all. The customer complains, gets a refund, and the platform eats the loss.

Restaurant collusion. A restaurant and delivery driver work together. The driver marks fake orders as picked up and delivered. The platform pays the restaurant and the driver for food that was never made.

These patterns mirror the institutional fraud covered earlier. False claims for payment, exploiting verification gaps, disappearing before anyone catches on. The difference is scale: gig platforms process millions of small transactions daily, making individual fraud hard to spot.

The Shared Infrastructure

What connects a fake auto loan in Ohio to a fraudulent tax return in Florida? Often, the same criminal networks.

The criminal supply chain that provides stolen card data also provides the raw materials for institutional fraud: Social Security numbers, identity documents, employment verification services, and money movement infrastructure.

A synthetic identity might be used first to open a bank account, then to apply for credit cards, then to take out an auto loan, and finally to file a fraudulent tax return. The same fake identity, multiple fraud types, maximum extraction before the scheme collapses.

Key Takeaways

• Lending fraud targets money at the source. Instead of intercepting payments, these schemes convince lenders to hand over money based on false applications.
• Synthetic identities are hard to detect because no real person notices the fraud. The identity was built to defraud.
• Internal fraud requires insider access but can persist for years in organizations with poor controls.
• Government program fraud scales with program size. Larger benefit programs attract more organized fraud.
• Gig platforms face the same patterns at high volume. Phantom rides, fake deliveries, and promotion abuse mirror institutional fraud but across millions of small transactions.
• The same criminal infrastructure enables multiple fraud types. Stolen identities used for loans also work for tax refunds and benefits.

What's next: The Investigation Techniques article covers how investigators trace money after fraud occurs.

Key Terms

References

1. Federal Reserve — Synthetic Identity Payments Fraud (FedPayments Improvement)↗ — Synthetic identity fraud is reported to be the fastest-growing type of financial crime in the United States, accounting for billions in losses annually.

2. ACFE — Occupational Fraud 2024: A Report to the Nations↗ — Study of 1,921 occupational fraud cases across 138 countries totaling more than $3.1 billion in losses. Asset misappropriation (the category that includes ghost employee, falsified wages, and commission schemes) appeared in 89% of cases, with a median per-case loss of $120,000.

3. U.S. GAO — Unemployment Insurance: Estimated Amount of Fraud During Pandemic Likely Between $100 Billion and $135 Billion (GAO-23-106696, September 2023)↗ — Estimate covers April 2020 (first full month of payments from all UI programs) through May 2023 (end of the public health emergency); represents 11%-15% of total UI benefits paid in the period. The Department of Labor disputed the methodology as overstating the true figure.