Skip to content

Loan stacking and synthetic identity rings

A ring joins a real ID number to a different face, phone and bank account, and applies to many lenders in a day. DeepID reads the face, the device and the form, and links applications through the accounts they pay out to, so you can cool off or block before the money leaves.

Decision
Cool off or block
Who signs off
Chief risk officer, Head of credit risk, Head of onboarding
The decisionS-6823

Block

BLOCK · face reused · emulator · scripted timing · payout account shared
Your customer sees
We can’t continue with this application in the app. If you think this is a mistake, contact us and we’ll look at it with you.
Your FRM receives
FACE_REUSEDEMULATORSCRIPTED_TIMINGACCOUNT_SHARED
Stopped or heldIllustrative
The decision at the last step, as your console shows it. Real codes and their names are agreed in the sandbox.
On this page

Catch stacked and synthetic applications before disbursal.

A lender approves a small loan on a clean application. The ID number is real, the documents pass and the bureau file shows no recent borrowing. On the same day the same applicant has applied to many other lenders, and none of them can see the others. The loans are disbursed and the defaults follow.

An illustrative scenario, not a real customer’s case.

Step by step.

  1. 1

    A synthetic identity is built

    A ring joins a real ID number to a different face, phone and bank account. Parts of the identity are real, so each element passes its own check.

    Your checks saw

    A real ID number. Documents pass.

    DeepID reads

    A face already seen under a different name and ID number.

  2. 2

    It applies to many lenders in a day

    The same identity applies to many digital lenders within hours, through scripts or emulators. Bureau records have not caught up, so each lender sees one clean application.

    Your checks saw

    A clean bureau file. Other lenders’ loans not yet reported.

    DeepID reads

    The same device behind several applications in your own book today, and a form filled by a script.

  3. 3

    Small loans are repaid to build trust

    The ring repays a few small loans on time to give the identity a track record. Internal scores improve and a higher limit is offered.

    Your checks saw

    On-time repayments. Limit increase offered.

    DeepID reads

    One device running several borrower accounts, and a disbursement account shared with other applicants.

  4. 4

    Large loans are drawn, then default

    With limits raised, the ring draws the largest loans available and stops paying. The phone numbers go silent and the disbursement accounts are emptied.

    Your checks saw

    A trusted repeat borrower. A larger loan approved.

    DeepID reads

    One block before disbursal, with the face, device and payout-account reasons, and the linked applications shown together.

Each check, on its own.

Each of these trusts the picture it is given. Read together across the journey, they stop agreeing, and that is what DeepID reads.

  • Credit bureau check

    Bureau records lag by days or weeks, so loans disbursed by other lenders in the same hours are not yet visible.

  • Document verification

    The ID number and other parts of the identity are real, so the documents pass.

  • Internal velocity rules

    Each lender counts only its own applications and sees one clean request from this applicant.

  • Repayment history

    Small loans are repaid on purpose, so the internal score rises just before the largest loss.

What DeepID reads.

  1. The same face, different names

    Liveness and face match

    The selfie matched to the ID photo with liveness, then searched across your applicants. A face that returns under a new name or ID number is the strongest synthetic-identity sign there is.

  2. eKYC and document checks at the source

    Identity and eKYC

    Aadhaar, PAN and the other ID numbers checked against the records that issue them, and the document’s portrait matched to the live face. A synthetic identity passes parts of this, which is why it is read with the face and the device.

  3. Shared devices and emulators

    Device intelligence

    A device ID that survives reinstalls, and emulators, cloned apps and rooted phones. A device that carries many applications in a short period points to stacking or a scripted ring.

  4. A form filled by a script

    Behavioural biometrics

    Pasted fields, uniform speed and identical paths through the form. Script and bot detection reads input no hand produced.

  5. Applications that pay out to one account

    Payee and mule graph

    Applicants linked through the accounts they pay out to and the devices they share. Applicants who look unrelated on paper but pay out to the same account are treated as one ring.

The decision.

Step up on a device or phone link alone, cool off a genuine borrower who shows several live applications in your own book, and block when a reused face, an emulator and a shared payout account appear together. Capping or staging the loan stays your credit policy.

  1. Allow

    No shared face, device, phone or account, and a form filled by hand. The application goes to the credit decision with nothing added.

  2. Step up

    A device or phone link with no other signal. The applicant completes a face check with liveness before the decision.

  3. Cool off

    A genuine identity with several live applications in your own book. Disbursal starts with a lower amount for a set time, in line with your credit policy.

  4. Hold

    The disbursement account is shared with unrelated applicants. Disbursal waits, and a fraud analyst receives the linked applications.

  5. Block

    A reused face, an emulator and a shared payout account on one application. The application does not proceed, and the linked applications are flagged for the same treatment.

How the actions work

What the customer sees.

“We can’t continue with this application in the app. If you think this is a mistake, contact us and we’ll look at it with you.”
Shown in the lending app when the application is blocked. Illustrative.

Reasons sent to your FRM.

The same decision reaches your FRM, case manager or SIEM as an event, with one code per reason. The codes here are illustrative; real codes and their names are agreed in the sandbox.

  1. FACE_REUSEDSame face seen earlier under a different name
  2. EMULATORApplication from an emulator
  3. SCRIPTED_TIMINGForm fields filled with uniform, scripted timing
  4. ACCOUNT_SHAREDDisbursement account shared with unrelated applicants

What to measure in a pilot.

Agreed in writing before the pilot starts, and counted on your own traffic against what you see today. Faces, devices and payout accounts can be measured on your own history first, in a free retrospective against the loans that defaulted. The form behaviour is proved in a shadow proof on live applications. We publish no figures for these.

  • Defaulted loans that shared a face, device or payout account with another application
  • Applications blocked that you later confirm as synthetic
  • First-payment default rate on the cooled-off segment, against today
  • Genuine applicants blocked or delayed, against the tolerance you set
  • Time added to the application decision

Questions fraud teams ask.

Does DeepID work on our own book alone?

Yes. From the first day it reads repeats inside your own book: a face under different names, a device behind many applicants and a payout account shared between them. It does not see other lenders’ applications.

How do you tell a stressed borrower from a fraud ring?

The signals differ. A stressed borrower is a real person on a personal phone whose face matches the ID. A ring shows reused faces, emulators, scripted forms and shared accounts. You set the response for each: usually a cool-off for stacking and a block for synthetic identities.

Does DeepID replace the bureau check or the credit scorecard?

No. It sits beside the bureau, the scorecard and your loan origination system, and feeds them one decision with its reasons. Credit policy and the final decision stay with you.

Rules it supports.

The controls below are the risk and mule measures on the rule map, dated and sourced on each market page. RBI’s digital lending directions are not mapped yet.

The rule map, by market

DeepID supports compliance with these rules. It never claims to guarantee it.

Wire one moment in the sandbox, before any contract.

Sign-up or login end to end, with the decision back in the app and as an event, so your engineers see the shape of it before anyone signs anything.