Impersonation Applications And How Lenders Detect Them

Credit taken out in another person's name rarely fails because a document looks wrong. It fails, when it fails, because the application does not fit the data already held about that identity.

Identity is verified against records, not documents

Most consumer applications are checked electronically against credit files, electoral or residency records and other databases, rather than by examining physical documents.

The check asks whether the combination of name, date of birth and address appears in those sources with a consistent history behind it.

An impersonator supplying genuine stolen details can pass that check, which is why identity verification alone does not stop this kind of fraud.

Behavioural signals do more of the work

Application fraud detection looks at how the application was made: the device, the speed of completion, whether details were typed or pasted, and whether the same device has appeared elsewhere.

It also looks at the shape of the request. A first application in years, for the maximum amount, with delivery to a new address, is a recognisable pattern.

These signals are compared with the behaviour of genuine customers rather than with a rulebook, and it is the deviation rather than any single fact that triggers review.

Small mismatches are the usual giveaway

Stolen data is rarely complete. An impersonator may have a name and address but not the exact previous address, the correct employment details or the right contact history.

Where the lender can compare the application against a file it already holds, inconsistencies surface quickly, which is why fraud against existing customers is caught more often than fraud against strangers.

Contact details are the most common tell, because the fraudster must supply a phone number or email that they control rather than one the victim has used before.

Cross-industry sharing raises the cost

In many markets, lenders share confirmed fraud data through industry databases, so an identity or a set of contact details used in one attempt is flagged for others.

Protective registrations, where available, ask members to apply extra verification to applications in a particular name, which slows genuine applications as well as fraudulent ones.

What these schemes are called, who may join them and how a consumer registers differ by country, and some markets have no equivalent at all.

Discovery usually comes late

The victim generally learns of an impersonation attempt from a search appearing on their file, a letter about an account they did not open, or contact from a collector.

The correction route for fraudulent entries differs from an ordinary dispute, because the question is whether the agreement was ever the consumer's rather than whether the data is accurate.

Timescales, evidence requirements and the protections available to victims vary considerably between jurisdictions and have been revised repeatedly in recent years.