What fraud in lending is: types, victims and how it is measured

Fraud and credit loss

A loan can be lost in two ways. In a credit loss, the borrower meant to repay and could not, for example because income fell or other debts grew. In a fraud loss, the money was obtained by deception: the applicant was not who they claimed to be, gave false information, or never intended to repay. The amount lost can be the same; the cause, and so the control that would have prevented it, is different.

The difference matters for the numbers. A credit score is built to predict whether a genuine borrower will repay; it is not built to recognise an applicant who is not genuine. If fraud losses are booked as ordinary bad debts, the credit policy looks worse than it is, and a lender may tighten credit for genuine customers while the fraud continues. The course Credit scoring, from first principles explains how a score is built and tested.

The main types

Fraud in lending is usually grouped by who commits it and whose identity or account is used:

• Third-party identity fraud: someone applies in another person's name or with an invented identity. The Financial Action Task Force, the FATF, describes impersonation as a person pretending to have the identity of another genuine person, and synthetic identities as identities developed by criminals by combining real, usually stolen, and fake information.
• First-party fraud: applicants use their own identity but deceive the lender, for example with false income or with no intention to repay.
• Account takeover: a criminal gains control of a genuine customer's account and borrows, or redirects money, in that customer's name.
• Scams: the genuine customer is deceived into borrowing or paying and passes the money to the criminal, sometimes to someone posing as a lender or an official.
• Insider and partner fraud: staff, agents or partners in the lending chain abuse their access, for example by approving loans they know to be false.

The US Federal Reserve Banks define synthetic identity fraud as the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. The FATF, in its guidance on digital identity, also notes that non-face-to-face customer identification relying on reliable, independent digital identity systems, with appropriate risk mitigation measures in place, may present a standard level of risk, and may even be lower-risk. In the FATF's view, then, identifying a customer remotely is not higher-risk by nature; the reliability of the checks decides.

Who is deceived, and who bears the loss

In identity fraud and first-party fraud, the lender is deceived and normally bears the loss, although a person whose identity was stolen may be left to dispute a debt they never took. In account takeover and scams, the customer is the first victim, and who finally bears the loss depends on the rules of each market and on whether each party met its duties.

Two official figures show how often the customer is the one who pays. The Singapore Police Force reports that 82.4 percent of scam cases in 2024 involved self-effected transfers, in which victims made the transactions themselves after being deceived. In the European Economic Area, the European Banking Authority and the European Central Bank report that payment service users bore about 85 percent of the losses from credit transfer fraud in 2024, mainly from scams that tricked users into initiating the transactions. For a lender, a customer who has lost money is also a customer less able to repay.

Classifying and measuring fraud losses

Bank supervisors classify operational losses by type of event. The Saudi Central Bank's rulebook, which publishes such a classification, defines external fraud as losses due to acts of a type intended to defraud, misappropriate property or circumvent the law by a third party, and internal fraud as similar acts that involve at least one internal party. A lender that never classifies a loss as fraud sees it only as a bad debt, so the first task is to write down when a loss counts as fraud. Then it can be measured:

Fraud loss rate = losses confirmed as fraud ÷ value of loans disbursed in the same period × 100

A worked example with illustrative numbers. A lender disburses 2,000 loans of 500 US dollars in a quarter, 1 million dollars in all. Sixty loans, worth 30,000 dollars, miss the first instalment and never pay anything. A review finds that 40 of them, worth 20,000 dollars, were taken with stolen or synthetic identities. The fraud loss rate is 2 percent, because 20,000 divided by 1 million is 0.02. Without the review, all 30,000 dollars would have appeared as credit losses, 3 percent of the quarter's lending, and the credit policy would have been blamed for losses that a better identity check could have prevented. A loan that is never repaid from the first instalment is a reason to review, not proof of fraud.

How large is fraud? Figures from three regions

There is no comparable international measure of fraud in lending, and published figures count different things. Three dated examples show the difference:

• Singapore: the Singapore Police Force recorded 51,501 scam cases in 2024, up from 46,563 in 2023, and at least 1.1 billion Singapore dollars lost, up from at least 651.8 million. These are scams reported to the police, whatever the payment used.
• The United States: the Federal Trade Commission reports that consumers reported losing more than 12.5 billion US dollars to fraud in 2024, 25 percent more than in 2023, in reports from 2.6 million consumers. These are reports sent to a database, not the results of a survey.
• The European Economic Area: the European Banking Authority and the European Central Bank put payment fraud at 4.2 billion euros in 2024, up from 3.5 billion in 2023, around 0.002 percent of the total value of transactions. These are frauds on payments, reported by payment service providers.

The three figures cannot be added or ranked: they measure scams reported by victims, reports by consumers and frauds on payments, in different currencies and populations. What they share is the direction, since each rose in 2024. For a lender, the conclusion is to measure its own fraud on a definition it controls, and to read any published figure for its definition first.

Reading fraud as a lender

• Write down when a loss counts as fraud, and review loans that default early against that definition.
• Measure fraud losses separately from credit losses, and by type, so that each control can be judged on its own results.
• Keep fraud out of the data used to build and test credit scores, or mark it, so that the score is judged on genuine borrowers.
• Ask of every published fraud figure who reported it, what it counts and in which currency.
• Remember that in scams the customer often bears the loss; the rules on who pays differ by market. The course Cybersecurity and fraud for lenders: the principles covers the controls along the life of a loan, and the anti-money laundering page follows AML/CFT developments.