Lending fraud
Lend to the borrower. Not the identity ring.
Synthetic and stolen identities, employers that do not exist, several applications from one phone, and funds sent to an account the borrower does not own. Omnareth checks every application and disbursement before money moves, and recognizes the phone or device behind a ring across applications.
| # | Event | Decision |
|---|---|---|
| 1 | Genuine application: identity and employer verified | ALLOW |
| 2 | Synthetic identity, verification fails | DENY KYC_FAILED |
| 3 | Stolen identity with a shell employer, same phone and device ▲ Repeat offenders opened; phone and device watched |
DENY EMPLOYMENT_UNVERIFIED |
| 4 | Another synthetic identity, same phone ▲ One phone across three applications: case opened |
DENY KYC_FAILED · WATCHLIST_MATCH · REPEAT_OFFENDER · APPLICATION_HOPPING |
| 5 | The genuine borrower applies a second time ▲ Review case opened; borrower not watched |
FLAG LOAN_STACKING |
| 6 | Disbursement to an account the borrower does not own | DENY ACCOUNT_NOT_VERIFIED · WATCHLIST_MATCH · REPEAT_OFFENDER · APPLICATION_HOPPING |
| – | Analyst confirms the phone case ▲ Phone blocked everywhere |
analyst · state |
| 7 | An underwriter resubmits a ring application with every check passed | DENY WATCHLIST_BLOCK · REPEAT_OFFENDER · APPLICATION_HOPPING |
| 8 | Genuine disbursement to the borrower's verified account | ALLOW |
How it fits
A check before money moves
Synthetic identity fraud is built to pass one check at a time. The ring behind it reuses phones, devices and employers across applications. Your system sends each request to Omnareth and acts only on what it allows.
The application
What the verified income supports, the income tolerance, the approval status and the accounts verified as the applicant's own.
Applications and disbursements
An application needs verified identity and employment and an affordable amount. Funds go only to an approved application and a verified account.
One phone, many identities
Omnareth holds the ring's phone, devices and shell employer responsible, recognizes them across applications, and flags one person applying many times.
Reference rules
11 rules, ready to adapt
Authorization checks fail closed, and every rule names who it holds responsible when it fires.
| Threat | What Omnareth checks | Rule code | Decision |
|---|---|---|---|
| Employment Not Verified | Stated employment must be verified. | EMPLOYMENT_UNVERIFIED | DENY |
| Income Above Verified | Flag stated income above the verified income tolerance. | INCOME_MISMATCH | FLAG |
| Identity Not Verified | An application proceeds only if identity verification passed. | KYC_FAILED | DENY |
| Amount Over Affordability | The amount may not exceed what verified income supports. | OVER_AFFORDABILITY | DENY |
| Disbursement to Unverified Account | Funds go only to an account verified as the applicant's own. | ACCOUNT_NOT_VERIFIED | DENY |
| Disbursement Before Approval | Funds are released only on approved applications. | NOT_APPROVED | DENY |
| Phone or Device Across Applications | Flag a phone, device, employer or account implicated in denials on two or more other applications in the last 24 hours. | APPLICATION_HOPPING | FLAG |
| Loan Stacking | Flag a national ID seen on other applications: one person applying many times in a short period. | LOAN_STACKING | FLAG |
| Repeat Offender | Flag events involving an identity implicated in two or more denied events in the last 30 days. | REPEAT_OFFENDER | FLAG |
| Blocked Identity | Identities blocked on the fraud watchlist may not take part in any application event. | WATCHLIST_BLOCK | DENY |
| Watched Identity | Identities under watch may proceed only with a flag for review. | WATCHLIST_MATCH | FLAG |
The insider case
Every check overridden. Still declined.
After the analyst confirms the case, an underwriter resubmits a ring application with identity and employment marked verified. Every application check passes. Omnareth refuses it on the watchlist, and the audit record shows the block it acted on.
Victims are not suspects
Only the identities a rule implicates are held responsible. Genuine customers named in a fraud attempt are never counted against.
Policy as rules
Your checks run on every request, with the reason and a remediation step recorded.
For auditors and regulators
Every refused request is sealed with what was known at the time, and verifiable later.
Adapt the model
The LoanApplication model, its rules and its fraud identifiers are plain JSON you can change.
Pilot program
Put lending fraud prevention to work in 90 days
One lane, facility or process, in shadow mode, with results measured against criteria we agree with you. Qualified companies and organizations can apply.