How to Detect and Prevent Fraud Rings

by Guest Contributor 4 min read July 1, 2020

Every few months we hear in the news about a fraud ring that has been busted here in the U.S. or in another part of the world. In May, I read about a fraud ring based in Georgia and Louisiana that bought 13,000 stolen identities of children who were on the Louisiana Medicaid program and billed the government for services not rendered. This group defrauded the Medicaid program of more than $500,000.

This is just one of many stories that we hear about fraud rings, and given the rapidly changing economic environment, now is the time for businesses to think about how to protect against fraud rings. There are a number of challenges that organizations may have when it comes to sharing trends and collaborations, understanding the ways to tie fraud rings together, creating treatments for identifying fraud rings and ways to store and catalogue fraud ring experiences so they can be easily recognized.

The trouble with identifying fraud rings

It’s important to understand the challenges that organizations have because they see the fraud rings through their own internal lens. Here are a few of the top things businesses should work on:

  • Think like a fraudster. This will help businesses become more creative in their approach to fraud prevention.
  • Facilitate internal collaboration. Share with in-organization partners. Sometimes this can be difficult due to organizational structure.
  • Promote external collaboration. Intel-sharing groups are a great way for businesses to network within their industries and learn about the fraud that others are seeing. An organization that I’ve worked with in the past is the National Cyber Forensic and Training Alliance (NCFTA).

Putting the pieces together

How do businesses identify a fraud ring? There are three steps to get started. The first is reviewing and understanding the data. Fraudsters are lazy and want to replicate the process over and over again, and because of this there is always some piece of information that is repeated. It could be a name, an email address, device fingerprint, or similar.

The second step is tying the fraud ring together. This is done by creating rules to help identify the trends. Having rules in place to identify fraud rings allows businesses to easily pull stats together for their leadership.

Lastly, applying an acronym or name to the particular fraud ring and adding comments to the cases associated with a particular ring will help with post-investigation analysis.

Learning from the past

Before I became a consultant, I remember identifying a fraud ring that was submitting events with the same language pack and where the device fingerprint was staying consistent. Those events were being referred out for review and marked with the same note. At a post-mortem review, I was able to talk to the fraud ring we had seen, and it was easy to pull all events associated with this fraud ring because my team had marked the events with the same comments.

Another fraud ring example happened a few years ago. A client called me and said that they were under a fraud attack and this fraud ring was rotating the email handle. I reviewed the data and came up with a rule to catch this activity. Fraud rings will use email handle rotation to help them keep track of accounts that are opened or what emails they used in the past. By coupling the email handle rotation with an email verification service like Emailage, this insight could be very telling. I would assume that when fraud rings use email handle rotation these emails are new and have just been created.

These are just a few of the many fraud rings that I’ve encountered over the course of my career and I’m sure there will be a lot more in the years to come. The best advice I can give to anyone that reads this post is to understand the data that you are reviewing, look for anomalies within the data, ask questions and test your theories by running queries on the data that you’re reviewing. I would love to hear about the different fraud rings that you’ve encountered over your career.

Stay safe.

Contact us

Related Posts

Who’s Driving What? How Fuel Loyalty and Generational Preferences are Shaping the Vehicle Market

Take a look around at any road, parking lot, or highway, and you’ll see just how diverse today’s vehicle landscape has become. Within that evolving mix, electric vehicles (EVs) have seen years of rapid growth, and while the market is seemingly entering a new phase, interest remains. So, with several vehicles and fuel types to choose from, what keeps drivers coming back to electrified vehicles? Experian Automotive’s Automotive Market Trends Report: Q2 2026 found that among EV owners who returned to the market in the last 12 months, majority (72.2%) replaced their EV with another EV, while 18.5% switched to a gasoline vehicle. Hybrid buyers also showed considerable loyalty to electrification, with 55.7% of gas-hybrid owners staying with the same fuel type when replacing their vehicle, and 32.7% swapping for a gasoline vehicle. Consumers are seemingly remaining loyal to EVs and hybrids because they are attracted to the benefits that fit their everyday lifestyle, such as lower fuel or charging costs amid the elevated gas prices. For some, it could also be tied to convenience, as drivers who have found a reliable charging routine or appreciate the efficiency of a hybrid may have little reason to switch back to a traditional gasoline vehicle. Generations are taking different paths to electrification Generational differences also influence hybrid and EV loyalty, with younger consumers generally showing greater openness to alternative fuel types. While older generations tend to have greater familiarity with traditional gasoline vehicles, hybrid and EV adoption is increasing across all age groups as these options become more accessible and mainstream. Millennials, in particular, showed the strongest inclination toward electrified vehicles. Through Q2 2026, they accounted for the highest EV share at 8.2%, compared with Gen X at 5.5%, Gen Z (4.7%), and Baby Boomers (4.7%). The difference becomes even more pronounced when hybrids are in the mix, as 23.1% of Millennial registrations were gas-electric hybrids or plug-in hybrids, versus 16.7% for Gen X, 16.8% for Gen Z, and 18.0% for Baby Boomers. For automotive professionals, these differences make understanding who is driving what, and what they may choose next, increasingly important. The future of the automotive market may be less about consumers choosing one vehicle type over the other and more about understanding the distinct patterns and preferences of each generation. As the market continues to evolve, those insights can help automotive professionals better meet consumers where they are. To learn more about vehicle market trends, view the full Automotive Market Trends Report: Q2 2026 presentation on demand.

September 24, 2026 by John Howard
New Data Available for MBS Investors: Current Credit Score 

In a previous post, we described how every mortgage borrower’s financial situation and credit profile evolve over time.  After a borrower opens a loan, their financial status evolves—jobs are gained and lost; incomes can rise or fall, and financially stressful situations or windfalls can occur. These effects are often reflected in the consumer’s evolving credit score, which changes with the consumer’s payment behavior on open loans, credit inquiry activity, credit card utilization, and other revolving lines, among other things.    Even though MBS, whole loan, and MSR investors ultimately bear borrower credit risk, they may have access to less current borrower credit information than other participants in the mortgage ecosystem.   In securitized markets (both agency MBS and private-label MBS), updated scores are not provided in disclosure to bondholders, even as loans age year over year.  In whole loan and MSR markets, a single origination credit score is often provided at the time of bid, and after a successful bid, the investor may have a permissible purpose to pull individual scores on an owned portfolio. But until recently, there was no single loan-level dataset that included continuously refreshed credit scores across the U.S. mortgage market—the type of foundational dataset needed to build and tune credit and prepayment models.  A monthly-refreshed Current Credit Score field meets our three-pronged materiality standard for new data delivery to MBS markets:  New: Provides information not available in existing datasets (i.e., orthogonal to currently available data). Neither private-label MBS nor agency MBS standard market data includes a monthly-refreshed borrower credit score.  Material: Impacts a sizeable portion of the MBS universe. For the vast majority of loans in MBS, borrowers credit scores are available.  Significant: Differentiates collateral performance by a large enough margin to influence trading and risk management decisions.  A current credit score wraps all of a borrower’s credit-related behaviors into a single numerical value and has historically been associated with a borrower’s likelihood of becoming 60+ days past due on any obligation within the subsequent 24 months.    In fact, a current credit score is among the most informative indicators of near-term mortgage default risk, as shown in the image below, which depicts 30+ DPD rates by current credit score bands for the entire U.S. mortgage market, controlling for origination score <=650.    Without access to current credit scores, investors are limited to the score at origination—causing the four distinct performance trends shown here to appear as a single averaged line. In reality, score migration since origination reveals significant divergence in credit risk, with the lowest current-score bucket exhibiting a nearly 10 times higher 30+ DPD rate than the highest-score bucket in the latest period shown.  Source:  Experian Mortgage Loan Performance (MLP) dataset hosted on IVolatility DataDriven Platform  In this article, we’ll take a quick look at how score migration acts as an early predictor of a performing loan’s first roll into 30-day delinquent status.    MBS Investors’ Current Credit Score Blindspot: Solved   An MBS investor relying on standard market data and securitization remittance reports sees no sign of borrower stress until the subject mortgage loan in the securitization misses a payment and is reported at 30 days delinquent. Of course, in the vast majority of cases, a borrower begins struggling financially well before missing a mortgage payment:  The borrower may miss payments on other types of loans (credit card, auto loan, personal unsecured, or payday loans) as they prioritize their home and mortgage.  Outstanding balances on credit cards may grow as the borrower begins to make only minimum payments on revolvers.  The borrower may apply for additional credit cards, personal or payday loans   The borrower may apply to increase limits on existing credit cards as outstanding balance nears spending limit  All these stress-indicative behaviors result in a decreasing credit score, many months before the borrower misses their first mortgage payment. An MBS investor with access to each borrower’s current credit score, refreshed each month, can predict increased likelihood of default many months before the first missed mortgage payment—and is therefore at a major information advantage relative to the market generally.  Experian’s Mortgage Loan Performance (MLP) dataset contains thousands of fields describing mortgage performance from each borrower, loan, and property perspective, all refreshed monthly (including, amongst other things, new credit scores and refinance inquiry activity, loan performance on all types of debt, filed junior liens, and AVM values).   MLP is much more comprehensive than loan-level data provided by Freddie Mac, Fannie Mae, Ginnie Mae, and PLS data vendors in several ways:   Standard market datasets may not contain certain data elements that some market participants consider useful when evaluating mortgage prepayment or credit performance. Basic, critical fields such as the borrower’s current credit score and the current junior lien balance on the property are missing.    MLP contains borrower, loan, and property data fields spanning a broad portion of the mortgage universe, including Agency, Non-Agency, and Esoteric mortgage products (CES, HELOC, Reverse), including both securitized and non-securitized loans.   MLP enables full three-dimensional (borrower + loan + property) tracking with persistent keys for borrower (before and after refinancing), loan (in securities/deals even after exit due to payoffs or buyouts, including before and after MSR sales), and property.  This enables end-to-end analysis of each borrower’s (and property’s) mortgage experience throughout their credit lifecycle.  Is Downward-Trending Credit Score a Signal for Impending Delinquency?  MLP contains thousands of fields describing each loan, borrower, and property across all U.S. mortgages.  It allows for virtually unlimited segmentation and granular analysis.   For purposes of this illustrative article, we’ll take a high-level look at the entire U.S. mortgage market and perform a quick analysis to confirm intuition that a declining credit score provides a signal for higher likelihood of near-term mortgage delinquency.  Figure 1 illustrates the current pay status (as of 6/30) for the entire U.S. mortgage market, as contained in the MLP dataset, along with count, UPB and UPB-weighted Vantage 4.0 credit score for each bucket.  Figure 1  Source:  Experian Mortgage Loan Performance dataset  As illustrated in Figure 1, approximately 772,000 individual mortgage loans were reported to Experian as 30 days delinquent as of 6/30/2026.  Of the 772,000 30d delinquent loans in the June snapshot, approximately 426,000 were current in the prior (May) snapshot.  Some of these 426,000 loans were reperformers which had been bouncing from 30 DPD to current over the prior few snapshots. To remove reperformance score noise, we further parsed out the population which: 1) had rolled from current to 30 DPD from May to June; and 2) was consistently current for a full year prior to the 6/30 missed payment.  The population meeting both conditions totaled approximately 123,000 loans.  Figure 2 below shows, for this population of 123,000 “clean current” loans, the UPB-weighted average Vantage4 credit score for each of the 12 months leading up to the June missed payment, as well as the impact of the missed payment on the 6/30 score.  Figure 2  Source:  Experian Mortgage Loan Performance Dataset  Figure 2 reveals a rather slow and steady ~20-point deterioration of score in the 12 months prior to first missed payment – as well as the 80-point drop once the missed payment hits.  When we compare this cohort’s Vantage 4.0 score trend to the broader Current population across the entire dataset in Figure 3, we see a marked difference in both absolute value and trend:  Figure 3  Source:  Experian Mortgage Loan Performance Dataset  Not only is the cohort’s starting Vantage 4.0 score lower than the broader current population, but it also displays a dropping trend (with a notable 2 to 3x acceleration in monthly score drop the month before the first missed mortgage payment) while the broader Current population’s score (of which the isolated cohort is a subset) remains rock steady.  Lastly, we present Figure 4, a histogram comparing the distribution of at-origination and as-of 5/30 (i.e., the period just before the missed June mortgage payment) credit scores for the clean current population. The distribution appears to shift toward lower credit scores. To the extent credit scores are correlated with credit risk, this shift may indicate elevated credit risk relative to origination. Since this degradation occurs during a period of perfect mortgage pay performance, it is invisible to MBS investors who lack access to current borrower credit scores. Experian MLP provides monthly refreshed credit scores for mortgage borrowers contained within the MLP database.  Figure 4  Source:  Experian Mortgage Loan Performance Dataset 

September 22, 2026 by Michael Pyatski, Perry DeFelice
Ask the Expert: The Future of Lending Starts With Identity With Shawn Rife and Brian Cardona

Identity intelligence and alternative data can help lenders validate consumers and support more informed decisions across the customer lifecycle.

September 16, 2026 by Julie Lee

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe