Income manipulation. Loan stacking. Synthetic identities. The signals are there — if you know where to look.
Fraud doesn’t always look like fraud. It rarely shows up as an obvious red flag in someone’s credit file. More often, it looks like a reasonable application from a borrower with a decent credit score, a legitimate-sounding employer, and income figures that check out — on paper.
The problem is that “on paper” is increasingly easy to fake. Income documents can be manipulated. Pay stubs can be generated with a few minutes and a free online tool. And credit scores, which reflect borrowing history, tell you almost nothing about whether the financial picture someone presented to you is real.
Cash flow data changes that. When you can look directly at a borrower’s actual bank transactions — the money moving in and out of their accounts in real time — it becomes a lot harder to fabricate a convincing lie. The money either showed up or it didn’t.
The Most Common Fraud Patterns — and What They Look Like in the Data
INCOME MANIPULATION
This is the most widespread form of application fraud. A borrower inflates their income on the application — sometimes by a little, sometimes dramatically. They might submit a doctored pay stub or a manipulated bank statement showing deposits that didn’t actually happen.
Cash flow underwriting makes this much harder to pull off. When you’re looking at 12–24 months of raw transaction data from the borrower’s actual bank account, you can see what income actually looked like month over month. Irregular, inconsistent, or missing deposits that should be there are an immediate signal that something doesn’t add up.
The most dangerous fraud isn’t the obvious kind. It’s a fabricated income that passes a surface-level check. Real bank transaction data is the most reliable way to verify what’s actually happening in someone’s financial life.
LOAN STACKING
Loan stacking happens when a borrower applies for multiple loans from different lenders simultaneously — often within a very short window — before any of the new debt shows up on their credit file. By the time each lender’s credit pull reflects the new obligations, the borrower has already drawn down all the loans and has no intention of repaying them.
Cash flow analysis can catch the signs of stacking behavior. Multiple recent large deposits from what look like other financial institutions, unusually high existing debt service payments relative to income, or transaction patterns consistent with someone drawing down new credit lines are all signals that warrant a harder look.
SYNTHETIC IDENTITY FRAUD
This is the sophisticated end of the fraud spectrum. A synthetic identity is built from a combination of real and fabricated information — often using a real Social Security number combined with fake personal details. The fraudster spends months or years building up a credit history for this fictional person before using it to take out large loans they have no intention of repaying.
Synthetic identities can be hard to catch with credit data alone — the credit history is real, just attached to a person who doesn’t exist. But cash flow data adds another layer of verification. Does the income story match the credit story? Is the bank account activity consistent with someone who’s lived the life that credit file suggests?
GIG INCOME MISREPRESENTATION
Not all income fraud is malicious — sometimes borrowers genuinely overestimate their income, particularly when it comes from gig platforms where earnings fluctuate. But whether intentional or not, the effect is the same: a loan sized to income that isn’t actually there. Cash flow underwriting gives lenders an accurate view of actual gig earnings over time, not just a snapshot that might reflect an unusually good month.
Why Credit Scores Alone Can’t Solve This
Credit scores are backward-looking by design. They reflect what a borrower has done with credit in the past — which is genuinely useful, but it can’t tell you whether the income figure on today’s application is real. A fraudster with a manufactured credit history or a stolen identity can present a perfectly reasonable credit score alongside completely fabricated income documentation.
The fraud is happening at the application layer, not the credit layer. To catch it, you need data that reflects what’s actually happening in the borrower’s financial life right now — and that means transaction-level cash flow data.
How Kora Surfaces Fraud Signals
Kora’s cash flow underwriting platform analyzes transaction data across dozens of dimensions to flag the patterns that indicate fraud risk. We look at income consistency and source verification, deposit timing and frequency, balance behavior over time, payment patterns, and anomalies that suggest document manipulation or account activity inconsistent with the stated application.
These signals feed directly into the Kora Score, giving your underwriting team a clear, data-driven risk assessment that goes well beyond what a credit pull alone can tell you. Legitimate borrowers with strong cash flow get approved faster. Applications with suspicious patterns get flagged for review — before the loan is made, not after.
The fraudsters who are hardest to catch are the ones who look legitimate on paper. Kora helps you see past the paper.
