Fraud Risk Agent AI

Invoked when: application submitted to the loan origination system, before the underwriting agent processes the credit decision

• –Reads the full application data — KYC documents, financial statements, stated identity fields, declared employment and income, contact details, and digital origination metadata — and checks for internal consistency: name spelling across documents, date of birth across identity documents versus bureau report, PAN linked to the stated name via NSDL records, address on utility bill matching stated address, and employer name consistent across salary slips and Form 16.
• –Cross-checks stated financial data against verifiable signals: a salary slip showing ₹80,000 monthly income for an employer that bureau data shows was struck off from MCA filings six months ago; a GST-registered business that shows zero GST turnover but declares ₹40 lakh annual income; a property document citing a registration number that does not match CERSAI records. Each of these is a specific fraud signal, not a general suspicion.
• –Checks the application against the fraud pattern corpus — the library of known modus operandi used in prior fraud cases at LendingIQ and from industry sharing — and flags any structural match: applications using a specific document format associated with a prior fraud ring, income certificate templates that match previously identified forged documents, or applicant profiles that match a known synthetic identity pattern.
• –Does not authenticate physical documents — it cannot determine whether a document image has been digitally altered, whether a stamp or signature is genuine, or whether a letterhead is authentic. Document authentication requires forensic tools and trained human document examiners. The agent flags inconsistencies in document data; it does not verify the document itself.

Invoked when: application is processed (real-time linkage check) or during monthly portfolio scan to detect slow-burn coordinated fraud patterns

• –Maps the current applicant across every shared identifier in the application database — phone number, email address, PAN, Aadhaar hash, device ID, IP address, bank account number, employer name, and residential address — and identifies all prior applications at LendingIQ that share any of these identifiers, whether those applications were approved, declined, or withdrawn.
• –Extends the network one degree further: where the current application shares an identifier with a prior declined or fraud-flagged application, it maps all other applications that share identifiers with that declined application — building the network graph that reveals whether this applicant is part of a cluster of connected applications that individually look clean but collectively show a coordinated pattern.
• –Checks MCA director linkage data for business borrowers: where the borrower is a company director, it identifies all other companies the director controls, checks those companies' credit histories at LendingIQ, and flags where the director is associated with prior defaulted or fraud-flagged entities. A director with three prior clean-looking company applications that all defaulted within 12 months of disbursement is a network signal the individual-application view cannot see.
• –Cannot access other lenders' databases, CIBIL's fraud exchange, or industry-wide fraud sharing networks autonomously. Cross-industry network analysis requires the agent to be provided with external fraud consortium data as an input — it cannot pull it independently. Where such data is not available, the network analysis is bounded to LendingIQ's own application history.

Invoked when: each application is processed, or when a batch velocity alert is triggered across the portfolio

• –Checks the application entity and its associated identifiers against configurable velocity rules: number of applications from this PAN in the last 30 days, number of applications from this phone number in the last 7 days, number of applications from this device ID in the last 24 hours, number of applications from this IP address subnet in the last hour, and number of applications from this employer in the last 30 days.
• –Applies context-sensitive velocity interpretation: five applications from the same employer in 30 days may be normal (a corporate loan scheme) or a fraud signal (a fake employer used across a ring) — the velocity check flags the pattern and presents the context, but the interpretation of whether it is benign or suspicious requires the human analyst to check the employer legitimacy and whether the five applicants have any prior relationship.
• –For digital origination channels, checks device-level and session-level velocity: multiple applications completed within minutes from the same device suggest either a loan agent processing bulk applications (potentially legitimate, but requiring a different compliance review) or a fraud operation using a single device to submit multiple synthetic identities rapidly. The two scenarios look identical in velocity data but require different responses.
• –Runs a portfolio-level velocity scan on a configurable schedule — weekly or on trigger — to detect slow-burn velocity patterns that real-time checks miss: 20 applications over 60 days from addresses within a single PIN code, all with the same employer, all approved without velocity flags at individual processing time, but collectively forming a pattern that warrants retrospective investigation.