In auto lending alone, fraud exposure is projected to reach $9.2 billion in 2025 — a blunt number that helps explain why fraudsters are learning to “borrow” identities rather than trying to break systems outright.
The organized playbook uncovered by Flare researchers
Researchers at Flare identified a detailed loan-fraud method circulating within an underground group that treats lending workflows as repeatable processes. Rather than exploiting software vulnerabilities, the approach relies on stolen identity data, social engineering, and careful navigation of onboarding and lending steps. The post analyzed by Flare breaks the operation into discrete stages — from identity acquisition to cash-out — and presents them as a reproducible method that can be applied across multiple institutions.
The fraud workflow, step by step
- Identity Acquisition — Stolen personal data is obtained with enough detail to impersonate a legitimate borrower.
- Credit Profile Assessment — Attackers evaluate the victim’s financial profile to assess loan eligibility and approval likelihood.
- Verification Preparation (KBA Readiness) — Additional personal details are gathered to anticipate knowledge-based authentication questions.
- Target Selection — Small- to mid-sized credit unions are chosen based on perceived weaker verification and lower fraud-detection maturity.
- Loan Application Submission — A loan is applied for using the stolen identity, ensuring internal consistency of data.
- Identity Verification Passed — KBA and standard checks are completed successfully.
- Loan Approval and Fund Release — The lender approves the loan and disburses funds through standard channels.
- Fund Movement and Cash-Out — Funds are routed through controlled and intermediary accounts, withdrawn or converted to monetize.
KBA as predictability, not protection
A central point in Flare’s write-up is that identity verification systems based on knowledge-based authentication (KBA) have become predictable: they typically draw on past addresses, loan or credit history, and employment or family associations. Much of those details can be reconstructed or inferred from publicly available data, social media profiles, previously leaked datasets, and aggregated identity records. The result, as described in the source material, is that “verification” can be converted into a predictable step that attackers prepare for in advance — turning a control into a checklist.
Why small- and mid-sized credit unions are focal points
The method explicitly leans toward smaller institutions. The underground discussions referenced in Flare’s research single out small-sized to mid-sized credit unions as attractive targets because they are perceived to be more reliant on traditional identity verification methods, less equipped with advanced behavioral fraud detection, and more likely to emphasize customer accessibility over strict controls. Whether universal or anecdotal, that perception informs attacker targeting and is reflected in recent industry reporting linking rising organized fraud to pressure on smaller and regional lenders.
What this means for technologists, regulators, and credit unions
- Technologists and security teams — The technique detailed by Flare treats onboarding and KBA as the attack surface. Detection should consider the sequence and timing of otherwise-normal actions, and security teams may need signals beyond static data-matching to identify chained behaviors that indicate cash-out in progress.
- Policymakers and regulators — The method underscores the limits of controls that depend on static personal data. Regulators watching consumer lending and auto finance exposure may need to consider how processes, not just software, create exploitable windows for monetization.
- Credit unions and loan operations — The research explains why institutions with limited fraud-prevention resources face elevated risk. Speed of fund movement and the use of intermediaries to separate cash from the originating account make manual review windows critical: once the funds move, detection becomes much harder.
Flare notes that attackers source stolen identities, KBA answers, and financial histories from dark web forums and underground markets well before contacting institutions, and that the firm “monitors thousands of these sources continuously” to detect exposed data at the source rather than after loss. The cash-out phase is particularly effective because each transaction can mirror legitimate behavior; the danger is not a single suspicious transfer but how many normal-looking steps can be completed in a compressed timeframe.
The pattern Flare documents is clear: organized fraud is shifting from technical intrusion to process exploitation, converting identity intelligence into reliably repeatable attacks. The remaining question — implicit in the report’s closing note that “a more adaptive defensive approach” is required — is whether institutions that are perceived as softer targets will close those procedural gaps before the projected losses widen further.
Original story: They don’t hack, they borrow: How fraudsters target credit unions
