Fraud Velocity Checks: Catching Rings Before the Third Application
Fraud velocity checks compare applications to each other. The signal catalogue, entity resolution basics, threshold limits, and who a false link harms.
Alfred BEditorial Reviews
Eight people, at least 150 loan applications, over $18 million. That case appears in the US Small Business Administration Office of Inspector General's June 2023 report on pandemic loan fraud, which also describes one case involving 62 PPP loans that expanded into cases involving 101 pandemic EIDLs. Careful reading inside any single file would not have found it.
Fraud velocity checks compare applications against each other rather than against a policy. They link files that share a device, an address, a bank account or a submission window, then examine the shape and the speed of the resulting cluster. The unit of analysis is the link between applications, not the contents of any single one.
That shift in unit does most of the work. It holds whether the identities are real or fabricated, and whatever documents arrived.
What do fraud velocity checks actually measure?
Fraud velocity checks measure correlation across applications rather than speed within one. The quantities are how many files share an identifier, how tightly they land in time, and how dense the cluster gets. A per-applicant rule asks whether one person is moving too fast. A velocity check asks whether twenty people are moving in step.
Platform research documents why. Alex Beutel and co-authors, presenting CopyCatch at the World Wide Web Conference in 2013, named the object as a temporally coherent bipartite core, a group of accounts acting on the same targets inside a shared time window, and showed that per-account rate limits cannot reach it. Qiang Cao and co-authors carried it further at the ACM Conference on Computer and Communications Security in 2014 with SynchroTrap, which clusters accounts by how similar their actions are over sustained periods. Across five use cases at Facebook and Instagram it surfaced more than two million malicious accounts and 1,156 large attack campaigns in one month.
Neither is a lender. The mechanism transfers. The numbers do not.
Which signals link one application to another, and how strongly?
Applications link through shared identifiers and shared timing: a device, an IP address, a home address, a bank account, a phone number, an email address, or one submission window they all fall inside. Identifiers differ enormously in what a match is worth, and the difference has been measured.
Device fingerprints are weaker at population scale than early work suggested. Alejandro Gómez-Boix, Pierre Laperdrix and Benoit Baudry, reporting at the Web Conference in 2018 on 2,067,942 fingerprints from a mainstream French website, found 33.6% unique overall and 18.5% unique on mobile, against 89.4% in earlier studies of privacy-focused audiences. Two thirds of visitors looked like somebody else.
Network addresses are weaker again, and the Internet Engineering Task Force said so in RFC 6269 in June 2011: where addresses are shared, the IPv4 address no longer uniquely identifies a subscriber. Phone numbers fail differently: Kevin Lee and Arvind Narayanan of Princeton, sampling 259 numbers available to new US subscribers in 2021, found 171 still attached to a previous owner's accounts.
The velocity catalogue: what a shared identifier indicates, and what the published evidence says about its strength.
| Signal | What a match indicates | Evidence and limit |
|---|---|---|
| Device fingerprint reused across applications | Same browser or handset behind multiple files | 33.6% of fingerprints unique overall, 18.5% on mobile (Gómez-Boix, Laperdrix and Baudry, Web Conference 2018) |
| Shared IP address or network | Applications reached the lender through one network path | A shared address does not identify a subscriber (IETF RFC 6269, June 2011) |
| Shared residential address | Applicants live, or claim to live, together | 663,835 Canadian roommate households, up 54% from 2001 to 2021, plus 986,400 households holding more than one generation, more than one census family, or a family with additional persons, of which 441,750 were multigenerational (Statistics Canada, 2021 Census) |
| Shared bank account or deposit instruction | Funds converge on one destination | Named as a link attribute in SBA OIG link analysis (June 2023); joint and family accounts are ordinary |
| Shared phone number | A contact point recurs across applicants | 171 of 259 sampled available US numbers still tied to a previous owner's accounts (Lee and Narayanan, 2021) |
| Shared email address | One inbox behind several files | Multiple accounts receiving unemployment insurance payments tied to one web-based email address, a red flag in FinCEN advisory FIN-2020-A007, October 2020 |
| Lockstep submission timing | Files acted on the same targets in one window | Temporally coherent bipartite core (Beutel and co-authors, WWW 2013) |
| Cluster density in the application graph | A small group of files concentrated on a small set of shared attributes | Density survives accounts that also behave normally (Hooi and co-authors, KDD 2016) |
No row there is a verdict. Each produces a cluster.
How does entity resolution turn applications into a graph?
Entity resolution is the process of deciding which records refer to the same real-world entity. Velocity work depends on it entirely: an application is a bag of strings until something decides two spellings of an address are the same address.
The governing model is old and Canadian. Ivan Fellegi and Alan Sunter, then at the Dominion Bureau of Statistics, published a theory of record linkage in the Journal of the American Statistical Association in December 1969 that still underpins the field. It scores each pair of records by how much more likely their agreement pattern is among true matches than among non-matches, then applies two thresholds rather than one. Above the upper threshold, a link. Below the lower, a non-link. Between them, a possible link routed to clerical review.
Two facts shape every implementation. George Papadakis and co-authors, in their entity resolution survey in ACM Computing Surveys in 2020, state the first: without blocking, resolution carries quadratic time complexity, since every record has to be compared with every other. The second is transitivity. If A links to B and B to C, a naive merge puts all three in one cluster, so a single weak edge pulls in unrelated people.
Véronique Van Vlasselaer and co-authors quantified what the graph buys, reporting in Management Science in 2017 that network variables built from companies connected through shared resources detected up to 55% additional fraudsters.
What number should trip an alert?
No published source establishes one. No research finding sits behind "three applications in seven days" or its cousins, and a count quoted without a citation is a house rule. The published work fixes the shape of the decision rather than its level, because the right level depends on a portfolio's own base rate.
What the literature establishes is the shape of the trade-off. James Doidge and Katie Harron, writing in the International Journal of Population Data Science in 2018, state that there is always a trade-off between missed links and false links, and that either approach can be tuned toward one or the other.
The arithmetic is unforgiving when the target is rare. Stefan Axelsson, in ACM Transactions on Information and System Security in 2000, worked the base rates for intrusion detection: with intrusions at roughly one in 50,000 records, a detector needs a false alarm rate near one in 100,000 before most alarms are real.
Alert volume is not detection. The US Government Accountability Office reported in GAO-25-107267 on 24 March 2025 that the Small Business Administration sent about three million COVID-19 EIDL fraud referrals to its Inspector General, and roughly two million were not actionable for want of usable data. A queue nobody can work is a threshold set wrong.
Who pays when the link is wrong?
Real people, and not a random selection of them. A velocity system that reads co-residence as suspicion declines applicants whose only offence is living where other applicants live, and the households most exposed are those already least well served by credit.
The Canadian numbers are not small. Statistics Canada reported in July 2022, from the 2021 Census, that 663,835 households were composed of roommates, the fastest growth of any household type from 2001 to 2021 at 54%, and that 986,400 households, 7% of the total, held more than one generation, more than one census family, or a census family living with additional persons. Multigenerational households alone numbered 441,750, or 2.9% of private households, and Statistics Canada's August 2025 work put 2.4 million people in them, of whom 52.7% were racialized and 40.5% born outside Canada, against 24.7% and 25.5% in other household types. Address linkage that trips on co-residence is a control whose burden falls hardest on racialized and immigrant families, by arithmetic rather than by intent.
Shelters compress it further. Housing, Infrastructure and Communities Canada counted 35,864 people in sheltered locations across 74 communities, 72 of them in October and November 2024 and Vancouver and Victoria in spring 2025, in its Everyone Counts 2024 report of 12 March 2025. Each shares an address with everyone else in the building, and library terminals and settlement offices do the same for devices.
Linkage error lands unevenly on its own terms. Sean Randall and co-authors, examining four Australian administrative datasets in BMC Health Services Research in 2018, found worse linkage quality for people born from 1980 onward and for those in remote areas, recall in one dataset falling to 0.896 against 0.963 in major cities. Thin identifier histories and recent moves degrade matching, which describes newcomers and young renters.
So a shared address used alone is a household tax dressed as a fraud control, paid by applicants who never learn why they were declined. The engineering answer is to keep the identifier that produced each link attached to the alert, weight it by what that identifier is worth, and require corroboration before a link reaches a decision. What obligations attach to any of it is a separate question this article does not answer.
How to build velocity into an intake flow
- Resolve entities before counting anything. Normalize addresses, phone numbers and account details, then decide which records describe the same person or business. A count of applications sharing an identifier is only as good as the decision that two strings are the same identifier.
- Score links rather than asserting them, in the Fellegi and Sunter form, and keep the middle band. Possible link sent to human review is the outcome most implementations drop.
- Record which identifier produced each link and carry it to the alert. A cluster joined by a shared deposit account and one joined by a shared IP address are different objects.
- Measure the cluster rather than the applicant. Size, density and the tightness of the submission window are what the research operates on.
- Set thresholds on your own book and record that they are yours. No published number exists to borrow.
- Treat a link as a reason to look rather than a reason to decline, and measure the false-positive rate as seriously as the catch rate.
- Run this beside identity and document checks. Velocity finds coordination and says nothing about whether an identity was fabricated, the subject of synthetic identity fraud detection, or whether paperwork came off a shared production line, covered in template-level document signals.
What we couldn't verify
No Canadian regulator, central bank or statistical agency has published research on coordinated application fraud in lending, or on how often shared identifiers recur across Canadian loan files. Equifax Canada, in vendor research released on 1 October 2025, put the Canadian application fraud rate at 0.56% in the second quarter of 2025, down from 0.70% the prior quarter, without breaking out coordinated activity.
The deployment evidence for lockstep detection comes from social platforms rather than lenders. No lender publishes the equivalent loan numbers.
No public source establishes a velocity threshold of any kind, and none measures the false-positive cost of velocity declines in lending. The fairness argument above rests on who shares addresses and devices rather than on measured decline rates. That is the number we most wanted and could not find.
Common questions
What are fraud velocity checks?
Fraud velocity checks compare applications against each other rather than against a policy, linking files that share a device, address, bank account, phone number or submission window, then measuring how many share an identifier and how tightly they cluster in time.
Why do per-applicant limits miss fraud rings?
Because each application in a coordinated group sits comfortably inside a per-applicant limit. Alex Beutel and co-authors showed at the World Wide Web Conference in 2013 that individual rate limits cannot reach groups acting on the same targets inside a shared time window.
What is entity resolution in fraud detection?
Entity resolution decides which records refer to the same real-world entity. Ivan Fellegi and Alan Sunter's 1969 model in the Journal of the American Statistical Association scores each record pair by a probability ratio and applies two thresholds, producing a link, a non-link, or a possible link for human review.
How many applications from one device should trigger a review?
No published research establishes a number. James Doidge and Katie Harron, writing in 2018, describe the choice as an unavoidable trade-off between missed links and false links, tuned on a lender's own data, so any count in circulation is a house rule.
Is a shared address evidence of fraud?
On its own, no. Statistics Canada's 2021 Census records 663,835 roommate households, up 54% from 2001 to 2021 and the fastest growth of any household type, and 2.4 million people in multigenerational households, of whom 52.7% were racialized and 40.5% born outside Canada. Co-residence is an ordinary, unevenly distributed living arrangement.
Carousel resolves applicants and their identifiers at intake, so cross-application patterns surface before a decision. See how verification fits your flow
