Online lenders are inviting prey for crooks who hope to score quick money by disguising themselves from afar as legitimate loan applicants.
A study conducted in October by LexisNexis Risk Solutions found that fraud attacks on digital lenders increased 8.2% during the preceding 24 months.
Some online lenders — including Elevate Funding and Credibly — are saying not so fast. They are taking a number of innovative security measures, including the deployment of technology that can spot fabricated photos,
It is an important step because fraudsters try to trick lenders into thinking they have property, licenses, assets, equipment and more that they do not possess.
Traditionally, online lenders have used site-inspection companies to verify the existence of a business customer or its assets. These companies charge a fee to send a person in their network to take pictures on-site at a business.
This process takes time, which is antithetical to the high-speed world of online lending, where credit is typically more expensive but quicker and easier to obtain than traditional bank loans.
“Depending on how remote the merchant's location is, it can be a long wait” for the site-inspection company to do its work, said Ryan Rosett, founder and co-CEO of Credibly, which makes data-driven loans to small businesses.
It made more than $350 million in loans in 2019. Its average loan size is around $55,000. Loan volume has been growing 30% year over year, the company says.
“For somebody in Alaska, it might take 48 hours," Rosett said. “In the rural areas we're working in, time kills deals. These merchants need the money right away.”
It can also be intrusive to have a stranger walk into a business establishment and start taking pictures. Employees may start wondering if the business is in trouble and if they need to look for new jobs.
“A lot of businesses don't want their employees to know that they’re taking out a cash advance,” said Ken Peng, director of marketing at Elevate Funding, which provides working capital to small-business owners with a history of financial hardship or poor credit. It lends about $1.5 million a month and funded 1,400 merchant advances in 2019.
The one- to two-day turnaround time of human site inspectors can also anger sales referrers who might miss out on a commission, Peng said.
“It was just a huge thorn in our side,” he said.
These lenders and others now use software to verify the authenticity of photos submitted with online loan applications.
Finding fraud
When Elevate receives an application for a merchant advance, its underwriting team assesses the risk based on the merchant's background and cash flow. Elevate might project that a company will do $14,000 in sales over the next three months and offer to advance $10,000 of that. Once the borrower accepts an offer, there is a post-underwriting process that includes a series of verifications.
Any loan over $10,000 requires a site survey, which includes taking photos of the business and its license to prove that it is legitimate, open and operating. Elevate uses technology from Truepic to do these site surveys.
Elevate sends a text to potential borrowers with a link to the Truepic interface, which instructs them to take pictures of specific things like their credit card terminal, signage, inventory, business license, transportation license and physical surroundings.
The photos get routed to Truepic, which runs 22 fraud detection tests. These include an analysis of the phone used, to see if it has been jailbroken or rooted, processes that could allow a phone to be manipulated.
A compromised phone “doesn't necessarily mean you're a bad actor, but it certainly means that you have access to different tools on your device that could let you do bad things,” said Craig Stack, founder and co-CEO of Truepic.
Truepic forces users into a controlled-capture environment, so they cannot upload an existing photograph or video — they have to take a new one. Truepic captures the genuine location of the user’s device and the actual time.
“The millisecond they push that shutter button, we're grabbing that image and our server records the universal time and date and pings local cell towers and Wi-Fi networks for the location,” Stack said. “So if you're trying to spoof that metadata, we immediately flag it as a mismatch.”
It produces a report on which photographs or videos passed its tests, which failed and why, and sends it to Elevate within 10 minutes.
The fast turnaround “has helped our referral partners be really excited about being able to fund a deal potentially the same day, versus having to wait an extra day,” Peng said.
In Elevate applications, Truepic has flagged several photos that were taken of other photos that already existed online, such as Google images. It has found some that were not at the borrower’s stated location, but at a business down the street.
In such cases, Elevate will go back to the merchant and ask questions.
“We don't just outright say, ‘Hey, you are committing fraud,’ but a lot of times we'll approach them and ask for an explanation, and then they'll just not respond or they'll give us some excuse,” Peng said. “Then we'll let them know that, due to risk factors, we will not be moving forward with the file.”
Like Elevate, Credibly used to rely on human site inspections to verify physical locations and assets and recently began using Truepic. It typically gets a response within 10 minutes.
Physical site inspections used to cost $75 each, but Credibly pays $50 for each Truepic check.
The occasional borrower who does not know how to use smartphones struggles with Truepic, Rosett acknowledged.
“But for anyone who can navigate a phone, it's super intuitive,” he said.
A fintech for fintechs
Stack started Truepic five and a half years ago with the idea that seeing is no longer believing when it comes to the internet.
“This was a bad problem then,” he said. “It's gotten much worse over the past five years, and it's trending to get even worse as time goes on. Deepfake technology is a runaway train.”
Thousands of apps help people seamlessly manipulate an image, he said.
It's "not just Photoshop editing," but "changing the metadata of an image,” Stack said. “Think time, date, location. This is not a big deal if it’s an image of your kids playing around on Instagram. It’s a really big deal if you're a business looking at a photograph and spending dollars associated with that photograph.”
The company has nine patents and another eight pending on its technology, Stack said.
“We think the current third-party site-inspection process is broken,” he said. “It's slow, it's expensive to the enterprise, it's not customer-centric. In a world where we're all addicted to Amazon Prime, Uber and Postmates, nobody wants to hear, 'Be home next Thursday as we send a stranger with muddy boots to your home,' or 'drive your car with the cracked windshield 20 miles to our preferred auto body shop.' "
Truepic began by working with the insurance industry. Several carriers use the technology to make sure applicants are in possession of an item, and that it is in the condition they say it is in, before the company issues a policy.
“There's a certain threshold where a lot of insurance carriers will roll the dice and hope that the insured is telling the truth about a scenario,” Stack said. “Now they're able to push our technology out via text message and know for sure.”
From insurance, Truepic expanded to working with warranty companies and automotive original equipment manufacturers.
A year ago, the company began working with alternative lenders, and that has become its fastest-growing segment. It is onboarding two or three per week, according to Stack.
