First-Party Fraud: An Evidence-to-Finance Checklist
A missed payment is an outcome, not an explanation
A loan becomes delinquent. The customer stops responding. An analyst notices inconsistencies in the original application. The account now has a credit-loss outcome and a possible first-party fraud concern. Those are related observations, but they answer different questions.
First-party fraud describes misconduct by the institution’s own customer. About-Fraud’s definitions page distinguishes it from fraud committed through another person’s identity or payment information.[1] A missed payment, however, does not establish deception. Financial distress, a servicing error, an unresolved dispute or other circumstances may also explain the account’s behavior.
The practical problem is not simply deciding which team owns the loss. It is preserving what is known, separating it from inference and giving finance enough information to apply the appropriate treatment without turning suspicion into fact.
A useful handoff keeps three records connected but distinct: the financial outcome, the investigation’s assessment and the action taken. The following checklist proposes a way to do that. It is an operating framework, not a legal definition of fraud or an accounting rule.
1. Describe the alleged act before assigning a label
“First-party fraud” is too broad to be the first entry in a case file. Begin with the suspected act. Was information allegedly falsified when credit was requested? Is the customer disputing a transaction the institution believes they made? Is there evidence of planned misuse after a period of normal behavior?
Then separate the proposition from the evidence. “Income document inconsistent with verified source” is different from “customer deliberately inflated income.” The first describes an observed discrepancy. The second adds attribution and intent, which need their own support.
Use separate fields for the customer associated with the account, the person who apparently performed the act, the suspected conduct and the confidence of the assessment. An account in a real customer’s name does not establish that the customer controlled every device, submitted every document or initiated every payment.
The Federal Reserve’s FraudClassifier announcement describes a question-led approach to payments-fraud classification, beginning with who initiated a payment.[2] It is not a loan-loss accounting standard, but it illustrates a useful discipline: answer the factual classification questions before selecting a final category.
2. Keep an evidence ledger, including the alternative explanation
For each material item, record the source, event time, collection time, verification method and limitations. Retain a reference to the original record under the institution’s access and retention rules. A summary is useful; it should not replace the evidence it summarizes.
A practical ledger can use five fields:
- Observation: what the record actually shows.
- Verification: how the institution checked it and what the check can establish.
- Interpretation: what the analyst thinks it means.
- Alternative: a plausible non-fraud or different-fraud explanation.
- Next step: the proportionate check that could change the assessment.
A document mismatch might reflect alteration, an outdated record or a processing error. Shared device or address data might suggest coordination, but could also reflect a household, shared service or data-quality problem. Those possibilities do not require the team to disregard the signal. They require the team to avoid treating a correlation as a completed finding.
Record contradictory evidence as deliberately as supporting evidence. A case file that accumulates only reasons to confirm the first suspicion becomes difficult to review fairly.
3. Separate the case clock from the finance clock
An investigation may remain unresolved while finance needs to close a reporting period or recognize a loss. The handoff should state what is known as of a specific date and identify the next review point. It should not imply that finance must wait for certainty about intent.
For covered U.S. retail lending, the interagency Uniform Retail-Credit Classification and Account-Management Policy addresses timely recognition of actual credit losses and the treatment of fraudulent loans.[3] Its scope and application matter. An internal suspected-fraud status is not permission to suspend applicable loss-recognition rules, and this checklist does not determine accounting, regulatory reporting or tax treatment.
Give finance the relevant account and exposure identifiers, the balance and recovery information drawn from the appropriate source systems, the investigation status and the evidence supporting that status. Finance should apply its approved policy and applicable requirements, involving accounting or legal specialists where needed.
Keep the investigative label separate from the accounting treatment. A loss can have a fraud-related cause while still requiring a particular financial-reporting treatment. A confirmed cause does not automatically tell the team which ledger account, reserve method or reporting category to use.
4. Use an uncertainty state that people can actually act on
If the system offers only “credit” or “fraud,” analysts may be pushed into false certainty. Consider maintaining a separate investigation status such as unassessed, under review, supported finding or inconclusive, with definitions appropriate to the institution.
These are proposed operational states, not universal industry standards. The institution should define the evidence threshold, permitted uses and review authority for each state. Avoid a percentage score that looks precise but has no tested meaning.
An inconclusive case still needs an owner, an authorized next action and a review date. It may not justify another intrusive verification request. It may also require continued monitoring or a specific information request. The action should follow the evidence and applicable obligations, rather than treating “uncertain” as either “safe” or “guilty.”
Give reviewers a way to record disagreement. A second review is useful only if the reviewer can challenge the interpretation, obtain the underlying evidence and change the proposed conclusion.
5. Make the handoff a decision record, not a forwarded case history
A concise evidence-to-finance handoff should answer:
1. Which account, exposure and event does this assessment cover?
2. What conduct is suspected or supported, and who is believed to have performed it?
3. What verified evidence supports that view, and what evidence points elsewhere?
4. What remains unresolved, and what could change the conclusion?
5. Which investigation status applies under the institution’s definitions?
6. Who reviewed the assessment, when and under what authority?
7. What financial facts are available, and who owns their reconciliation?
8. What action is requested from finance, and which decisions remain finance’s responsibility?
9. When will the case be revisited, and who must receive a correction?
Use a common case identifier, but do not force all teams to use one field for different purposes. The fraud team’s cause assessment, servicing team’s account status and finance team’s treatment can coexist without being identical.
Restrict access to the underlying personal information. The receiving team may need the finding, its basis and a route to authorized review rather than every document collected during the investigation.
6. Test the process with a deliberately ambiguous example
Consider a hypothetical personal-loan account. The borrower misses payments after losing employment. A review also finds that an application document does not match a later verification result.
The delinquency is a financial fact. The employment change may support a hardship explanation. The mismatch warrants investigation, but does not by itself show what the borrower knew when applying. The reviewer would need to consider the document’s source, timing, reliability and any explanation or contrary evidence.
The handoff can therefore report delinquency and verified discrepancies while leaving the intent assessment unresolved. Finance receives the financial facts in time to apply its policy. The investigator receives a defined verification task. Neither team needs to pretend the other question has already been answered.
If later evidence supports intentional falsification, update the investigation assessment with the new evidence and effective date. If the mismatch turns out to be an institutional processing error, correct the record and notify downstream users. Neither conclusion should silently rewrite what was actually known at the earlier reporting date.
This example is illustrative. It is not an account of a real customer, a legal finding or a recommended treatment for a particular loan.
7. Stop uncertain labels from becoming training “truth”
About-Fraud’s manual-review coverage has already explained why fraud taxonomy and analyst feedback matter for credit models.[4] The additional question is whether the label reaching the modeling team is fit for that purpose.
Store the label’s source, status, creation date, review date and relevant definition version. Distinguish the date of the underlying event from the date the institution learned its outcome. A label corrected after an investigation should remain traceable to the version it replaced.
Model owners should decide how to treat unresolved and revised labels. Do not automatically remove every suspicious account from credit-model data, or automatically train a fraud model on every delinquent account. Either choice can change the population and the meaning of the model’s target. Document the rationale, exclusions and limitations, and test whether conclusions depend on disputed cases.
For historical testing, prevent later information from appearing as if it was available at the original decision time. A well-documented final finding can still be an inappropriate input to a backtest if its timing is ignored.
8. Reconcile the money without forcing a single cause
Use finance-approved definitions to distinguish exposure, charge-off, recoveries and other amounts. Do not add a fraud dashboard total to a credit-loss total unless the teams have checked for overlapping accounts, time periods and measurement bases.
A useful reconciliation identifies the population shared by both reports, explains differences and assigns an owner to unresolved items. The goal is a traceable view of the loss, not an artificial rule that every account must live in only one team’s dashboard.
Review how often findings are reversed, how many cases remain unresolved beyond their review dates and how long evidence takes to reach finance. Pair those measures with quality sampling. A fast closure rate can look good while encouraging premature conclusions; a large fraud total can reflect a labeling change rather than a change in underlying behavior.
Close with a question, not a presumption
A defensible handoff does not demand certainty where the evidence cannot supply it. It makes uncertainty visible, assigns the next decision and preserves the financial facts that cannot wait.
Review one recent case with fraud, credit risk and finance together. Can each team identify the alleged act, verified evidence, unresolved question and owner of the next action? Can they reconcile the financial outcome without treating a missed payment as proof of intent?
If not, start with the handoff. Better detection is useful, but a finding only helps when the next team understands exactly what it does, and does not, establish.
Sources
[1] About-Fraud, “Fraud Definitions,” first-party fraud and related entries.
[2] Federal Reserve, “Federal Reserve announces FraudClassifier Model to help organizations classify fraud involving payments,” June 18, 2020. Cited for question-led classification, not lending or accounting rules.
http://federalreserve.gov/newsevents/pressreleases/other20200618a.htm
[3] Federal Reserve, “Uniform Retail-Credit Classification and Account-Management Policy,” issued by FFIEC June 12, 2000. Cited within its U.S. retail-credit scope, not as a universal fraud-loss allocation rule.
[4] Max Blumenfeld, “The Importance of Manual Review,” About-Fraud, July 21, 2021. Cited for the role of analyst taxonomy and feedback; no historical percentage claims are repeated here.
| Posted in: | AF Education |