10 red flags AI catches in loan applications (that humans miss under time pressure)
Ten specific red-flag patterns that LLMs reliably surface from pasted application text — with the signal, the prompt logic that catches it, and the false-positive rate you should expect.
This post is part of the ongoing pillar on AI fraud detection for lenders. Where the pillar walks the four fraud patterns at a strategic level, this post is the tactical version — ten specific signals an LLM can be prompted to surface reliably, with the detection logic and false-positive ranges to expect.
A red flag is not proof. It’s a reason to look harder. What follows are the ten reasons-to-look-harder that pay off most often.
1. Arithmetic inconsistencies on payslips and statements
What it catches. Gross, deductions, and net don’t sum. Opening-balance-forward on a bank statement doesn’t match prior-month closing. Itemised deductions don’t total to the deduction sum.
Why AI is good at it. Pattern-matching across a structured document and doing simple arithmetic is bread-and-butter LLM territory. The prompt just has to tell the model what to look for.
False-positive rate. Low — around 3–8%. Legitimate arithmetic errors in documents do happen occasionally, particularly in old-format or small-employer payslips. The flag is usually warranted.
What you do with a hit. Request a revised document or verify directly with the employer. Don’t auto-decline — many real files have minor errors.
2. Cross-document field mismatches
What it catches. Employer name spelled differently on the payslip vs the employer letter. Role listed as “Senior Engineer” on one document and “Lead Engineer” on another. Tenure implied by payslip date doesn’t match employer-letter start date.
Why AI is good. Comparing fields across documents is exactly what LLMs do well — the task is entity-matching plus discrepancy-surfacing, both natural language tasks.
False-positive rate. Medium — 12–20%. Harmless inconsistencies are very common (nickname on one, formal name on another; minor spelling variations).
What you do with a hit. A quick reference call or direct HR-email ping resolves it. Flag for operations review, not hard decline.
3. Unusual timing of digital footprint elements
What it catches. PAN issued 20 years ago but the phone number associated with it is 3 months old. Email address created 2 weeks before the application. LinkedIn profile has 12 months of content but no connections before the last 2 months.
Why AI is good. Integrating multiple timing signals and noticing when they don’t form a coherent human narrative — this is exactly the kind of multi-signal fusion LLMs handle well.
False-positive rate. Medium — 15–25%. Real humans do sometimes change phones and create fresh emails, especially young adults or recent immigrants.
What you do with a hit. This is the #1 synthetic-identity signal. Escalate to video KYC or out-of-band verification.
4. Suspiciously smooth application forms
What it catches. Zero typos, perfect formatting consistency, every optional field completed precisely, language unnaturally polished for the stated demographic. Classic tell of copy-paste application farms.
Why AI is good. LLMs have excellent intuition for “natural” human writing vs “template-quality” writing, because they’ve trained on both at massive scale.
False-positive rate. Higher — 20–30%. Many meticulous, genuinely detail-oriented applicants produce clean forms. This flag alone isn’t enough.
What you do with a hit. Use it as a modifier — combine with any other flag to raise overall risk. Never act on this signal alone.
5. Round-number income just above a threshold
What it catches. Net monthly income stated as exactly INR 50,000 when your minimum eligibility is INR 45,000. Or exactly INR 1,00,000 when a better pricing tier starts at 1,00,000.
Why AI is good. Cross-referencing stated income against round numbers AND against your policy thresholds — both are easily described to the model in the prompt.
False-positive rate. Moderate — 15–20%. Legitimate borrowers have round salaries too, especially government and large-corporate employees.
What you do with a hit. Pull one additional source of verification — typically a bank-statement salary credit — and match against stated income.
6. Geographic incoherence across signals
What it catches. PAN from one state, phone number STD-code from a different state, stated residential address in a third state, employer registered in a fourth — all at once, with no narrative that connects them.
Why AI is good. Integrating multiple geographic signals into a coherence check is a natural language task (the model can “read” the implicit geography of each signal).
False-positive rate. Medium — 12–18%. Migrants, remote workers, and recent relocators genuinely produce this pattern.
What you do with a hit. Ask the applicant to narrate the geography — “We see PAN from Tamil Nadu, phone from Delhi, address in Bangalore, employer in Mumbai. Could you help us understand your location history?” — and evaluate the answer.
7. Bank statements showing unusual single-credit transactions
What it catches. A single large credit labelled “salary” in an account that’s otherwise inactive, or with only small daily-life debits. Suggestive of a staged statement.
Why AI is good. Pattern-recognition over a transaction list, looking for outliers — this is exactly where LLMs excel on reasonable-sized statements.
False-positive rate. Low — 8–12%. Most salary credits do follow a regular pattern; the anomaly is usually real.
What you do with a hit. Request 3–6 months of statement, not just 1 month. A single staged statement can’t be replicated consistently across multiple months.
8. Co-applicant or reference sharing patterns
What it catches. The same PAN appears as reference on multiple unrelated applications in your system. Or the same co-applicant PAN keeps appearing across files that have no other obvious connection.
Why AI is good. This is actually more a SQL-query task than a text task, but pairs well with an AI dossier prompt that evaluates whether the shared-reference pattern is coincidence or coordination.
False-positive rate. Very low — 3–5% if the threshold is set at “reference appears in 4+ unrelated applications.”
What you do with a hit. Escalate the whole cluster of applications for ring-fraud review, not just the latest one.
9. Loan purpose that doesn’t match applicant profile
What it catches. 22-year-old entry-level applicant requesting a loan for “business expansion.” 60-year-old retired applicant requesting a loan for “higher education.” Small-town address applicant requesting a loan for “luxury travel.”
Why AI is good. Coherence-checking stated purpose against applicant profile is a natural language task. The model forms reasonable priors about what loan purposes fit what profiles.
False-positive rate. Higher — 18–25%. Genuinely unusual but legitimate applications exist, and refusing them is how lenders miss underserved segments.
What you do with a hit. Ask for evidence of the purpose (contractor quote, admission letter, itinerary). Legitimate applicants produce evidence; fraud applicants often can’t.
10. Absence of expected breadcrumbs
What it catches. A 35-year-old salaried applicant with no prior bureau history at all. An established-profession applicant with no social or professional footprint. A self-employed applicant in a common trade with no visible business presence online.
Why AI is good. The model reasons about what should exist and notices when it doesn’t — a reasoning task rather than a pattern-matching one.
False-positive rate. Medium — 10–15%. Many thin-file applicants are legitimate — immigrants, recently-formal-employed, or privacy-conscious.
What you do with a hit. Request the narrative. Thin files with real explanations are fine; thin files the applicant can’t explain are not.
The meta-point
What’s striking across these ten is that only one or two require techniques most credit analysts would call “advanced.” The rest are signals a careful human underwriter with unlimited time and fresh attention would catch too — but a real underwriter has limited time, end-of-day fatigue, and fifteen other files to process.
That’s the whole case for the AI layer. It’s not smarter than your underwriters. It just doesn’t get tired at 4pm on a Friday.
Where to go from here
The prompts that catch these ten flags are the core of the fraud chapter in the AI Lending Prompt Library and are expanded — with sanitised case studies and decision trees — in the Fraud Detection Playbook.
If you want to start free, pick the two flags above that hurt you most in the last 90 days and build a one-prompt screen for just those two. Add the rest as you calibrate.
Next in this series: a teardown of AI tools for collections, and then the P2P-lending-specific version of this red-flag analysis.
Frequently asked questions
How accurate is AI at catching application red flags?
Across the ten patterns listed below, AI catches roughly 65–85% of the signals on real files, with false-positive rates between 8% and 25% depending on the pattern. That's good enough to be useful as a first-pass screen, but not good enough to auto-decline on AI flags alone — every medium-or-higher signal needs human review.
Can I just use one prompt for all red flags?
You can, but a single omnibus prompt dilutes the attention of the model across many patterns and misses subtle ones. Better: a short prompt per pattern family (document consistency, behavioural, digital-footprint), with a higher-level orchestrator prompt that aggregates the outputs. This costs a few more tokens per file but catches materially more.
Does AI replace the underwriter's red-flag scan?
No — it augments. The goal is for the AI to catch what a tired underwriter misses (the things easy to see if you have fresh eyes and unlimited time) so the underwriter can focus on the judgment calls that require domain expertise.
Sources
- Synthetic Identity Fraud in the U.S. Payment System · Federal Reserve Board