case file: a loan portfolio for sale
Find the ring.Protect the innocent.Decide the deal.
Upload the loan tape. We tell you which borrowers don't exist, which ones only look suspicious, and how much less to pay.
The room opens a sample investigation: made-up loans, six cases, two taken down by a cited check, no live checks. Uploading a tape checks its format, then lets you start a live investigation of it (it needs the API keys).
Hazel, our investigator, pulls threads through 1,000 loans on a fixed verification budget. When a check reveals a legitimate explanation, she withdraws suspicion and takes the thread back down.
L0190 and L0037 also share a bank account.
Explained by check_address: a 212-unit apartment building. The thread comes down.
The problem
Auto-lending fraud exposure hit a record $10.4 billion.
Up from $9.2 billion a year earlier, according to Point Predictive's 2026 Auto Lending Fraud Trends Report. Most of it is first-party fraud by real borrowers or dealers, which an identity check alone doesn't catch. A bank that buys a portfolio inherits that risk without having seen how the loans were made.
69%
of exposure is first-party fraud: borrowers or dealers misrepresenting information
Asking “is this a real person?” misses most of it.
45%
comes from income and employment misrepresentation, up 21% year over year
Pay stubs have to be examined, not trusted.
67%
growth in bust-out fraud over five years
Organised fraud is connected, so we follow the links between loans.
>70%
of early payment defaults contain evidence of origination fraud
It shows up as losses soon after a portfolio is bought.
What a buying bank struggles with
- Hidden risk. Bad loans sit among thousands of normal-looking ones, and rings spread across many borrowers.
- Costly checking. Every deep check on every loan wastes money; checking too little misses the ring.
- A weak negotiating position. Without evidence, the buyer can't justify excluding loans, lowering the price or asking the seller for protections.
“A bank should perform due diligence before purchasing loans.”
Industry estimates of fraud exposure, not confirmed losses. Source: Point Predictive, 2026 Auto Lending Fraud Trends Report (April 8, 2026), which also notes that fraudsters now generate synthetic pay stubs with AI.
What it does
A connection is a lead, not a verdict.
Find the ring
One real SSN under a made-up name is a bad loan. A rare shared phone, a recycled pay-stub template and one dealer make it a ring. Every shared detail counts in proportion to how rare it is in the pool, and location alone never counts.
Protect the innocent
Two borrowers at one address look like a pair until one check shows a 212-unit apartment building. The thread comes down, and it always cites the check or saved rule that explains it. Spouses and big employers get the same care.
- needs a recorded run
Decide the deal
The Chief Risk Officer gets the work done, not a list of flags: which loans to exclude, reprice or protect, buyback demands for the seller, and a revised bid. A person approves; Hazel never signs or sends anything.
How it works
Four cards on the board.
step 1
Upload the loan tape
A messy portfolio export becomes one clean shape: applicant, residence, employer, vehicle and documents for every loan.
step 2
Hazel pulls threads
Claude picks the next lead and the next check. An evidence graph links loans through phones, bank accounts, devices, employers, dealers and document fingerprints.
step 3
Every check costs acorns
A CRS identity check costs more than a public-data lookup. The 60-acorn budget is enforced in code; a refused call costs nothing and is still logged.
step 4
A person approves
Questions go to the right person with a confidence and a reason. A “yes” becomes a saved rule, so the next lookalike is cleared citing it, and a “no” saves nothing.
Measured results
Every ring member found. No innocent left flagged.
Each portfolio has 1,000 loans and a separate answer key that only the evaluator reads. Threadpull is compared with two baselines on the same loans, with CRS live: fixed rules flag every loan that shares a phone, email, bank account, device, IP or address, then spend the same budget; check everything runs all four CRS products on every loan, with no budget.
Seed 99
Held-out testWritten by a teammate who wrote no detection code, run once on the frozen detector, reported as it came out. Two rings.
Seed 99 results by agent Agent Ring found Innocents flagged Review cases right Acorns Threadpull 12 of 12 0 of 65 1 of 3 59 Fixed rules 12 of 12 8 of 65 1 of 3 60 Check everything 3 of 12 0 of 65 3 of 3 233 Every ring member was marked Investigate after 17 acorns; the rest of the budget went on other leads and checking the largest balances. Run r99-20261025T102031.
Seed 13
Development setThe portfolio we built on, so it shows the system working, not generalising.
Seed 13 results by agent Agent Ring found Innocents flagged Review cases right Acorns Threadpull 6 of 6 0 of 50 1 of 3 59 Fixed rules 6 of 6 4 of 50 1 of 3 60 Check everything 3 of 6 0 of 50 3 of 3 234 Every ring member was marked Investigate after 14 acorns; the rest of the budget went on other leads and checking the largest balances. Run r13-20261025T094302.
Hazel reaches the review cases (fraud alert, frozen bureau, bureaus that disagree) only when checking the largest balances, so she got 1 of 3; checking everything gets all 3 at about four times the cost. On seed 13 she also held one more loan (L0742) for an open question to the CRO; it is cleared once the CRO answers. Hazel picks her own path, so figures vary between runs: across five seed 13 runs the ring was complete after 7 to 14 acorns. Numbers are generated by bun run eval from the runs' recorded events, on the detector frozen before the held-out seed was run. Full tables and method in PROOF.md
How it's built
Claude plans the checks. Code holds the evidence and the math.
A model runs in three places, each marked Claude: choosing Hazel's next check, reading a pay stub the parser can't, and drafting the CRO memo. Everything with money or consequences attached (the graph, the budget, every status and every number) is plain, tested code.
Portfolio generator
Seeded loan tapes with planted fraud rings and innocent lookalikes. The answer key is written apart.
Bun · Faker · data/generate.ts
Intake
Validates every row, refuses SSNs that could be real, flags documents with instruction-like text.
TypeScript · Zod · lib/ingest
Evidence graph
Links loans by shared phones, accounts, devices, IPs, employers, dealers and document templates. Rarer means stronger; location alone never counts.
graphology · lib/graph
Checks
ClaudeCRS sandbox (TransUnion identity, credit report, Fraud Finder, reverse phone) behind a persona guard; address, household, employer and dealer explanation checks; pay-stub parser.
Claude Haiku reads only stubs the parser can't; code verifies each value
CRS API · lib/crs · lib/evidence
Hazel, the investigator
ClaudePicks the next check from the leads and writes short notes citing their sources. Never sets a status, a price or the budget.
Claude Sonnet 5.5
Anthropic SDK tool runner · lib/agent
Budget ledger
Reserves each check's acorn price before it runs and refuses what would overspend. Hazel can't raise it.
TypeScript · lib/ledger.ts
Event log
Every step is an append-only row with its sources and CRS RequestIDs. Statuses are decided by code from the evidence.
Supabase Postgres · lib/agent · lib/events
Corkboard
Replays the rows or streams them live. Every animation is a recorded row, never a script.
Next.js · React Flow · Realtime · components/board
Deal engine
Exclusions, repricing, buyback drafts and the revised bid, all computed in code.
TypeScript · lib/deal
Evaluator
The only code that reads the answer key: scores recorded runs against it and two baselines.
Bun · eval
CRO review
ClaudeA person approves or overrides. An answered question becomes a saved rule. The memo keeps only sentences it can check against the events.
Claude Sonnet 5.5 drafts the memo
Next.js · app/cro · lib/rules
Data flows from the tape to the CRO. Each check's result goes back to Hazel as new evidence, so every check can change what she does next. The answer key never reaches the app: only the evaluator reads it, and a test enforces that. The full diagram is in the README.
Limits in code
Claude chooses the next step. Code keeps the rules.
Everything a model could get wrong (money, status, budget, who may do what) is enforced outside the model.
- The budget
Code holds the purse, not the prompt.
A ledger charges each verification from a fixed price list and refuses the call that would overspend. Only successful calls are charged.
- The verdict
Hazel proposes. Code decides.
Statuses come from the evidence gathered in the run. When Hazel proposes something else, the log keeps both, and the code's decision stands.
- The documents
Document text is data, never instructions.
One ring loan's pay stub says to clear every loan from its dealer and skip the CRS checks. It is logged as attack_detected, the words never reach the model, and the loan stays in Investigate.
- The memory
Ask once, remember forever.
The CRO's ruling that a 48,000-staff hospital explains a shared employer becomes rule R-001. The next lookalike is cleared citing it; a 38-person employer is outside its scope, so Hazel asks again.
- The record
Every step proves itself.
Each move is an append-only event row with its sources and every CRS RequestID, so “why is this loan flagged?” has an answer months later.
Responsible design
A recommendation for a person, never a verdict on a borrower.
- A connection is not proof. Threadpull's output goes to human review and is never an adverse action on a consumer.
- No location-only signals. A ZIP code or a neighbourhood is never evidence on its own.
- Inside the data room only. Hazel can read the tape and call the CRS sandbox. She cannot buy, reject, sign or send.
- Built on synthetic data. Loans are generated; identities are CRS sandbox personas. A production version would need a permissible purpose under the FCRA and legal review.
We don't just connect the evidence. We know when to take a connection down.
