• Originally a simple safety permit, the driver’s license became America’s default identity document because it was familiar and ubiquitous.

• An ID of convenience, the U.S. driver’s license is vulnerable to fraud in ways that few others are, forcing decades of upgrades as technology has evolved.

• Driver’s License Data Verification (DLDV) is the latest step, letting risk teams check DMV records in real time.

The driver’s license is so familiar that it’s easy to forget how strange it is that a document meant to prove someone could operate a vehicle became the default proof of identity in the United States.

To mark the launch of Driver’s License Data Verification (DLDV) in Intercept, we trace how the driver’s license evolved from a safety permit into the country’s everyday ID, and why the next step is verifying it against the DMV record itself with DLDV.

The chauffeur problem
The driver’s licenses as safety measure
1899-1910

The first driver’s licenses emerged in a much different world than the one we know today: cars were rare, expensive, and confusingly high-tech, often operated by chauffeurs rather than their owners. As crashes and hit-and-runs rose, public blame fell heavily on these hired drivers. At one 1909 New York hearing, advocates for an automobile bill argued that “90 per cent of the automobile accidents were due to the carelessness of joy-riding chauffeurs.”

The number was almost certainly rhetoric. But it captured the problem early licensing was built to solve: making sure this new machinery was operated by people who knew what they were doing, and giving authorities a way to trace responsibility when something went wrong. Starting in Chicago in 1899, cities and states began requiring driver’s licenses to make sure early automobiles were operated by qualified, traceable drivers. In New York State, the chauffeur license introduced in 1910 became the first driver’s license to require a photograph.

Suburban strangers
The driver’s license becomes a photo ID
1958-1986

By midcentury, suburban life meant cars, sprawl, and — less remembered today — the widespread popularity of personal checks. The number of paper checks handled by the Federal Reserve doubled in the 14 years after World War II, to 4 billion, and then doubled again by 1970, to 8 billion. With shoppers driving miles to supermarkets and shopping centers, then paying by check, clerks and tellers needed a simple way to know that the stranger in front of them was really who they claimed to be.

The driver’s license became the convenient solution. Millions of Americans now carried driver’s licenses in their pockets everywhere they went, so retailers and banks began requesting them as ID when accepting or cashing checks. As the license became as much an identity document as a safety credential, states added more identifying information, most notably the photo. California is commonly credited with putting the photo on the front of the modern driver’s license in 1958; by 1986, even the last holdouts, New York and Tennessee, had added mandatory photos for noncommercial drivers.

Fifty states of fake
The driver’s license gets physical security standards
1976-2008

Making the driver’s license America’s default ID was a gift to counterfeiters: 50 states meant 50 designs, each changing on its own schedule. Front-line ID checkers were expected to spot fakes from places they might never have been. Underage drinking compounded the problem, normalizing fake IDs and creating mass demand for fake-ID makers to get better. By 1976, a federal advisory committee estimated that false ID aided 80% of hard-narcotics smuggling into the U.S., cost businesses about $1 billion a year, and drove government-program losses “into billions of dollars.”

The ensuing decades became an arms race between fake-ID makers and the states: better laminates to stop photo swaps, holograms and special inks to defeat copiers, microprint and UV features that made cards harder to imitate, and eventually PDF417 barcodes that let machines read the license’s data directly. By 2000, the American Association of Motor Vehicle Administrators (AAMVA) had introduced a national card-design standard, and after 9/11, REAL ID turned layered physical security into a federal baseline. States could still issue their own licenses, but the cards now had to be built to resist tampering, counterfeiting, and casual reproduction.

Sources of truth
The driver’s license becomes networked, letting verifiers check the data against the issuing DMV.
2010s - present

States had made the card harder to fake, but the system was still too easy to game. A suspended driver could apply in another state. A fraudster could use a new name. Building on the commercial-driver system created in the 1980s, AAMVA’s State-to-State Verification Service launched in 2015 to help DMVs check whether an applicant already held a license somewhere else. That solved one kind of fragmentation: DMVs could compare records before issuing a new credential.

But as financial services have moved online, the driver’s license took on another job: remote identity verification. Applicants are often asked to upload a photo of their license, leaving analysts to decide whether the image can be trusted. That task is only getting harder in a world of AI-generated documents, deepfakes, and stolen PII. DLDV solves that challenge by letting approved businesses and agencies check license data against the issuing DMV’s own records. As of May 2026, DLDV offered unrestricted DMV checks in 44 jurisdictions.

Real-Time Driver’s License Verification (DLDV)

That is the capability we just added to Intercept: an authoritative, real-time DMV check that’s available within the risk analyst’s existing dashboard. DLDV gives analysts a new source of truth in high-risk reviews, both online and in person. When they suspect the image they’re reviewing may be outdated, doctored, or deep-faked, they can confirm its veracity in seconds. The result is faster decisions, fewer unknowns, and more confidence to approve good customers while stopping fraud.

Learn more about the latest version of Intercept here.

The latest edition of SentiLink's Fraud Report, covering 1H 2026, is out today. With over 50 pages of in-depth analysis of 170M+ real-world account opening applications, as well as write-ups on several recent fraud trends, the report shares what we're seeing in the ongoing battle against fraud with the broader fraud-fighting community.

The report is free, so you can grab a copy right now and read all the details. But it's a long read, so to give you a quick taste, here are three things we learned from digging into the 2026 data.

1. Fraud rates are falling (sort of)

Rates of all three fraud types we track — identity theft, first-party fraud, and synthetic fraud — dropped over the course of the first half of 2026. However, the overall identity theft rate in 1H 2026 was still higher than what we’ve observed in any previous report. Given that we have previously seen identity theft rates rise over the course of the second halves of both 2024 and 2025, we are not convinced that the drop we’ve seen over the course of this half reflects any sort of long-term trend.

The drops in the rates of synthetic fraud and first-party fraud were more modest. The synthetic fraud rate dropped both over the course of the half and YoY, but it remains within the bounds of the 50-90 bps range in which we’ve observed it in all previous reports.

We have not been tracking first-party fraud for long enough to speculate about what the modest drop there might reflect.

2. Fraudsters are getting more sophisticated

While residential proxies are nothing new, their availability has exploded (thanks in part to the AI boom) and the ease with which they can be detected has dropped significantly. In the first half of 2026, SentiLink observed multiple identity theft attacks in which the fraudsters leveraged residential proxies that did not appear on major commercial proxy detection lists — meaning their connections look legitimate to most anti-fraud systems.

These attackers also used legacy PII — phones and emails once genuinely associated with the victim, but since abandoned — to help their applications look even more legitimate to fraud detection systems.

Not all attacks are this sophisticated, but these tools are now easily available. We expect the frequency of this type of attack to increase.

3. First-party fraud is a major problem for auto lenders

While first-party fraud is a significant problem in all industries, only in auto lending did it exceed identity theft. There, the mean first-party fraud rate was above 5%, which is more than double the rate we observed in every industry except telecom.

Several unique features of U.S. auto lending may help explain this pattern; we detail some of these in the report.

Dig into the details

To learn more about all of these, explore an interactive fraud map, and see the results of dozens of other analyses, grab your free copy of the report today:

The SentiLink Fraud Report: Identity Fraud Rates & Trends 1H 2026

• Two attacks on our partners this spring arrived from inside the victims’ own neighborhoods. These partners saw automated identity theft attacks in which applications came from IP addresses within a few miles of the victim’s home, often on the victim’s own internet provider.

• The mechanism is a residential proxy: web traffic routed through a stranger’s home internet connection, targetable down to the ZIP code and the internet provider.

• AI demand is why residential proxy supply exploded. Scraping the web at AI’s needed scale requires addresses that don’t look like data centers. That spending built infrastructure fraudsters now rent for cheap

• Detection is behind, and we tested it. We bought residential proxies on the open market ourselves; none were flagged by industry-standard tools.

• Legacy phone numbers finished the job. Many applications carried a number that had genuinely belonged to the victim years earlier.

• What we’re doing: Building model features purpose-built for residential proxy abuse, tested against real fraud attacks, and designed to catch more of the traffic that older anonymization logic could let through.

Learn more: This is one of the trends we’re monitoring in our twice-yearly fraud report. Sign up to make sure you receive it.

Every so often, a fraud attack stumps us (at first). Late this spring, two did: Within weeks of each other, two of our partners reported what looked like automated identity theft attacks: the kind where fraudsters take a batch of stolen identities and use software to try to open new accounts en masse. The weird part was the internet traffic. Every application looked like it was coming from the victim’s own home, or a few blocks from it, often on the same internet provider the victim actually used. Many of them used phone numbers that had belonged to the victims years earlier.

We dug in. What we found turns on a wonky phrase we knew all too well, one you may soon hear more often outside of cybersecurity circles: residential proxy. It isn’t a new idea — it just means routing your web traffic through another person’s device, so that whatever you do online appears to come from an IP address tied to their house, not yours. What’s new is that residential proxies are suddenly sprouting up everywhere, and getting harder to spot. The reason why is a story of supply and demand, bots and humans, and a confusing game of masks that’s causing havoc in the worlds of AI, cybersecurity, and fraud prevention.

The Original Proxy

To explain, we need to start with the most fundamental building block of the Internet: the Internet Protocol address. An IP address is a delivery address for machines. It tells the network where to send things back. That’s it.

The original sin driving this story — the approximation that launched whole industries devoted to identifying web traffic, redirecting it, and disguising it — is that an IP address tells you where a computer is, and therefore something about the person using it. For a long time that was safe enough. Addresses were handed out in blocks to providers operating in particular places. Traffic from an address belonging to a cable company in Ohio? Reasonable guess: a guy in Ohio.

Those reasonable guesses turned out to be worth money. Streaming services used IP addresses to enforce licensing deals, advertisers to target local audiences — and banks to flag a loan application filed thousands of miles from the customer’s address (hi, that’s us!). A routing detail evolved into an identity credential: a rough answer to where are you, and from there, a partial answer to are you who you say you are?

That spawned a mirror-image business. Once websites started behaving differently depending on which IP address you arrived from, there was money in being able to arrive from somewhere else. Retailers began tracking prices in other markets, researchers measured what’s blocked where. Others simply wanted anonymity, to mask their original IP.

All this created a third industry: telling the difference. Banks, retailers, ticket sellers (and fraud prevention companies like us) now pay specialist firms to map the internet’s masks — to flag traffic arriving through a VPN, a data center, or an address with a history of trouble. It’s an arms race: every advance in detection forces a new kind of mask, and every new mask forces advances in detection.

After AI, the flood

But here’s the thing: most of the Internet isn’t people anymore. Bots now generate more than half of traffic on the Internet, according to a 2026 report from Thales. Bots have jobs. Some are benign: search engines indexing pages, monitors checking that sites are up. Many aren’t: software scraping prices, testing stolen passwords against login pages, opening fake accounts. The unwelcome ones have to get past doors built to keep them out. Bots became the best customers of the industry that masks IP addresses as a result.

And then AI showed up to the party. AI needs bots, bots, and more bots — to read the entire internet for training, to fetch live pages for answers, to browse and book and buy on a customer’s behalf. And whether or not those web pages want to be crawled by AI bots (many don’t) AI bots find a way — by hook, by crook, or by proxy. AI companies and their kajillions of dollars have created a demand to mask traffic unlike anything that came before. Those resources are increasingly pouring into one very specific place: residential proxies.

Residential proxy is an umbrella term covering many different arrangements, some legal, some not. A guy running Honeygain, an app that pays a few dollars a month for your spare bandwidth, is a residential proxy. A malware-infected wifi router is a residential proxy. So is everything in between: a free game on your phone or a streaming app on your smart TV that resells your connection without telling you. This June, Spur found that proxy software is embedded in more than 42% of the apps in LG’s smart TV store.

Business is booming. Bright Data, one of the largest providers of residential proxy networks, advertises more than 400 million residential addresses. Last fall, Spur counted 250 million unique ones in a single ninety-day stretch, a number its co-founder called unheard of. Lumen’s threat researchers, who watch the criminal end of the market, see roughly 20 million distinct addresses a day and estimate that something approaching 60 million compromised devices are in circulation worldwide, about a quarter of them in the United States. All of it is for sale; access runs around a few dollars per gigabyte at volume. The dashboards are self-service and the targeting has gotten absurdly good: order traffic from a specific country, state, city, ZIP code, or internet provider, and hold the same address for as long as your session needs it.

Which brings us back to fraudsters, who built none of it but are benefiting from all of it. The same dashboard that sells a scraping operation for a million addresses in Ohio will sell a single address in a specific Ohio ZIP code to somebody holding a stolen identity from that ZIP code. This allows fraudsters to game risk scores that flag an application as risky when the applicant’s address is far from their IP’s location. Among a targeted sample of low-scoring fraud applications from our internal database assembled to study this phenomenon, every mile mattered: mean risk scores climbed steadily as the distance between address and IP grew, from under 200 for addresses within a kilometer of their IP to nearly 400 once that gap passed 100 kilometers.

The two attacks and what’s next

The two recent attacks on our partners used this tactic at scale across thousands of identities. An automated system paired each stolen identity with a proxy address as close to that person’s home as it could get. When an application didn’t clear, the same identity came back on another application from a different nearby IP address. SentiLink’s scores caught most of it — that’s how the partners noticed the attack in the first place, with the share of applications we flagged high-risk climbing from about a third to roughly 80% in a matter of days. But enough got through to concern us. Many of the applications also carried a phone number that had genuinely belonged to the victim years earlier, since abandoned, reissued, and captured by the fraud rings. Like proximity, an old number can read as continuity to fraud models. But in these cases, these numbers meant OTP verification codes went to the attackers further lowering traditional risk signals.

So why didn’t our proxy detection alone catch every application? Part of the answer is that lists of proxy providers flagged as risk are always lagging the market. Addresses enter these pools by the millions, and some look ordinary until they are used in an attack. In our own testing, some residential proxies available for purchase did not appear on common lists of risky proxies. But there’s another reason too: older models flagged only the riskiest providers and let several larger, mainstream providers pass, since a relatively small portion of their traffic is used for fraud. The latest models target all residential proxies, then combine other signals to separate risky from legitimate traffic within those large IP pools.

So we’re working on all fronts: widening the list of risky proxies, digging into traffic within each proxy, and pushing for IP information that keeps pace with the evolving threat landscape. It means new models with features devoted to solving this problem. Before long, it may also mean questioning the industry assumption that IP is a valid stand-in for identity.

By David Maimon

We bought a flight from a fraud marketplace to see whether it would actually fly.

For $52 in cryptocurrency, a Telegram vendor who calls himself QOBIZ Online sold us a Miami-area itinerary at half off. We sent him a Google Flights link, a passenger name, and a date of birth. A few hours later — after his first attempt on a JetBlue booking threw errors and he switched carriers — he sent back a confirmed reservation, live inside the airline’s own system, in the name we had given him.

That small purchase marks a change in who these fraud markets sell to. Telegram’s fraud channels used to be wholesale operations: fraudsters selling raw materials — stolen card numbers, hijacked logins, step-by-step “methods” — to other fraudsters. Increasingly, they sell retail, delivering finished products to ordinary buyers who may never realize what they bought. It’s the guy selling watches off a tarp on Canal Street — except the tarp is a chat thread, and buying from it feels a lot like the “conversational commerce” ordinary shoppers are already growing used to. And it can reach almost anyone: Telegram is a mainstream app now, with more than a billion monthly users, roughly 87 million of them in the United States. That kind of in-chat buying hit $11.3 billion in 2025 and is projected to roughly double within five years. A black-market travel agent is now a few taps away from the everyday bargain-hunter.

We can’t say for certain how QOBIZ obtained our seat. But everything we saw carries the earmarks of fraud as law enforcement defines it — starting with a discount so steep that Interpol treats it as a near-certain sign of a stolen ticket. This is the story of how one of these markets works, what it was like to buy from it, and what the evidence suggests was really going on.

The marketplace

QOBIZ runs a storefront that markets deeply discounted travel to the general public. His Telegram channel, “Flights booking Hotels discounts,” advertises a standing offer — “EVERYTHING 50% OFF,” “100% Safe & Secure,” “Order Now — DM Fast!” — over a large library of photos and videos used as sales material. It reads less like a criminal forum than a discount travel agency.

A few facts about the operation. The channel became a Telegram “supergroup” — a small chat upgraded into a large, scalable community — on December 9, 2025. We tracked it as part of our routine monitoring of channels that trade in illicit goods, collecting its public activity between February 18 and June 1, 2026: 283 text posts of ads, booking confirmations, customer testimonials, and proof-of-service screenshots. By then, the group listed more than 140,000 members, though Telegram membership inflates easily, and the actual posting came from far fewer accounts.

Flights are the core product, but they’re only the entry point. Sorting the travel-related posts in our dataset shows how broad the counter has become:

The advertised bookings run from budget domestic flights to itineraries topping $2,000, on brand-name platforms throughout — Southwest, JetBlue, Frontier, and American; Agoda, Booking.com, Expedia, Priceline — and beyond travel entirely, down to grocery delivery and bill payments.

How he earns trust without a name

A marketplace like this faces a selling problem that legitimate businesses don’t. It offers none of the protections that make people comfortable buying online — no credit-card chargeback, no PayPal dispute, no company to look up, no Google or Yelp reviews, no recourse at all if the deal goes bad. But it also can’t lean on the trust machinery of the traditional dark web — escrow services, long-running forum reputations — because its customers aren’t criminals who know that world. They’re ordinary shoppers chasing a deal. So what’s a fraudster to do?

His answer is to put a track record on display. He floods the channel with screenshots and videos of supposedly completed orders, captioned with their value and speed — “$1900+ Southwest done same day,” “$1500+ New York Hotel done smoothly,” “$1200+ Airbnb done” — surrounded by customer “vouches” and “+Rep” endorsements that stand in for the star ratings of a real marketplace, complete with vacation photos from his buyers. A prospective buyer has no way to check any of it.

He also takes the risk off the buyer. Many posts advertise a “No Upfront Payment Required” policy, letting a customer see the booking before sending money he could never claw back — the strongest possible answer to the fear of being scammed. And he keeps the crime out of frame: the pitch is always vacations, Disney trips, and half-price luxury travel, never “I have stolen access.” The customer is invited to think about the trip, not where the discount comes from.

Buying a ticket

Advertising can be staged, so the only real test was to place an order. We kept it deliberately small — a $52 flight — and never used what he sent, to limit both the money reaching a presumptive criminal and any harm from a fraudulent booking.

We approached him as a buyer wanting a cheap flight from Washington, D.C. to the Miami area. He sent back a standardized intake form asking for the itinerary, passenger name, and date of birth, and listed the ways he’d take payment: Zelle, Cash App, or Bitcoin. He quoted 50 percent off.

What happened next didn’t look like a scam: The vendor behaved like a customer-service rep working a difficult order. He stayed in contact for hours, reported that the first airline’s itinerary was returning errors, asked for an alternative, switched carriers, and ultimately delivered a confirmed reservation on a different airline in the name we’d supplied, with a checked bag included, as a PDF over Telegram.

The reservation behaved like a real one. He sent screenshots from the airline’s booking portal showing a valid confirmation code, our passenger’s details, a June 2026 departure, and a Washington Dulles–to–Fort Lauderdale routing that lived inside Frontier’s system rather than as a standalone document. The passenger data matched exactly what we’d given him, which means the booking was created for our request, not recycled from an old one. Days later, it went a step further: a fully formed boarding pass landed in our inbox by email — a real seat, a boarding group, a scannable barcode. We never used it, but as far as the airline was concerned, a passenger we had invented was cleared to fly. We never boarded, so we can’t swear the plane would have carried our made-up traveler to Florida — but by every indication short of the jet bridge, it would have.

So what did we actually buy?

The most revealing screenshot was the airline’s own payment screen. It showed the ticket had been paid for with a Visa card that was neither ours nor our passenger’s, for $115.97 — while we had paid the vendor $52 in cryptocurrency, separately. In other words, the real fare went onto a valid payment card, and we handed QOBIZ roughly half of it in crypto for the service of arranging that.

This is the closest our evidence comes to the mechanism, and it fits what investigators would expect. No legitimate seller could sustain a half-price fare: airlines net only about $7 per passenger, a margin near 3.6 percent, according to the International Air Transport Association. The math only works when the inventory costs the seller nothing — a ticket bought on a stolen card, a room booked with hijacked loyalty points, a seat purchased through a compromised account or a synthetic identity, or a trip taken and then charged back. A payment on a card that isn’t yours is the signature of the first and most common of those methods.

We can’t prove fraud outright, and we can’t know for certain the provenance of the payment card used to make the purchase. We didn’t fly the ticket, and our evidence is the vendor’s own screenshots. But a steep discount, an anonymous seller paid in crypto, and a booking charged to someone else’s card together bear the hallmarks of stolen-card fraud as law enforcement describes it. What we can say plainly — and what we have since shared with law enforcement — is that the vendor took an inquiry, moved it through payment to a working reservation, and delivered, which, in these markets, is the whole value proposition.

Then he did one more thing. Shortly after our booking cleared, QOBIZ reposted it in his channel — our reservation, wrapped in fresh promotional language for discounted flights, hotels, and Airbnb stays. Having sold us the ticket, he upcycled us into the sales pitch for the next customer. The track record he advertises is impossible for any buyer to verify — but we can confirm that at least one entry on it was real. It was ours.

In a recent issue of the Signal, we told you about a 2024 Corvette Stingray that vanished.

A man walked into a Southern California car dealership, made a single lease payment of $2,779.05 to drive off in the $90,000 car, then dodged every repossession attempt, leaving the lender to write off the debt.

So we went looking for it.

And, for a brief moment, we found it – or at least its VIN: The 17-character identifying number appeared in a tiny advertisement on page 14 of a community newspaper, listing the car for a public auction the following week, in a lot in Lancaster, 70 miles north of Los Angeles.

That ad is no outlier. We found hundreds like it in California community newspapers dating back to 2024. They are often the only public trace of a fraud pattern that the people who fight it say is both stubbornly common and steadily worse.

These auctions are the last step in a legal process called a lien sale. Done honestly, lien sales protect auto mechanics and tow companies when customers skip out on the bill. But fraud rings have learned to use the process to launder cars, siphon money from lenders, and walk away with a clean title, all with the stamp of approval of the state Department of Motor Vehicles.

“Out of nowhere, it’s like half my caseload now,” says Bentzion Krugliak, an attorney at IDEA Law Group who represents auto lenders including Santander, Toyota Motor Credit, and TD Bank. The cases were rare when he started in 2019, he says; now he gets four or five new ones a week. The work is a race against the clock. “I have to drop everything I’m doing and file a lawsuit before I get a chance to wipe my ass” he says. “Otherwise, my client loses their title.”

An honor system

To understand how lien sales enable fraud, it helps to start with how they’re supposed to work. A broken-down car shows up at a body shop. The shop makes the repairs, stores the vehicle, and runs up a bill — but the customer never pays. California, like most states, lets the shop recover its money by selling the car, provided it follows a few steps. First, it has to notify the car’s legal owner — usually the bank that financed it. That owner then gets a short window — 10 days, in California — to object and force the matter into court. If no one does, the shop sells the car at public auction. The proceeds cover the bill, and any surplus goes to the DMV, where anyone with a stake in the car has three years to claim it.

But every one of those safeguards rests on a single assumption: that the mechanic is telling the truth. Nobody really checks.

Each of those steps can be gamed, and any of the involved parties — borrower, shop, highest bidder — can be in on the con. The repair bill can be padded with inflated storage charges or work that was never done. The “public” auction can be held somewhere remote, won by a single friendly bidder, or never happen at all. The notice can go out just before the deadline, to a lienholder’s general mailbox, where it takes days more to reach anyone who can act. Some lien claimants will even mail an empty envelope by certified mail — then show the DMV the receipt as proof they gave notice. Either way, the car gets cashed out, and the lender is left holding the loss.

“Criminals have figured out that a lot of this is based on an honor system,” says Paul Steier, who was the director of investigations at the Iowa DMV and is now Vice President of Law Enforcement Programs at AAMVA, the association of state and provincial motor-vehicle agencies. The laws behind it were written for a past era, he says — when people read the local paper and most lenders were local. Today, a bogus claim could be flagged digitally, but the regulations haven’t caught up. “We have technology today” to stop lien-sale fraud, he says. “You’ve got to get laws changed.”

One shop, 18 cars

What makes this so hard to catch is that the honest version and the fraudulent one reach the DMV on identical paperwork. “It’s not always fraud,” Krugliak says. But he believes there are tells. For example: a late-model luxury car that the mechanic values at $4,000 or less – the cut-rate category known as “a short lien” that skips the DMV approval process. Another tell, he says, is volume: a body shop filing “more than five lien sales a year,” he says, “is either doing a very bad job at their customer base, or they’re up to something.”

By those measures, the shop advertising the Corvette’s lien sale — Advance Auto Electric — deserves a second look. Based in Lancaster, a desert city in the northernmost part of Los Angeles County, it advertised 18 vehicles for lien sale between September 2024 and October 2025, including three Range Rovers, a BMW M8, a Mustang GT, and a diesel Ford F-250. The Valley News Group, which publishes titles including the Calabasas Enterprise and the Valley Vantage — community papers some 50 miles south of Lancaster — published lien sale ads for 132 unique vehicles in 2025, up from 84 in 2024.

At least two finance companies have sued Advance Auto Electric and its owner, Haik Agadzhanyan, personally. Krugliak brought one case, after the shop attempted to auction a leased 2024 Toyota Tundra it valued at “$4,000 or less” — the threshold that skips DMV approval — while billing $6,090 in storage. Toyota’s filing valued the truck at $46,480. TD Bank sued over a 2022 Ford Bronco, which was advertised in the Valley News Group papers. The lawsuits and disputed valuations do not establish that Advance Auto Electric or Agadzhanyan engaged in fraud. But they add to a pattern of unusual and contested lien-sale activity involving the shop. When reached by phone, Agadzhanyan declined to comment.

A rare criminal case

In Houston this spring, an auto-crimes task force raided a shop called Pure Performance, where, police say, owner Talal Obeid moved stolen and rented luxury cars out of California using fraudulent mechanic’s liens — in one case claiming $60,000 in repairs on a near-new Mercedes. Investigators seized nine cars and more than $900,000 in assets and charged Obeid with a felony.

Cases like that are the exception. More often, Steier says, a lender’s complaint gets filed away as a private contract dispute rather than a crime. “This isn’t a civil dispute,” he says. “This is somebody intentionally defrauding a lender.” Part of his job now is making that case to police and prosecutors.

In California, reform has centered on the money. After CalMatters reported that the DMV had collected more than $8 million since 2016 from lien-sale cars that sold for more than what was owed — surplus the agency keeps when owners aren’t notified to claim it — legislators introduced a 2026 bill to require that notification. As it stands, the agency that oversees lien sales also profits from them.

Contacted with questions about how it oversees lien sales, a California DMV spokesperson said the department couldn’t respond by the deadline and pointed us to its website.

Too late to stop the sale

Krugliak’s best defense is speed: the moment a lender calls, he sues and serves the DMV, putting a hold on the title — a “Vehicle License and Title (VLT) stop” — before the sale can close. Done in time, the title can’t be washed. But the car has often already been sold to someone who knew nothing; the hold simply means they can’t get the title to what they paid for. “We’ll get a call from some random Joe,” he says: “I just bought this car and I can’t take title to it.”

The Corvette, meanwhile, is on the road somewhere. After it surfaced in that legal notice, it slipped back into the ordinary used-car market — and this time the paperwork was clean. The title passed through Carvana, the online used-car retailer, which said it bought the Corvette directly from an individual — not from the lien sale — and sold it, for cash, to another. That is the system working as designed. A car that vanished on a single $2,779 payment re-entered the world with a clean title and an owner who did nothing wrong.

“Why go and get a gun and rob a bank?” Steier says. “Why not just take a vehicle, shuffle the paperwork, and make hundreds of thousands of dollars?”

Say you're a fraudster and you've just acquired a stolen identity you'd like to use for maximum financial gain. What do you actually do? Where do you apply first? How long do you wait before submitting your next application?

At SentiLink, we’re always interested in how fraudsters behave, and we have the data to look into and answer these questions. When we compared application behavior associated with exploited identities to the behavior of legitimate consumers, we found some significant differences both in terms of what type of institutions they target and in terms of the velocity with which they tend to apply.

How we investigated

To investigate this question, we looked at the first five applications on record for a total of 2,391,411 distinct identities that submitted applications between January 1, 2023, and April 28, 2026. These identities submitted a total of 11,239,356 applications over that period, each of which was scored using SentiLink’s Identity Theft Score. Identities were split amongst two groups:

• Exploited identities — 285,236 identities that showed a consistent high-risk-score pattern indicating they had been stolen and were in active use by fraudsters.

• Control identities — 2,106,175 identities that showed a consistent low-risk-score pattern indicating a very low probability that the identity had been stolen.

While this is quite a large sample and all of the results that follow are statistically significant, it is important to note that this is based on a limited sample from SentiLink's data, so we only have visibility into applications that were submitted to SentiLink partners. SentiLink's partner list is large and has grown over time — we now serve 500+ partners, including 13 of the top 15 US banks — but in most cases, there are likely at least a few applications connected to many of these identities that were not included in this analysis because they were submitted to institutions we did not work with at the time.

The results

What normal looks like

When we examine the behavior of the control identities — identities we have a high confidence were not stolen during the period — we find pretty much what you’d expect from a legitimate consumer, with applications focused primarily on banking and consumer lending (which includes Buy Now, Pay Later services consumers frequently use to finance small purchases).

For example, when we look at the first application submitted by a control identity, nearly 70% of them are banking, consumer lending, or credit union applications:

Similarly, if we look at the most common sequences of the first three applications associated with control identities, we can see that they tend to remain in this space:

None of this is surprising. But as we’ll see, fraudsters who’ve stolen an identity behave differently.

Fraud looks different

While the most common first applications among exploited identities (i.e. stolen identities under the control of fraudsters) are still to consumer lenders and banks, when we look at the top five most common first applications among exploited identities we can see a significant difference:

While almost 70% of control identities submit their first application to a consumer lender, bank, or credit union, fewer than 40% of fraudster-exploited identities start there.

On the flip side, more than 40% of fraudsters submit their first application to a non-bank alternative finance (AltFi) lender, neobank, or telecom company, whereas just 10% of control identities submit their first applications in those categories.

When we investigate the first three applications associated with exploited identities in sequence, it appears that many fraudsters are choosing to specifically target AltFi lenders, telecom companies, and neobanks early in their exploitation of a stolen identity. The most common first-three-application sequence among exploited identities was AltFi → AltFi → AltFi, followed by Telecom → Telecom → Telecom.

This pattern has not shifted much with time; when we broke the applications down by year, we found that in every year, fraudsters were more likely to start their exploitation of a new identity with AltFi, telecom, or neobank applications than legitimate consumers (control identities) were.)

Looking across the full list of applications associated with a given identity, we see the same pattern repeated again: legitimate consumers (control identities) tend to have more consumer lending and bank applications, whereas fraudsters are far more likely to apply to AltFi lenders, neobanks, and telecom companies.

To put it another way, fraudster-controlled identities were:

• 4.5x more likely to have an AltFi application.

• 2.6x more likely to have a telecom application.

• 2.4x more likely to have a neobank application.

Fraudsters apply faster

When we look at how fraudster identity exploitation differs from legitimate consumer behavior, there is another significant difference worth noting: fraudsters tend to submit applications at a much higher velocity. The average control identity had a median gap of more than 40 days between applications on average, whereas the median average gap for fraudsters was just 15 days.

Exploited identities were also more likely to be associated with multiple applications in short periods of time; for example, nearly 60% of exploited identities had submitted multiple applications within 2 hours of each other, compared with just 40% of control identities.

Conclusion

Clearly, the way that fraudsters tend to use stolen identities differs dramatically from the typical behavior of legitimate consumers. And fraud is endemic in every industry, it is clear from the data that specific types of lenders — AltFi lenders, neobanks, and telecom companies — may face an elevated level of risk due to the fact that fraudsters are more likely to apply to them, and more likely to apply to them early, before the victim has had any chance to notice and report the crime.

This underpins the importance of highly accurate fraud prevention. SentiLink’s Identity Theft Score flagged these applications; other solutions might not.

On February 22, 2024, a man walked into a Chevrolet dealership in the San Gabriel Valley and signed a 36-month lease on a brand-new Corvette Stingray. It was a 2024 C8, mid-engine, 490 horsepower — the kind where the V8 rumbles behind the seats with enough thrust to hit 60 mph in under 3 seconds.

When he signed the lease, the odometer read 7 miles. Before he drove off, he made the first payment and covered the usual stack of fees. Grand total to leave in a $90,000 car: $2,779.05.

It was the last money the lender would ever see.

What happened next is auto lending’s worst-case scenario: the letters and phone calls go unanswered, and repo agents return empty-handed. So the lender sues in civil court. The borrower doesn’t show up there either; the sheriff and the process servers can’t find him. Nobody can find the car. Eventually, the case is dismissed, and the lender takes the writeoff.

The Corvette case is a flashy example of a dull-sounding legal phenomenon: replevin, sometimes called claim and delivery. It’s what happens when a lender asks a court to help recover collateral – in this case, a car – from a borrower who has stopped paying and won’t give it back. Replevin actions aren’t rare; hundreds of them are filed in U.S. state courts every year, according to our analysis of public court filings. They aren’t always fraud — in some states they’re a routine part of the repo process — but typically they come after the usual tactics have failed.

But the Corvette case also belongs to a narrower category that we, as fraud trackers, consider useful: cases where the borrower can’t be found, the car is never recovered, and the original loan or lease survives in the public court record. These cases offer something rare in first-party fraud research: a public way to look backward from the loss to the application that made it possible.

So we decided to go digging. Reviewing court records, we found a total of 25 unrecovered-car cases, along with copies of their original loan and lease agreements. That let us ask the question at the center of this story: if we reconstructed those applications as they looked on the day the cars left the lot, would the warning signs already be there?

A public version of a private study

First-party fraud is difficult to study: The applicant isn’t impersonating someone else, as in identity theft, or inventing a synthetic identity from scratch. They are using their own names, Social Security numbers, and enough other real information to look, on paper, like an ordinary borrower who later defaults.

The difference is intent: An honest borrower meant to repay and then can’t. First-party fraudsters never intended to honor their contracts. In that way, they misrepresent themselves (and also often in other material ways, such as lying about personal information such as their income, address, or employment). The fraud begins at the application.

Typically, we study first-party fraud through private retrostudies with our partners, where the lender provides a large batch of applications, including some it has labeled as fraud, and we look back at what the applications showed at origination. Those studies are rich, but the labels still involve judgment, and the data and results stay confidential.

Here, the lost-car replevin subset gives us a chance to do a public version of the work. These cases don’t prove first-party fraud, of course. But they do offer very strong signals of it: a borrower who evades service, a vehicle that can’t be recovered, and in some cases, the borrower is sued more than once by multiple lenders. And it comes with the original paperwork.

From courthouse records to a dataset

We set out to build a small, high-quality sample of replevin actions as an initial study. Searching court records via Unicourt, a courthouse database, we identified replevin actions from the past ten years, then filtered for cases where the plaintiff was clearly a corporate lender and the defendant was a private individual.

We then focused on the cases with the strongest first-party fraud signals: the borrower was never located and personally served, and the court record showed no evidence that the vehicle was recovered. Next we made sure the original loan or lease agreement was available in the public file.

We limited the sample to California because that is where most of the usable cases were, and because California gave us a clean benchmark: more than 26,000 auto-loan applications from the general California population that we had already analyzed for first-party fraud for two major auto lenders. For borrowers who appeared in multiple cases, we kept only the earliest case in our date range.

That left 25 replevin cases — our 25 missing cars.

The $1.8 million parking lot

The sample was small; the losses were not. Together, the unrecovered cars represented almost $1.8 million in unpaid balances. The set skewed toward luxury and performance vehicles: 6 BMWs, 4 Porsches, 3 Mercedes-Benzes, 3 Chevrolets — including the Corvette — and 2 Land Rovers. The remaining vehicles were one each from Bentley, Dodge, Ford, Jeep, Kia, Tesla, and Toyota.

Most of the contracts, which were originated between February 2015 and June 2024, were leases rather than loans (18 of the former, 7 of the latter). Monthly payments ranged from $348 for a 2012 Ford Edge SEL financed in early 2015, to $2,500 for a 2024 Porsche Panamera. The median payment was $972 a month for a 2023 Chevy Blazer

Balances owed at default were just as wide. The median was $58,882 (also the Blazer). At the high end was the same 2024 Panamera: roughly $133,000 owed, and no car returned.

What the model saw

By the time these cases reached court, of course, the borrowers and cars were long gone. We wanted to wind back the clock.

Using the documents attached to each case, we reconstructed each application the way it would have appeared the day a lender first received it. Then we ran each one through SentiLink’s First-Party Fraud model, which returns a number from 1 to 999 representing the likelihood that an applicant is misrepresenting themselves in the application.

The contrast was stark. In our benchmark of 26,180 California applications, the median score was 95, indicating very low first-party fraud risk. Among the 25 applications for the unrecovered cars, the median score was 758 — the 96th percentile of the benchmark. More than a third scored above 900, a level reached by only about 1% of the benchmark cases.

The model wasn’t perfect — four of the 25 came in under 300, indicating a low likelihood of fraud. But the overall picture is unmistakable: to the model, the overwhelming majority of these applicants looked like people misrepresenting their true credit identity at the time of application.

But why?

To us, this is one of the most fascinating parts of the work.

None of the individual application data is exotic. Our models rely mostly on basic identifying information that people scribble down on loan applications: address, phone number, social security number, email —humdrum vitals that don’t, at first glance, seem to tell you whether someone is being honest about who they are.

But together those details form patterns, and machine learning is very good at noticing when ordinary facts combine in unusual ways.

To investigate our model’s behavior with these lost-car cases, we peeked under the hood using a tool called SHAP. Think of it as a way to put tiny red flags and green flags on every part of the data: What data made the application look riskier for fraud? Which made it look more ordinary? And how much did each one matter?

First we look at SHAP values in big groups – not enough to tell us much yet, but enough to give us a map of where to look.

The biggest separation comes from the SentiLink cluster, the record of everywhere an application identity’s phone number, email, address, and IP have turned up across our network of 500+ partners. Ordinary applications are reassuringly repetitive, with the same details used again and again at a slow and steady pace. Something about the lost-car cases was different.

The above chart has other clues that surface fraud risk: unusual patterns of fraud alerts and similar fraud codes associated with the application identity, and phone numbers that were new, recently ported to a new carrier, or tied to multiple identities. There were also missing green flags, like long-running ownership of the same phone number and steady bank-account history (a slow “demand deposit account velocity” in industry argot).

All of that influenced the score. But since the biggest gap is in the cluster, let’s dig there.

Simply put, the lost-car identities were newer and busier. The typical benchmark identity had been in the cluster for more than five years; the typical lost-car identity, only 2.4. Benchmark applicants applied for credit about once every 90 days. The lost-car identities applied at nearly four times that rate. The identities attached to the lost-car replevin actions also applied to more different institutions than the average – about 5 compared to 3.

None of this proves fraud, of course. People switch banks. They shop for credit. But the model is reacting to a shared set of patterns that says “hey, something about these identities is out of the ordinary. Slow down. Take a closer look.”

That’s the broad view. Now let’s get specific and look at that Corvette.

The Corvette, under the hood

The model scored the Corvette application high at 762.

The Corvette case is a more intense version of the average lost-car replevin case. In the 90 days before the application, the same name, date of birth, and Social Security number had appeared in six applications — against the lost-car replevin average of 3.7 and the California benchmark of around 1. While the typical replevin identity had applied for accounts at five different institutions in the past year, the Corvette driver’s identity had applied at five different lenders in the past 60 days. Put together, the score was not about the car being flashy. The model did not know the borrower, or that the V8 was behind the seats. It saw a different kind of horsepower: an identity moving fast through applications, across institutions, with discernible signals of elevated fraud risk.

You can learn more about SentiLink’s approach to detecting elevated first-party fraud risk at the point of application here.

Every machine learning model is a snapshot of yesterday. It learns the shape of the world from the data it was trained on, and then we ship it. From that moment, the world keeps changing. The model, and the data scientists, have to keep up.

We have a name for what happens next: drift. Internally, we like an even simpler definition — time passes, and things change. A partner adds a checkbox to a form. A new data source comes online, and the inputs get a little richer overnight. All of it leaves fingerprints on the model’s outputs.

This post is about how we listen for that drift on SentiLink’s fraud models, what the listening looks like in practice, and three real examples from the past year of what we’ve heard.

The most boring possible example of drift

Before any of the fraud stuff, here’s the simplest case we have. One of the features in our models is the age of a record in the Manifest, our internal database of identity history. The oldest records date from when we started collecting data. Every year, by definition, those records get one year older.

The whole population shifts one bucket to the right, exactly as the calendar would predict, right on time.

This is drift in its purest, most innocuous form, and it makes the first point cleanly: drift is not always bad. It’s just change. Our job is to figure out which changes are a problem, which are a signal, and which are a yawn.

Two flavors: feature drift and score drift

Changes show up in one of two places.

The inputs can change. Maybe a partner starts collecting an email field they didn’t previously collect, or our coverage on a particular data source suddenly improves. We call this feature drift.

The outputs can change. The distribution of scores we calculate moves — more mid-range scores, fewer high ones, a thinning of one tail. This is score drift, and it’s often a downstream consequence of feature drift, though not always.

We watch both every week. The summary statistics we use are called Stability Indices (Population Stability Index, or PSI, for score drift, and Characteristic Stability Index, or CSI, for feature drift). Simply put, these are single numbers that add up when two distributions diverge. Below 0.1 we call green. Between 0.1 and 0.2 is yellow — a polite cough from the data. Above 0.2 is red.

A weekly report rolls in. Most of the time, nothing’s there. Sometimes there’s a story.

Story 1: a required field changed everything

Last June, our drift report flagged a model we run for a partner. PSI had been quiet for months, and then it wasn’t.

We had to worry if the model was getting worse, and if so, worse how?

We looked at the score histogram.

The very-high and very-low scores held mostly steady. The middle of the distribution — roughly 200 through 700 — got noticeably fatter. The model was producing more “there’s some kind of signal here” answers than before. So we walked through the inputs, looking for a feature whose change matched the change in the outputs. We found it on the first try.

The big blue bar on the right of the chart is what email history used to look like for this partner: more than half of applications came in without an email address. By June, that bar had nearly disappeared. The partner had quietly made a change to their application form.

A feature that used to be missing most of the time was now populated almost every time. From the model’s perspective, that’s a meaningful change in the world: an email address carries all kinds of signals that the model didn’t have access to before the model had learned how to confidently score applications without seeing an email address, and now it was more hesitant, because it was being handed information it had less practice digesting.

We talked to the partner. Other performance metrics — actual fraud caught, false positive rates — were still fine. The model wasn’t broken; it was just being compared against a baseline that no longer existed. So we didn’t replace or redesign anything. We reset the baseline. June 2025 is the new normal. From then on, when we asked “is anything drifting?”, we asked it relative to the post-June world.

The takeaway: not every twitch on a drift chart is a model going bad. Sometimes it’s the world becoming more informative than it was before.

Story 2: a bot attack, visible only in the histograms

Three months later, a different partner lit up the same monitor. This one looked different from the start.

Yellow zone, persistent. We pulled up the score distribution.

Look at the blue then vs. the red now, where the blue used to be. There was a meaningful chunk of applications scoring above 700 — high risk, by our scoring convention. In October, that chunk evaporated and reappeared around 500–600. Our magic 8-ball had gone from “outlook suspicious” to “reply hazy, try again.”

Now we were paying attention. Into the features.

Two charts, two stories. The first chart tracks how old an email address is when it shows up in an application. We noticed a spike in the leftmost bucket; the partner was suddenly seeing lots of brand-new emails. The second chart tracks the same thing for phone numbers — and there we see a fat new spike on the right. They were seeing way more old phone numbers than unusual.

Brand-new emails plus aged phones, arriving together at unusual rates, is a textbook signature of a bot attack. Fresh emails are easy to spin up at scale; aged phone numbers get bought off lists. The combination is a tell.

The attack was clever. People don’t change their phone numbers much, so an old phone number usually means a real person living a real life. One application with an aged phone and a fresh email just looks like someone who got a new Gmail. Thousands of them, arriving all at once, look like something else entirely — and that’s exactly what the shape of the histograms told us.

Story 3: we got better, and the old model couldn’t tell

Here’s a happier story. Over six months, one of our models started drifting for the best possible reason — we knew more than we used to.

The numbers here are small – a sliver of the PSI scores we saw with the bot attack – but they continued to slowly climb, month after month. Something was changing. But what?

New data sources had come online. In sports, a tough call sometimes becomes clear from a new camera angle. The new data worked the same way — helping us disambiguate a segment of previously murky applications and move them solidly into the “not fraud” scores, below 200.

Why this matters

In a perfect world, we could learn what fraud looks like once and identify the same patterns forever and ever. But we don’t live in that world. We live in a world where fraud, people, companies, and data are always changing. As experts in fighting fraud, we have to adapt – and to adapt, we have to know how the world is shifting around our models. When we see the shift before our partners, we can reach out. We can ask questions and work with them to understand what has changed.

There’s a version of fraud investigation that resembles detective work — a crime occurs, you examine the scene, and the clues you find in that one case teach you what to look for across millions of others. This is a quieter side of fraud investigation, using graphs as clues. One person with a brand-new email and an old phone number is just a person. Ten thousand applications arriving at the same partner in the same month make a bar chart that sounds an alarm.

At the end of a sparse industrial road in Arlington, Wisconsin — population 844 — there’s a warehouse that’s the official business address of nearly one thousand wholesale auto dealerships. Just don’t expect to see any cars outside for sale — or any people.

The businesses registered here have real licenses, issued by the state, that entitle them to buy and sell cars at dealer-only auctions across the country. But many have no employees, no inventory, and no real presence anywhere. What they have is an address — the one legal requirement most of them couldn’t satisfy on their own.

This is a Centralized Dealer Operation, or CDO. The phenomenon they represent — a single address hosting hundreds or thousands of paper businesses, each holding a government-issued license — is one that regulators have struggled to respond to for a decade, and that lenders and fraud analysts are only beginning to recognize as a risk signal.

What wholesale dealer licenses are (and why people want them)

To understand CDOs, we need to understand why a wholesale auto dealer license is worth having.

In the United States, car auctions — the kind run by Manheim and ADESA, two leading auction networks — are not open to the public. To participate, you need a dealer license. States require them to protect consumers: if a deal goes wrong, the license warrants that car buyers have somewhere to turn and something to recover. States uniformly require dealers to maintain a real, inspectable place of business, and post a bond — typically $25,000 or more — that consumers can claim against in cases of fraud or title problems.

While retail dealership licenses come with their own requirements (a physical showroom and display lot, regular business hours), many states issue a separate wholesale dealer license, and these are much easier to obtain. These often require just a bond and a business address, and entitle you to buy and sell to other dealers only — not consumers — and participate in the auctions.

This makes a wholesale dealer license enormously appealing for a specific type of entrepreneur: someone who wants auction access, wants to flip cars, and doesn’t want to build an actual dealership to do it.

The companies selling the licenses

In 2010, a company called US Dealer Licensing began turning the CDO model into a business. The idea was simple: lease a large commercial building, divide it into registered business addresses, and sell annual memberships to people who needed a physical location to qualify for a wholesale dealer license. USDL, as it’s known, describes itself as the country’s leading centralized dealer operation — and operates out of 101 Skyline Drive in Arlington, Wisconsin, the warehouse where nearly a thousand wholesale dealerships are currently registered.

The company changed hands in 2018, when entrepreneur Anik Shah and a partner acquired USDL for $1.25 million. Then, in late 2025, the private equity firm of NetJets CEO & chairman Jordan Hansell, Tradepost Partners, made a controlling investment — a signal that someone looked at the business of selling registered addresses to wholesale dealers and saw durable, scalable cash flow.

USDL markets itself openly: it has a website, a Facebook page, and cheerful explainer videos walking prospective customers through the signup process for “your golden ticket.”

On TikTok and YouTube, influencers pitch wholesale dealer licenses as a low-barrier side hustle — a way to access dealer-only auctions, flip cars for profit, and build a business without a lot or a showroom. Some sell online courses. USDL, and a handful of competitors operating similar buildings in other states, are there to close the deal.

Why fraudsters love a CDO

None of this is inherently illegal, of course. A wholesale dealer license is a legitimate, state-backed credential, and a CDO can provide aspiring entrepreneurs with a foot in the door of a market that would be otherwise inaccessible. People who sign up include hobbyists and side-hustlers looking to flip cars, some of whom scale into full-time businesses, and others that buy a car or two at auction, maybe make a little money, and then move on.

“Centralized dealer operations are a legal, efficient, and widely used model in the wholesale auto industry,” RJ Nicolosi, CEO of US Dealer Licensing, wrote to us in an email. “Just as many industries have adopted co-working or virtual office models, we help legitimate entrepreneurs meet state facility requirements without prohibitive overhead.”

But the infrastructure of CDOs makes them useful for fraudsters. Wholesale dealer licenses allow cars to be sold from dealer to dealer with far less scrutiny than consumer transactions, which require mandatory disclosures, odometer certifications, and title checks designed to protect the buyer. That reduced scrutiny, combined with inconsistent title rules across state lines, allows a shady actor to move a vehicle through a chain of dealer-to-dealer sales — obfuscating material problems like salvage damage, flood history, or a lemon law buyback along the way. This is title washing: run a car through enough jurisdictions and the brand on the title can effectively disappear. Or a dealer can skip the complexity entirely and simply roll back the odometer, then resell the car through dealer channels where mileage scrutiny is lower — pocketing tens of thousands of dollars more than the vehicle is actually worth.

The same infrastructure enables fraud that has nothing to do with cars. A government-issued license tied to a real business address is exactly what a synthetic identity needs to look legitimate — and business entities can access far more credit and phone lines than individual consumers, making a CDO-backed identity also a useful building block for financial fraud.

SentiLink data indicated fraudulent activity tied to CDOs. Analyzing 167 applications tied to the Skyline Drive address, half scored above 750 on SentiLink’s First Party Fraud model — a threshold that indicates a high probability the applicant is misrepresenting some element of their identity. Forty-two applications scored above 900, and multiple identities in the cluster were flagged as linked to synthetic Social Security numbers, or had prior convictions for forging titles or possessing a vehicle title or registration without authorization.

Regulators struggle to keep pace

Since 2024 Wisconsin has revoked the licenses of 444 wholesale dealerships including 123 at the Skyline address alone, according to the state’s Department of Transportation. State officials say the violations include dealers rolling back odometers, selling directly to consumers, and operating with no genuine business presence. Odometer fraud in Wisconsin involved more than 930 million rolled-back miles in 2024 and 2025, officials say, causing over $55 million in losses.

US Dealer Licensing declined to discuss individual customers, citing privacy and regulatory concerns, but said it has “a strong working relationship” with state authorities. “When potential violations are identified, we promptly cooperate with investigations. Dealers found to be non-compliant are removed from our network,” wrote Nicolosi, adding that the company actively monitors dealer compliance and is developing AI-assited tools to help its customers do the same. “Our goal is continuous improvement in supporting lawful operations.”

Attempts to cut the practice off altogether have struggled. Indiana and Washington eliminated the wholesale dealer license category entirely — in 2015 and 2017, respectively — but no state has followed since. In Wisconsin, two separate bills would have tightened wholesale dealer requirements. Both failed: Assembly Bill 581 in 2021, and Senate Bill 588 in the 2023-24 session. Arkansas introduced a similar bill in 2025; it died in committee. USDL lobbied against at least one of the Wisconsin bills.

The business, meanwhile, keeps growing. USDL, now backed by Tradepost Partners, has announced plans to expand its national footprint — with Arkansas, a state with no enforcement infrastructure aimed at CDOs, as the current growth frontier. The demand side shows no signs of slowing either: influencers like @thankucheese, who has amassed 221,500 TikTok followers teaching people how to get a dealer license and access Manheim and ADESA auctions, keep publishing. In Arkansas, SentiLink has already identified CDO-style clusters — multiple wholesale dealer licensees sharing a single industrial address — suggesting the pattern that took years to surface in Wisconsin is already replicating itself further south.

While the warehouse on Skyline Drive is finally getting some attention, in Arkansas and beyond, plenty of other empty rooms are just opening for business.

Why does Montana have 131 Bugattis registered in 2024, while Washington State — with twice the population — has zero? The answer is an open secret, one that may soon become expensive for auto lenders.

Montana has no sales tax, and its laws allow anyone — regardless of where they actually live — to form an LLC there in a few days for a few hundred bucks, then register a vehicle in that LLC’s name. There’s no vehicle inspection, no emissions test. In California, where the base sales tax rate is 7.25 percent, savings reach tens of thousands of dollars for high-end cars. The buyer never has to visit Montana. The plates arrive in the mail. Exotic car buffs have a name for the practice: the Montana Loophole.

The $49 loophole

Montana is home to a thriving cottage industry built around the loophole. Registered agents with names like Fast Easy Registration and 49 Dollar Montana Registered Agent advertise the service openly on Google. For about $1,000 all-in, they’ll form the LLC, handle the DMV paperwork, and ship you Montana plates wherever you are. Luxury cars, RVs, even small aircraft are all fair game. The result: Montana has more registered vehicles per capita than any other state – some 2.3 million registered vehicles for 879,000 licensed drivers in 2023, according to a Bloomberg Tax analysis.

But now other states are cracking down, and lenders who fronted hefty sums for these high-end vehicles may find their collateral seized, their titles clouded, or their institutions entangled in federal money laundering investigations. We went looking for exposed loans. We found them.

Utah, which passed Senate Bill 52 last year, identified 16,000 vehicles and 4,800 boats registered out of state by Utah residents, representing up to $100 million in potentially recoverable taxes and penalties every year.

California is pressing criminal charges. In March, authorities there arrested 14 residents for concealing more than $20 million in luxury vehicle purchases — including a $1.8 million McLaren Elva and a $1.5 million Porsche 918 Spyder — through Montana LLCs since 2018. The charges include felony tax evasion and money laundering.

Getaway cars: now with financing

When we pulled the records on the vehicles named in California’s complaint, four carried active liens — meaning those lenders are likely to get identified and possibly even dragged into the resulting prosecution for money laundering and tax evasion. Among them: a 2023 Ferrari SF90 Spider and a Lamborghini Aventador, both registered through the same $49 Montana registered agent, and a Mercedes-Benz G63 AMG and a Porsche 91 GT3.

Broadening our search, we found Montana LLC-registered vehicles backed by lenders of every stripe — community banks, national institutions, and captive auto finance arms — with active liens on vehicles ranging from a $298,000 Bentley Bentayga to a Corvette Stingray. Using SentiLink Intercept, we identified LLCs with addresses matching those of Montana registered agents, and with officers based out of state. (The Bentley owner lives in Kansas; the Stingray: North Carolina).

Montana Corporate, one registered agent, even maintains a dedicated financing page on its website listing lenders its clients have successfully used — suggesting the intersection of Montana LLCs and auto financing is far from unusual.

For lenders, legal exposure runs in several directions. States can claim unpaid taxes ahead of lenders, or seize the vehicle outright in a criminal proceeding — leaving the lender’s collateral tied up in court, or gone entirely. Meanwhile, a fraudulent registration may throw the title itself into question. The California complaint adds another wrinkle: several defendants face money laundering charges for moving hundreds of thousands of dollars through bank accounts to fund these purchases — exactly the kind of transactions that financial institutions are required to flag under federal anti-money laundering rules.

Big sky, dark clouds

The crackdown is still in its early stages. In California, officials say to expect more criminal cases. They have already mapped the problem by dealership: 416 suspicious Montana LLC sales in Beverly Hills alone, 359 in Costa Mesa, 273 in Van Nuys, and 269 in San Diego.

Utah is building a paper trail. The state now uses insurance records to identify vehicles registered out of state by Utah residents, cross-referencing them against DMV data to find potential tax scofflaws. When it finds one, the owner gets a notice and 60 days to pay up — after which they face the full back taxes plus a penalty equal to 100% of what they owe.

The Montana loophole is closing. Some lenders may be left by the side of the road.

Christmas Day is one of the few days when large parts of the economy simply…stop. Offices are closed. Customer support teams run on skeleton crews. Most people—fully ninety-seven percent of the civilian workforce, according to the Bureau of Labor Statistics—have a paid holiday. Instead of a normal workday, they open presents, cook, or travel.

But when we were working on our latest Fraud Report, we noticed that the identity theft rate spikes on Christmas. That raised an obvious question: is identity theft actually increasing on Christmas or are fraudsters simply the only ones left at the office? When most of the economy shuts down — on Christmas, Thanksgiving, or the Fourth of July — do fraudsters follow the same rhythm, or keep right on working?

Fraudsters are people too, of course. But they operate outside the systems we normally use to measure work — labor statistics and the like — and their activity is hidden by design. So when nearly the entire workforce takes the day off, it’s not immediately clear whether fraudsters follow the same rhythm or keep right on going.

Fortunately, even the most furtive fraudsters leave footprints. At SentiLink we track their behavior across millions of applications, 24/7/365. (Most of SentiLink’s human employees take Christmas off, but our risk models do not). That gives us a way to investigate.

Short answer: fraud rarely takes a holiday

Across most major U.S. holidays, identity theft rates run 15 to 20% higher than comparable weekdays. But that doesn’t usually mean fraud suddenly increases — on most holidays the number of suspicious applications falls too, just not nearly as much as the number of legitimate applications.

But on Christmas, fraudulent application volume really does rise in one channel: deposit-account applications like checking and savings. Driven by that activity, Christmas identity-theft rates climb to 64% above the weekday baseline as activity thins out.

How we tested holiday fraud patterns

Our hypothesis was straightforward: if fraudsters follow the same rhythms as the rest of the workforce, fraud volume should slow down on days when most Americans are off the clock.

To test that idea, we looked at applications from a subset of SentiLink partners during six U.S. holidays when more than 90 percent of civilian workers typically receive paid leave, according to BLS — New Year’s Day, Memorial Day, Independence Day, Labor Day, Thanksgiving, and Christmas. In the year we analyzed (2025, the first with complete fraud-report coverage), all six happened to fall on weekdays.

We compared those six holidays to a matched set of sixty ordinary weekdays, selected to mirror the same distribution of quarters and days of the week. To avoid spillover effects, we excluded the days immediately before and after each holiday.

We then evaluated fraud in two ways. First, we calculated the weighted identity theft rate using the same partner filters and industry weighting methodology used in our fraud reporting. (Readers interested in how those fraud probabilities are generated and how the weighted fraud rate is calculated can find the full methodology in our Fraud Report.)

Second, we performed a simpler statistical check: comparing the share of applications with at least an 80% probability of being identity theft (based on that same methodology) between holidays and control days using a two-sample t-test.

While SentiLink tracks multiple kinds of fraud, we focus here on identity theft — both because a cursory check showed similar patterns for synthetic fraud, and for simplicity’s sake.

Taking the day off, sort of

Before looking at fraud, we started with a simpler question: when Americans take the day off, do they stop applying for credit cards, bank accounts, and other services?

On average, the answer appears to be yes. Across our control days we observed about 1.27 million applications per day. On holidays that number falls to about 1.03 million, a decline of roughly 18.6 percent.

But the average hides a lot of variation. On some holidays Americans step away from personal finance; on others they catch up on it. On New Year’s Day, application volume falls about 61 percent below the annual weekday average, and Christmas Day shows a similar drop of roughly 57 percent. Thanksgiving also sees a noticeable decline, about 17 percent below the annual average.

Other holidays move in the opposite direction. Memorial Day actually sees about 21 percent more applications than a typical weekday, Labor Day runs roughly 10 percent above average, and Independence Day comes in only about 6 percent below normal levels.

The variation gets even starker once we break activity down by use case. Car buyers drive the Labor Day spike, using the long weekend to shop dealerships and lock in promotions like discounted financing and 0% APR offers that often accompany end-of-summer inventory clear-outs.

Memorial Day shows a similar bump in lending, which in our data includes a large share of buy-now-pay-later (BNPL) applications — likely reflecting shoppers financing purchases during holiday retail sales. At the other extreme, some categories nearly vanish on the true shutdown holidays: auto applications collapse on Christmas and New Year’s Day, when dealerships close and nobody spends the day applying for car loans.

Fraudsters on holiday

But how do fraudsters behave when the herd thins out?

To find out, we estimated identity-theft rates using the same methodology as in the SentiLink Fraud Report, which we believe provides a good approximation of overall identity-theft activity in the United States.

Across the holidays, fraudsters generally claim a larger share of the field. On ordinary weekdays in our sample, about 4.8% of applications were classified as high-risk for identity theft. But on Memorial Day, Independence Day, and Labor Day, they show up at rates roughly 15–20% higher than a typical weekday. By Thanksgiving the gap widens further. And on Christmas — when legitimate application activity collapses — fraudsters account for a greater percentage of what remains, pushing the estimated fraud rate more than 70% above baseline.

The only holiday that doesn’t follow the pattern is New Year’s Day, when fraudsters appear to slow down along with everyone else. But we can’t truly understand what’s happening with the rate increase without looking at the volume of fraudulent applications to see how it changes.

Counting high-risk applications

So we looked another way, flagging high-risk applications — those whose identity-theft scores correspond to roughly an 80% probability of identity theft in our validation tests — and comparing how often they appear on holidays versus our baseline of 60 comparable weekdays.

Most of the time, high-risk applications move with the herd. When overall application activity rises or falls, the volume of highly suspicious applications usually moves in the same direction. That’s what we see on most holidays. When application volume drops — as it does on Memorial Day or Thanksgiving — the number of high-risk submissions typically drops as well. New Year’s Day goes even further: fraudsters appear to stay home in especially large numbers, with suspicious applications falling more sharply than overall activity. Fraudsters, it seems, generally follow the same rhythms as legitimate applicants.

But a few holiday–use-case combinations stand out. On the Fourth of July, for example, credit-card applications include more high-risk submissions than a typical weekday, even though overall application volume dips slightly. That suggests fraudsters sometimes follow specific opportunities rather than the overall market.

And then there’s Christmas.

On Christmas, application volume collapses, but high-risk submissions fall much less — and in one channel, deposit accounts, high-risk volume actually exceeds the typical weekday level. In other words, most of the time fraudsters behave like black sheep, moving with the herd. But on Christmas, the wolves really do come out.

To check whether these differences could simply be random variation, we tested the holiday results against the proportion of ordinary weekdays. For each use case, we compared the share of high-risk applications on the holiday to the share observed across the 60 matched control days using a two-proportion test. Because we ran multiple comparisons across holidays and products, we also applied a false-discovery-rate adjustment to avoid overstating statistical significance. The key patterns — including the spikes around Christmas and several product-specific increases on other holidays — remain statistically significant (p << 0.01) under those tests.

Of course, this is only a first pass at the question. Our analysis covers a single calendar year, and fraud patterns evolve quickly as attackers adapt to defenses and opportunities. Different years — or different economic conditions — might produce different holiday dynamics. And while our models capture a large share of identity-theft attempts across our network, no single dataset can perfectly represent the entire market. The patterns we see here are best understood as suggestive evidence rather than a final word.

So do fraudsters take holidays? Sometimes. On New Year’s Day they appear to stay home even more than the rest of us. Most of the time they follow the herd, rising and falling with ordinary application activity. But on a few days — especially Christmas — they don’t. For fraudsters, Christmas is just another day at the office.

For more analysis of fraud rates and trends, grab a free copy of the brand-new SentiLink Fraud Report.

We know that fraudsters exploit the abandoned US identities of immigrants who once lived in the United States but have since left the country — this is called Assumed Identity Abuse (AIA).

But what about Americans who renounce their citizenship and leave the country? Much like immigrants who have left the country, these people have effectively abandoned their US identities, but those identities don’t disappear. And fraudsters, it turns out, are exploiting that.

When we analyzed a sample of “renounced” identities and compared that to samples of US identities, we found that the renounced identities were significantly more likely to have been exploited for identity theft. Renounced identities were also exploited more often, with a median of roughly 8x more high-risk applications linked to their identities (post-citizenship-renunciation) than were linked to exploited identities in the control groups.

Active exploitation: a sample case

To understand what this type of identity fraud looks like in practice, let’s walk through an example. What follows is a real case, although we have changed the name and anonymized other details to protect the victim’s privacy:

Tarin Sule was born in 1991, probably somewhere in the area of Washington, D.C. Based on a LinkedIn profile that appears to belong to the same person, he went to a D.C. area college and worked as an intern at a D.C.-based company before taking a full-time role in New York. Several years later, around 2015 or 2016, he appears to have moved to the Middle East, taking a series of jobs in the region and founding a startup based there in 2017.

According to the US Federal Register’s lists, he renounced his US citizenship in 2019. And as of 2026, Tarin is still located in the Middle East, according to the LinkedIn profile.

However, in late 2024, Tarin’s identity was used in an account-opening application to a major U.S. bank. This application lists Tarin’s correct name, DOB, and SSN, but was submitted from a California IP address, with a California phone number, and listing a Southern California mailing address. Tarin has no known history in California. The application also lists what appears to have been a brand-new email address at the time of application. These are classic signs of identity theft, and SentiLink scored this application as high-risk.

In early 2025, the fraudster appears to have tried again, submitting two more applications to the same bank using Tarin’s identity in combination with different contact information — another new email, a different Southern California address, and a different California phone. Both of these applications also scored as high-risk.

And it appears the fraudster or fraudsters exploiting Tarin’s U.S. identity haven’t given up. In late February 2026, two additional applications were submitted in Tarin’s name, one to a rent-to-own firm and another to a different major U.S. bank. Again, these applications scored as high-risk for identity theft.

How we linked renounced-citizenship identities to identity theft risk

The U.S. Federal Register publishes quarterly lists of Americans who’ve chosen to renounce their US citizenship and expatriate. The lists include a first name, last name, and middle name or initials if available, for each individual. No additional identifying information is provided, but since the lists are issued quarterly, we know that the identities included on a given list must have renounced their citizenship before the date the list was issued.

To analyze whether these “renounced” identities are being exploited, we looked at names from the past ~15 years of renunciations and identified a group of 616 renounced identities with very rare surnames (all surnames with fewer than 100 total instances in the 2010 US census).

Because these surnames alone are so rare in the United States, if an application in our database matches the surname and the given name provided by the Federal Register, the application identity and the Federal Register identity are very likely to be the same.

For these 616 identities, we searched our database for bank and credit applications that were submitted after the applicant identity renounced their citizenship and that scored high for identity theft risk with SentiLink’s Identity Theft Score. We found that 69 of these identities, or 11.2%, were associated with at least one high-risk identity theft application submitted after they’d renounced their citizenship.

We then compared this to a random sample of roughly 4,000 identities from our database who, like the renounced group, had extremely rare surnames, and found that 3.91% of those identities had been exploited.

That is a dramatic difference. Renounced identities were 2.86x more likely to have been exploited by fraudsters.

These renounced identities were also exploited more often (11.8 high-risk applications on average) than the exploited control identities (1.88 high-risk applications on average).

This fraud M.O. appears to be a small but active subcategory of Assumed Identity Abuse. These renounced identities likely appeal to fraudsters for the same reason they target the identities of immigrants who’ve left the U.S. — since the victims are no longer in the country and have stopped using their U.S. identity, they are unlikely to ever notice or report that it has been stolen.

Are fraudsters using the Federal Register to find targets?

Manual review of a sample of high-risk applications from the exploited renounced identities suggests that most of these applications include the identity’s true date of birth and SSN — information that is not available from the Federal Register.

It is possible that fraudsters are sourcing names from the Federal Register’s list and then searching for the rest of the PII elsewhere. But SentiLink researchers have already documented that fraud markets openly sell packages of “expat” and “emigrant with credit history” identities. We think it is more likely that fraudsters are sourcing these identities primarily from markets like these — these packages likely include a mix of identities including immigrants who’ve left the US, US expats who may one day return, and the identities of people who’ve renounced their citizenship and moved abroad.

Conclusions

It appears that fraudsters are actively targeting the U.S. identities of anyone who has permanently left the United States, whether they are former immigrants or former citizens. And unfortunately, because the Federal Register publishes only names — the vast majority of which are common enough that multiple people share the same name — there is no realistic way for FIs interested in combating this trend to leverage those lists.

However, these applications are detectable with identity theft tools such as SentiLink’s Identity Theft Score. Financial institutions should be particularly alert to applications that show signs of the typical patterns we see in other Assumed Identity Abuse (AIA) cases: identities with an established history in one location, a period of dormancy, and then a burst of new activity, often in a location to which the identity has not previously been tied, and using new phone and/or email addresses.

Learn more about how abandoned identities and abandoned PII elements are used by fraudsters in our latest Fraud Report, which is free and available now.

Also, see how abandoned identities like these become fuel for fraudulent schemes in this CBS news report featuring Dr. David Maimon, SentiLink’s Head of Fraud Insights:

Fraud nerds are a specific type of person. You see the gift card rack at the grocery store and think about money laundering. You walk past a cash-only restaurant where nobody ever seems to eat and think: what are they actually selling? You explain some audacious scheme to your family at dinner, and they don’t quite get why you’re so animated.

If any of that feels familiar, this Substack is for you.

Who we are

SentiLink is a fraud intelligence company. We have two teams: fraud investigators who dig into individual cases that are messy, specific, surprising, and data scientists who take those investigations and turn them into risk models that are clean, systematic, and predictive.

We work with over 500 partners across the U.S. financial ecosystem, including 13 of the top 15 banks and 2 of the top 3 telcos. They share the fraud they’re seeing; we give them tools to stop it. What our investigators find today is what our models catch tomorrow.

What we’ll write about

The stories. Investigations into specific fraud schemes — how they work, who’s behind them, and how they unravel. If you’ve seen our Head of Fraud Insights, David Maimon, in the LA Times or on CBS exposing identity theft rings and fraudulent businesses, this is more of that — new cases, told from the inside.

The patterns. Twice a year we publish a fraud report drawn from hundreds of millions of real applications across the financial system. But we analyze this data every day — so this Substack lets us share what we’re seeing as patterns shift and new ones emerge.

The ideas. Conferences and LinkedIn are teeming with buzzwords — Agentic AI, deepfakes, dark web identity marketplaces — but which are true near-term threats? We see this stuff up close every day. We use that experience to discern what’s merely chatter, and what truly matters.

Who it’s for

We’re writing this for anyone who finds fraud genuinely interesting — and there are more of you than you might think.

If you’re an investigator, you’ll find stories from the front lines that resonate with what you see every day, and the data context that helps explain why.

If you’re a data scientist or engineer, you’ll find the messy real-world texture that gives your models meaning, and the emerging patterns worth watching.

If you’re a leader trying to build a fraud strategy, you’ll find the ground-level intelligence and the higher-order thinking you need to make better decisions.

And if you’re just someone who’s curious about how this world works — the cat-and-mouse of it, the ingenuity on both sides, the way fraud tells you something about the systems and society we’ve built — you’re exactly who we’re writing for.

Fraud nerds, welcome home.

Subscribe now