Bust-Out Fraud

Bust-out fraud is a planned scheme in which a borrower, or a group controlling several identities, opens credit accounts, behaves like a model customer for months to earn higher limits, and then draws down all available credit at once before disappearing. The "bust-out" is that final burst of spending and cash withdrawal. It targets credit cards, revolving credit lines, retail finance, overdrafts and, increasingly, buy now, pay later (BNPL) products.

Bust-out is a staged form of first-party fraud, because the account holder intends from the start not to repay. It is often run with synthetic identity fraud, where the "customer" is a fabricated person, and the losses frequently surface as ordinary credit write-offs rather than as fraud. A related business version involves shell companies that build trade credit with suppliers and then order large quantities of goods before closing.

Picture a new regular at a corner shop who pays every tab on time for a year. The owner starts to trust them and lets the tab grow. One week the regular runs up the biggest tab possible, buys items they can resell, then never comes back. The shop discovers it was a plan all along.

Bust-out fraud is the same trick played on banks, often on many at once. The patient, good behaviour is the bait. Because the customer looked perfect until the last moment, the warning signs only appear in a short window just before the money is gone.

1. Establish. The fraudster creates or obtains an identity and opens accounts, sometimes using a thin file that needs time to build a credit score.
2. Nurture. They make small purchases and pay on time, sometimes for a year or more, and request limit increases. "Piggybacking" as an authorised user on another person's account can speed this up.
3. Expand. With a good record at the credit bureau, they apply to more lenders and stack limits across several accounts.
4. Bust out. Within days, they max out every line, buy goods that resell easily, take cash advances and may make fake payments, often with bad cheques or reversible transfers, that temporarily free up more credit before bouncing.
5. Disappear. The accounts go into default. Contact details stop working, and collection efforts find no one.

The fake-payment step is what turns a maxed-out card into a much larger loss: if a lender restores available credit before the incoming payment clears, the fraudster can spend the limit twice.

Lenders look for a cluster of signals, since any one of them can be innocent:

• Rapid credit-seeking. Many applications and new accounts across lenders in a short period, often detected through bureau inquiries and velocity checking.
• Sudden change in use. Utilisation jumps from low to near 100% across all accounts at the same time.
• Payments larger than the balance. Overpayments or payments that are returned shortly after credit was released.
• Shared data points. Several "different" customers using the same phone number, device or address, a sign of an organised ring.
• Cash-like spending. Gift cards, electronics, jewellery and cash advances concentrated in a few days.

Behavioral analytics and network link analysis are the main tools, because they compare a customer with their own history and with linked identities rather than just checking whether the identity is real.

When an account busts out, the balance is usually charged off as a credit loss and covered by the lender's loan loss provision, not reported as fraud. This understates fraud figures and can mislead credit models into treating the defaults as bad luck. Many lenders now re-examine charged-off accounts and move suspected bust-outs into fraud reporting, so that the patterns can feed detection models instead of only pricing models. Bust-out is a particular concern in unsecured lending, since there is no collateral to recover and the identity behind the account may not lead to any real person who could be pursued for the debt, and it can raise a lender's share of non-performing loans.

Common defences include waiting for incoming payments to clear before restoring credit, limiting how fast limits can rise on new accounts, sharing data on suspected rings through industry consortia, and monitoring for linked identities. Banks in the US file a suspicious activity report when a bust-out meets reporting thresholds. Bust-out is one entry in a lender's wider fraud typology, and the organised version sometimes overlaps with a money mule network that moves the cash out.

• Financial Crimes Enforcement Network (FinCEN)
• Consumer Financial Protection Bureau