It’s a scenario no merchant cash advance team wants to face: Monday morning, the operations dashboard flags a massive unexpected chargeback – $400,000 gone from a deal approved last week. A quick review of the merchant’s documents shows every box ticked, every line item in order. Yet, the funds have vanished, and your due diligence now feels lacking.
If that story sounds familiar – or alarming – you’re not alone. Across the small business lending industry, leaders are asking a new question: Can our KYC actually prevent fraud, or is it just something we do as a formality? In today’s rapidly evolving risk landscape, it’s not enough to gather documents or trust in routine. It’s time to rethink what resilience looks like—before fraudsters force the lesson for you.
US Fraud Reality: Identity Impersonation Schemes
The modern fraudster is much smarter than in past years. Today, schemes are multi-layered, data-driven, and engineered to exploit every gap in the onboarding and funding process. Between 2019 and 2024, a landmark investigation by deBanked exposed how a handful of U.S.-based fraud rings targeted the cash advance sector and walked away with millions.
Let’s break down their tactics:
- Sophisticated Phishing: Fraudsters used stolen merchant identities and government filings to assemble flawless applications, complete with real bank statements, matching tax IDs, and documents obtained from public databases.
- Broker and Merchant Impersonation: Instead of relying on obvious forgery, the strategy involved impersonating legitimate brokers and merchants, utilizing voice-altering software during phone interviews and employing near-perfect domain registration to bypass traditional checks.
- Multi-Stage Money Movement: After approval, the merchant’s real bank account would receive funds. Then, the scammers – usually posing as a trusted lender or consultant – would prompt a “refinance” wire transfer. Victims sent money back not to the legitimate lender, but to offshore shell accounts or crypto exchanges.
- Operational Scale: Deals averaged $200K–$600K, and many funders only realized the fraud days or weeks after the money was already gone. Documentation was never the problem. Process blind spots, especially around identity verification and real-time review, were.
Industry aftershocks linger: some funders report multi-six-figure write-offs on single deals, with the confidence and trust built up between underwriting and brokers shaken at the core.
And it’s not just today’s attackers. Each cycle of AI-driven phishing, synthetic identity creation, and document forgery makes detection harder. Underwriting, risk, and compliance teams across the industry are now navigating an unprecedented volume of flagged applications. As a result, the line between routine onboarding and a potential six-figure fraud event has never been thinner.
Why Current MCA KYC Falls Short
So why do these scams succeed? It’s not a lack of effort or intelligence – most MCAs conduct a thorough onboarding. But in most cases, the process is weighted toward this single entry point. What’s often missing are layered identity checks, deeper ownership analysis, or ongoing risk review – leaving gaps for sophisticated threats to exploit as time goes on.
Let’s discuss some of the most common pitfalls:
Document-Only Focus:
Many teams verify paperwork, but miss confirming the person presenting it. A government ID and a matching bank statement mean little if you don’t know who’s really on the call. A quick FaceTime, a live video check, or behavioral interview could flag inconsistencies, but static systems rarely escalate to these steps.
Single Verification Point:
Approval is often the end of due diligence. What about post-funding communications? When an apparent merchant requests a wire or asks to change a payment rail, is there a method for re-verifying identity before cash moves?
Uniform Scrutiny:
In many MCA organizations, the same onboarding checklist – a review of IDs, bank statements, and business docs – may be used for both low-value renewals and high-value first-time advances. Without clear protocols for escalating risk reviews on large deals or new brokers, the riskiest transactions don’t always receive the extra scrutiny they merit.
Ownership Blind Spots:
Shell companies, multi-layered LLCs, and hidden beneficial owners slip through onboarding when only surface registration is checked. Fraudulent entities love planting roots in ambiguous documentation; robust UBO tracking can break up these attempts before they grow.
Each of these issues is documented, not hypothetical. MCA leaders we spoke to shared stories of near-misses, surprising recoveries, and painful lessons. The common thread: process gaps aren’t discovered in audit – they’re exposed in loss.
Banks’ Layered KYC Blueprint & MCA Application
Banks excel at building dynamic KYC frameworks that adapt and escalate controls in response to emerging threats. Beyond meeting regulations, these approaches offer actionable strategies that MCA organizations can adapt to fit their own business models and operational workflows.
Let’s walk through the pillars and practical applications:
- Risk-Based Segmentation
- Bank insight: Assign customers to risk tiers based on transaction volume, business type, and history.
- MCA application: When onboarding, create a quick risk “score” for new deals – flagging large amounts, new business models, first-time brokers, or markets with a history of fraud. High-risk? Extra layers kick in.
- Customer Due Diligence (CDD) vs. Enhanced Due Diligence (EDD)
- Bank insight: Use CDD for routine relationships and EDD for high-risk profiles – requiring deeper info, repeated checks, and periodic updates.
- MCA application: For established merchants renewing, run CDD. If you see large first funds, unusual company structures, or sectors flagged for fraud, escalate to EDD: video interview, additional document validation, ownership tracing.
- True Identity Verification
- Bank insight: Live video, behavioral and digital verification platforms, phone and email validation, and ongoing watchlist scraping.
- MCA application: Add a step to verify each merchant’s phone number against billing history, accept only corporate emails, and for flagged deals, use video verification to visually confirm identity.
- Beneficial Ownership Checks
- Bank insight: Dig into the UBO and related entity landscape to spot shell companies and undisclosed risk partners.
- MCA application: Request UBO forms for new onboardings and rerun them before large renewals and any ownership changes.
- Ongoing Monitoring
- Bank insight: Use pattern recognition and real-time alerts to flag risky behavior after initial approval.
MCA application: Run monthly or quarterly transaction scans for unusual cash movements, new payment rails, or rapid escalation of funding requests.
Collaboratively, adopting these steps turns KYC from a roadblock into a resilience toolkit – empowering teams to ask better questions, respond more quickly, and restore trust before trust is challenged.
From Blueprint to Action: 90-Day Implementation Roadmap
Bringing new KYC strategies to life isn’t just about having a framework. Execution matters. Here’s a practical 12-week plan to operationalize smarter verification and keep teams moving together:
Before starting, set milestones for tracking progress and accountability – this plan works best when underwriting, risk, compliance, and operations are aligned.
Weeks 1–2: Audit & Risk Mapping
- Review last 90 days of deals for fraud indicators: fake brokers, voice anomalies, documentation inconsistencies.
- List process gaps, assign high-risk segments, and highlight “close calls” or unresolved cases.
Weeks 3–5: Deploy Foundational Controls
- Enforce strict phone and email verification on all new high-risk deals.
- Launch automated alerts for domain mismatches, duplicate document metadata, and strange patterns in applicant history.
- Conduct video calls for flagged deals, not just for compliance but for high-value transactions.
Weeks 6–8: Layered Verification Rollout
- Integrate live video KYC for flagged merchants and brokers.
- Request and review UBO details, mapping corporate relationships for all medium and high-risk deals.
Weeks 9–12: Continuous Monitoring & Review
- Activate transaction-pattern monitoring dashboards; set up notifications for unusual cash movements.
- Establish periodic re-KYC triggers (e.g., every 12 months, or on major account changes).
- Prepare an internal compliance pack with evidence trails and process checklists, ready for board or audit team review.
This roadmap isn’t about disruption – it’s a method for raising the entire operation’s resilience, building trust with partners, and reducing the “unknowns” in every deal.
Building Confidence & Next Steps
Through experience and ongoing collaboration with the MCA community, these best practices have proven they make a measurable difference. By strengthening KYC—not as a box to check, but as a living defense system—you protect capital, secure business partnerships, and build a reputation for reliability.
Ready to take action?
- Audit Today: Use the blueprint to map and challenge your current KYC against industry-backed best practices.
- Pilot in 30 Days: Select a risky segment for enhanced verification – large deals, new brokers – and measure the improvement.
- Scale in 90 Days: Refine, automate, and roll out upgrades across your business.
When identity fraud strikes, your KYC won’t just be “good enough” – it’ll stand as a foundation for growth, resilience, and peace of mind. If you want a set of helping hands, team HyperVerge is just a call away.
