Most fraud in lending happens fast — a fabricated application, a single bad-faith advance. Bust-out fraud is different. It is patient by design: a scheme that builds a legitimate-looking credit and payment history over time, specifically to earn access to larger financing, before defaulting deliberately once the exposure is big enough to make it worthwhile. That patience is what makes it harder to catch through standard underwriting checks alone.
How a bust-out scheme typically unfolds
A bust-out scheme generally follows a recognizable arc, even though specific tactics vary. It usually starts with a business — sometimes genuinely operating, sometimes a shell set up for this purpose — establishing a clean payment history on smaller obligations, including possibly a smaller MCA advance repaid faithfully. That good track record is then used to qualify for progressively larger financing, sometimes across multiple funders in parallel. At some point, the business stops repaying entirely, often after drawing down as much available credit as possible in a short window.
Early signals worth watching for
A pattern of rapid credit-limit or advance-size escalation
A business seeking meaningfully larger amounts in quick succession, especially shortly after establishing a track record, deserves a closer look — not because growth is suspicious on its own, but because the speed and timing pattern is a known bust-out characteristic.
Sudden increase in financial activity without a clear business explanation
A jump in deposit volume or transaction activity that doesn't correspond to any evident change in the business's operations — new locations, new contracts, seasonal patterns — can indicate manufactured activity designed to support a larger financing request.
Applications across multiple funders in a compressed window
As covered in our piece on detecting stacking, a business drawing on multiple funding sources simultaneously, particularly late in what looks like an escalating pattern, is consistent with a bust-out scheme approaching its final stage.
Requests to maximize available credit quickly
A pattern of drawing down available financing as fast as possible, rather than at a pace consistent with genuine operating needs, is one of the more direct signals that a business may be approaching an intended default rather than continuing normal operations.
Why standard underwriting checks alone often miss it
The defining challenge of bust-out fraud is that, at any single point in time, the business's file can look genuinely strong — a real payment history, reasonable financials, passing verification checks. Standard underwriting, evaluated deal by deal without a longitudinal view, is not naturally positioned to catch a pattern that only becomes visible when trended over time and, ideally, across a network of lending relationships rather than a single funder's own history.
How bust-out differs from other MCA fraud patterns
It's worth distinguishing bust-out fraud from the other MCA fraud patterns covered in related guides, because they require different detection approaches. Stacking — taking multiple advances simultaneously — can happen opportunistically without any intent to ultimately default. Document fraud — altering bank statements or fabricating documents — is typically detectable through arithmetic verification and format analysis. Synthetic business identities rely on fabricated registration and identity information that cross-reference checks can surface.
Bust-out fraud is distinct because it relies on genuinely real business activity, a real payment history, and real documents — all of which check out correctly because they represent actual performance, just in service of a premeditated exit. This makes it the most patient and most relationship-dependent of the common MCA fraud patterns, and the one that most specifically requires a longitudinal rather than a point-in-time view to detect.
The portfolio-level perspective
Individual file review, however thorough, has structural limits for catching bust-out fraud because the pattern requires a view across time and relationships that any single deal evaluation doesn't have. This is why the most sophisticated lenders in this space supplement individual underwriting review with portfolio-level monitoring: tracking renewal velocity, observing behavioral changes in existing borrowers, and participating in industry data-sharing arrangements where available.
Portfolio monitoring doesn't replace thorough individual file review — it adds a different layer of visibility. A business that would pass individual deal review can still be flagged by portfolio-level patterns (rapid escalation across multiple advance cycles, behavioral shifts coinciding with large draw-downs) that only become visible when the relationship is viewed as a whole rather than as a sequence of independent transactions.
Building bust-out awareness into renewal and increase workflows
The most actionable place most lenders can add bust-out awareness is in their renewal and increase workflows, since these are precisely the moments where the pattern's escalation phase typically occurs. Some specific practices worth building into these reviews:
- Compare current financials directly against performance during the prior advance period, not against a generic baseline, to identify meaningful changes in deposit patterns or existing obligations.
- Flag any significant increase in requested amount relative to the prior advance size for explicit documentation of the rationale, rather than treating larger requests as automatically positive signals.
- Review the timing of the renewal request — a business requesting renewal very shortly after the final payment on a prior advance may be operating normally, but in combination with other signals, tight timing deserves explicit acknowledgment.
- Check for new recurring debits not present in the prior review period, since acquiring additional financing from other sources since the last advance is a meaningful change in the business's obligations profile.
What lenders can do about it
- Track escalation velocity, not just the current request's standalone merits — how quickly has requested or approved financing grown relative to the business's history.
- Weight recent financial activity changes against the business's operating narrative, rather than treating growth as automatically positive.
- Cross-reference application timing against other funders where industry data-sharing arrangements make this possible.
- Apply renewal-specific scrutiny — a business seeking a rapid renewal or increase shortly after a prior advance deserves the same rigor as a new application, not less.
From here, this article is about Cevrynt
How Cevrynt supports pattern-aware underwriting
Cevrynt's Fraud Signals module surfaces financial activity changes and recurring debit patterns as part of every review, giving underwriters the context to evaluate a renewal or increase request against the business's actual trajectory rather than reviewing it as an isolated transaction. This sits alongside verification and policy evaluation in one connected file.
As with all fraud-related findings, Cevrynt surfaces signals for a trained underwriter or fraud analyst to evaluate — it does not render a fraud determination on its own. A qualified walkthrough can show how this applies to your renewal and increase-request workflows specifically.