Risk indicators, not accusations. A V-Finder score says a loan shares measurable traits with PPP loans whose borrowers were publicly charged. It does not mean the borrower committed fraud. Most loans with high scores are legitimate. Use scores to prioritize review, never as evidence by themselves.
Each loan gets two numbers, shown as “top X% of PPP loans” (its rank among all 11,468,210 loans in the SBA file):
Weights come from a logistic regression fitted on the tuning half of the benchmark against a random sample of 300,000 PPP loans. Signals whose weight came out negative were removed so every signal only adds risk and can be explained in a sentence.
Benchmark: 124 loans from 99 DOJ/USAO press releases on charged, pleaded or convicted PPP borrowers. 59 loans tuned the weights; 65 held-out loans (different press releases) were used only for testing. “Flag rate” is the share of all PPP loans at or above the threshold (the false-positive budget). “Lift” = recall ÷ flag rate.
| Target | Flag rate (all loans) | Held-out recall | Tuning recall | Lift |
|---|---|---|---|---|
| 1% | 0.9% | 33.8% | 44.1% | 37× |
| 2% | 2.0% | 49.2% | 59.3% | 25× |
| 5% | 4.0% | 53.8% | 66.1% | 13× |
| 10% | 5.4% | 58.5% | 69.5% | 11× |
| Target | Flag rate | Held-out recall | Tuning recall | Lift |
|---|---|---|---|---|
| 1% | 0.9% | 69.2% | 78.0% | 78× |
| 2% | 1.7% | 72.3% | 81.4% | 43× |
| 5% | 4.4% | 81.5% | 88.1% | 19× |
| 10% | 9.0% | 87.7% | 93.2% | 10× |
Because charged cases skew to large loans, we also measured a model with no size terms (on a 100,000-loan sample):
| Target | Flag rate | Held-out recall |
|---|---|---|
| 1% | 1.0% | 15.4% |
| 2% | 2.0% | 18.5% |
| 5% | 4.2% | 27.7% |
| 10% | 9.0% | 40.0% |
Scores take a limited number of distinct values, so actual flag rates differ slightly from the 1/2/5/10% targets. Precision cannot be measured directly: the true fraud rate among unflagged loans is unknown (SBA OIG estimates about $64 billion of PPP funds were potentially fraudulent).
Original 9 cases, re-verified Oct 26 2026 against the DOJ releases (chosen before tuning, so not a held-out test). Caruso is a civil False Claims Act settlement, not a criminal charge. It is now counted separately (its loans rank in the top 2%). Among the 8 criminal cases: top 1% = 4/8 (VanPelt, Williams, Billingslea, Boles), top 2% = 5/8 (+Tabrizi), top 5% = 6/8 (+Hamed). Bath and Arena were missed.
Loan matches:
We grew the benchmark to 239 loans from 178 DOJ/USAO releases (9,575 releases searched; 2,401 mention PPP). We added smaller cases on purpose: 123 loans are under $150,000, and 20 are under $20,000. Sole-proprietor borrowers were matched by the defendant’s full name, the state and the exact loan amount. We also fixed a file-encoding problem that had dropped 0.9% of SBA rows, so the population is now 11,468,210 loans. The current weights were not changed. The scores below are for the v27 model on the 125 held-out loans (releases split by hash, never used for tuning). 95% Wilson intervals are in brackets.
| Score | Top 0.9% | Top 2% | Top 4% |
|---|---|---|---|
| Application score, all held-out | 21% (15–29%) 26/125 · flags 0.9% · lift 23.2× | 33% (25–41%) 41/125 · flags 2.0% · lift 16.4× | 38% (30–46%) 47/125 · flags 4.0% · lift 9.4× |
| Application score, held-out loans < $150k | 0% (0–5%) 0/69 · flags 0.9% · lift 0.0× | 1% (0–8%) 1/69 · flags 2.0% · lift 0.7× | 6% (2–14%) 4/69 · flags 4.0% · lift 1.5× |
| Audit score, all held-out | 44% (36–53%) 55/125 · flags 0.9% · lift 49.1× | 47% (39–56%) 59/125 · flags 1.7% · lift 27.8× | 53% (44–61%) 66/125 · flags 3.8% · lift 13.8× |
| Audit score, held-out < $150k | 12% (6–21%) 8/69 · flags 0.9% · lift 12.9× | 17% (10–28%) 12/69 · flags 1.7% · lift 10.3× | 28% (18–39%) 19/69 · flags 3.8% · lift 7.2× |
| Refit without loan size | 5% (2–10%) 6/125 · flags 0.9% · lift 5.6× | 11% (7–18%) 14/125 · flags 2.0% · lift 5.7× | 19% (13–27%) 24/125 · flags 4.0% · lift 4.9× |
What this means. With more small cases in the test set, held-out recall fell compared with the first test (34/49/54% → 21/33/38%). The application score finds charged loans that are large, over the cap or fintech-channel. It does almost nothing for loans under $150k: 0 of 69 at the top 0.9%. Most small-loan fraud in the releases ($20,833 sole-proprietor loans, made-up Schedule C income) looks normal in the public application fields. The audit score, which adds “not forgiven”, does better on small loans (12–28%). A refit on the larger tuning set did not improve held-out results beyond the error bars, so the live model stays as it is. False-positive budget: at each threshold, about 99.9% of flagged loans are not in any charged case we know of. A flag is a lead to review, not evidence of fraud.
Of the 239 charged loans, 151 are not in the top 2%. 84 of them are held-out and 121 are under $150k. We read each DOJ/USAO release and put every miss into one main category, using the most specific scheme the release describes. Each row says whether public SBA data can show that kind of fraud. Full list: /api/ppp/cases?flagged=no.
| Main scheme in the release | Missed / charged | Under $150k | Visible in public data? | What would fix it |
|---|---|---|---|---|
| Fake Schedule C sole proprietor (invented self-employment income) | 60 / 65 | 58 | No. The $20,833 / 1-job / 2021 pattern matches millions of honest loans. | IRS Schedule C filings or state income data (not public). We tested a separate small-loan ranking: 36% of held-out small charged loans fall in its top 10% (95% CI 26–48%), only 3.6× random. Not shipped. |
| Inflated payroll or employees at a real business | 28 / 61 | 18 | Partly. Per-job cap and sector norm catch the extreme cases. | IRS 941 or state wage records (not public). |
| Fake or shell business | 21 / 41 | 17 | Partly. Business age is self-reported. State registries cover only CO, NY, CT, OR and TX, and only 7 charged loans fall there. | Free bulk registry data for FL, GA and MO (not available to us). |
| Ring / recruiter / kickback member | 13 / 28 | 4 | Partly. Shared addresses and same lender/day/ZIP bursts showed no lift. Same amount in the same ZIP showed 2.7× on tuning loans but added nothing on held-out loans. | Shared phones, emails, bank accounts, IP addresses (not public). |
| Stolen or synthetic identities | 11 / 17 | 9 | No. The application looks normal. | SSA and identity verification data (not public). |
| Unclear from the release | 6 / 6 | 5 | n/a | n/a |
| Also EIDL / other relief | 4 / 9 | 3 | No. EIDL loan data has no borrower names. | Not public. |
| Fake tax or payroll documents | 4 / 8 | 3 | No. | IRS records. |
| Lender, insider or tax preparer | 4 / 4 | 4 | No. | Lender-side data. |
Other facts about the misses: 52% went through a fintech-channel lender (vs 65% of caught loans). 96 of the 151 were approved in 2021. 41 have no warning sign except the lender channel or “not forgiven”. Releases often describe several schemes, so these categories overlap and are approximate (keyword-based reading of each release). Per-loan list: vf_missed_gap_analysis.csv in the repo. Which non-public data would close each gap, and who holds it: Gap Closer.
To catch made-up businesses, we joined free state open-data registries to PPP entity borrowers (corporations, LLCs, partnerships) by exact name (Inc/LLC ignored) and state:
That covers 1,185,282 PPP entity loans, and 71% matched (CO 66%, CT 82%, NY 77%, OR 63%, TX 68%). Among matched loans, 1.6% were first registered after Feb 15, 2020, and 0.14% within 90 days before the loan.
Why it is not scored: only 7 benchmark loans fall in these states and business types (4 tuning, 3 held-out). None of the 7 had a registration after the cutoff, so the signal cannot be tested. Our charged cases are mostly in MO, FL, GA and WV, and most small ones are sole proprietors, who don’t register with the state.
Sources we couldn’t use:
Loan detail now shows these registry facts as context: when the business was registered, “registered after Feb 15, 2020”, “now inactive” and “no exact-name match”. None of them changes the score. Current status can reflect events after the loan.
Under $150k, held-out recall was near zero, so we built more public-data signals and tested them. Each was fitted only on the 54 small tuning loans and tested on the 69 small held-out loans. Lift is the tuning-set rate divided by the rate among all loans under $150k:
A separate small-loan model ranked within loans under $150k catches 1/69 (1%), 2/69 (3%) and 6/69 (9%) of held-out small loans at the top 0.9/2/4% of small loans. The 95% upper bounds are 8–18%, which is a lift of about 2× and within the error bars of v27. A size-stratified ranking (each size band flagged at the same rate) gave up big-loan recall without a significant small-loan gain. Adding the new signals to the full model gave held-out recall of 26/32/34%, vs v27’s 21/33/38%. Nothing passed the bar for a change, so the score is still v27.
Small charged cases mostly use a sole-proprietor template: a $20,833 maximum loan, invented Schedule C income, and a fintech lender in 2021. Millions of honest loans look exactly the same in public data. What actually caught these cases (bank records, IRS mismatches, SBA cross-program data, shared phones, emails, bank accounts and IP addresses) is not public. Loan detail now shows the $20,833 maximum, the 2021 Schedule C rule and “charged off” as context notes with plain-English explanations. They are not scored. A residential-address check was not possible because the SBA addresses are normalized and carry no unit markers.
| Signal | Weight (application) | Weight (audit) | All loans | Charged loans | Lift |
|---|---|---|---|---|---|
| Above the per-job payroll cap Loan ÷ jobs > $20,833 ($29,167 for NAICS 72), the most PPP's $100k-per-worker pay limit allows. | +1.65 | +1.92 | 2.2% | 15.3% | 6.8× |
| Far above the sector norm $ per job ≥ 3× the average for the same 3-digit NAICS sector in the same state. | +1.35 | 0.7% | 5.6% | 7.6× | |
| New business Borrower said “New Business or 2 years or less” / startup. | +2.31 | +1.31 | 6.1% | 26.6% | 4.4× |
| Business age left blank Business-age field unanswered. | +0.76 | +1.14 | 4.7% | 13.7% | 2.9× |
| Round amount Amount ≥ $10,000 and an exact multiple of $1,000 (formula amounts rarely are). | +0.86 | +1.38 | 5.2% | 20.2% | 3.9× |
| Shares an address ≥ 2 differently named borrowers at the same street address + ZIP. | +0.21 | +0.47 | 22.4% | 29.0% | 1.3× |
| Address cluster ≥ 5 differently named borrowers at the same street address + ZIP (ring signal). | +1.37 | 2.7% | 4.0% | 1.5× | |
| Fintech-channel lender Lender named by POGO (2020) or the House Select Subcommittee (2022) as linked to many fraudulent loans: Kabbage, Cross River, Celtic, Fundbox, ReadyCap, Radius, Customers Bank, Capital Plus, Harvest, Benworth, Prestamos, Fountainhead. Channel risk only. | +1.87 | +0.77 | 25.9% | 47.6% | 1.8× |
| Loan ≥ $150,000 Size/priority factor. Charged cases skew large, partly because prosecutors prioritize large losses. | +2.98 | +2.35 | 8.5% | 70.2% | 8.3× |
| Not forgiven (audit score only) No forgiveness amount recorded. An after-the-fact outcome, so it is excluded from the application score. | +3.79 | 7.7% | 83.9% | 10.9× |
A loan under $20,000 gets a large negative weight: almost no charged loans in the benchmark were that small (press releases rarely name small loans). SAM.gov exclusion and OFAC name matches are shown for review but not scored, because no benchmark case had one.
We read the 99 benchmark press releases (and all 1753 PPP-related DOJ releases for comparison) for what the government says the scheme involved and how it was proven. Releases rarely state the initial trigger, so these are evidence types, found by keyword patterns and not hand-coded.
| What the case involved | Benchmark releases | All PPP releases | How investigators see it | Can V-Finder see it from public data? |
|---|---|---|---|---|
| Luxury or personal spending traced | 46/99 (46%) | 36% | Bank records (subpoena) | Not in public data. |
| Money laundering / funds moved to others | 36/99 (36%) | 32% | Bank records, SARs | Not in public data. |
| Ring / recruiter / kickback network | 32/99 (32%) | 26% | Co-conspirator cooperation, shared identifiers | Partly: shared address + ZIP clusters (a2/a5) and related-loan links (same address, same name, same lender/county/day). Shared phones, emails, bank accounts, IPs are not public. |
| Also defrauded EIDL / other relief | 29/99 (29%) | 36% | SBA/OIG cross-program data | Not public at the loan level (EIDL loan data lacks borrower names for most loans). |
| Inflated employees or payroll | 28/99 (28%) | 15% | IRS/state wage records vs. application | Partly: per-job cap and sector-norm signals (over_cap, nr3). |
| Fake or altered payroll/tax documents (e.g. Form 941, W-2, 1099) | 25/99 (25%) | 25% | IRS records, document forensics | Not public. Indirectly: round amounts and cap-level amounts. |
| Shell, defunct or newly formed business | 11/99 (11%) | 14% | Secretary of State records | Partly: new-business and blank-age signals; state registration dates are not yet joined. |
| Bank / lender flagged it (SAR, fraud review, refused) | 8/99 (8%) | 3% | Lender fraud review, SARs | Not public. Lender channel risk is used (fintech). |
| Stolen or misused identities (incl. deceased) | 7/99 (7%) | 10% | SSA death records, identity data | Not public. |
| Multiple applications or lenders | 2/99 (2%) | 6% | SBA E-Tran duplicates | Partly: same-name related loans across states and lenders. |
| IRS / tax-record mismatch (no filings or wages paid) | 2/99 (2%) | 1% | IRS | Not public. |
| Data analytics / PRAC / OIG data match | 1/99 (1%) | 4% | PRAC PACE, SBA OIG link analysis | Not public (uses TINs, bank accounts, IPs). |
| Tip, whistleblower or qui tam | 1/99 (1%) | 10% | Hotline, relators | Not public. |
Investigating agencies named in benchmark releases: FBI 69, SBA OIG 38, IRS-CI 29, TIGTA 25, Secret Service 12, FDIC OIG 9, HSI 6, FHFA/Fed OIG 3, USPIS 2.
Oversight findings: SBA OIG Report 23-09 (June 2023) found most potential fraud through link analysis of shared identifiers (tax IDs, phone numbers, bank accounts, emails, addresses, IP addresses) plus hotline complaints and investigative casework. Of those identifiers, only the address is in the public file, which is why V-Finder's ring signal is address-based. The House Select Subcommittee (Dec 2022) and POGO (Oct 2020) documented disproportionate fraud through fintech lending channels. Griffin, Kruger and Mahajan (Journal of Finance, 2023) used similar public-data indicators: implausible pay per employee, multiple businesses at one residential address, unregistered businesses.
We also tested “same lender, same ZIP, same approval day” clusters, “same name at 3+ loans or in 2+ states”, mailbox-style addresses, $20,833 sole-proprietor maximum and “at the per-job cap”. Each came out with a zero or negative weight on the tuning set, so they are not scored. The address-cluster signal is the ring signal that held up.
Report an error or request a correction: email python0o@mail.grokbot.com. Please include the loan number or page link and what is wrong. We check each report against the public source and correct or remove the item if it is wrong. Built by Pat Callahan, Nashua, NH (@python0o).
Model built Oct 25, 2026. Weights and statistics: /api/ppp/model.