Key Considerations to Manage Bust-Out Fraud and Check Kiting

While fraud teams and specialists work tirelessly to tackle ever-changing fraud cases, it’s important to note that customer management teams are also actively supporting the cause. There is particular focus on fraud cases related to deceptive payments made by supposed “trustworthy” customers. These cases are known by several different names, including bust-out fraud, check kiting fraud, or “ghost funding”.

Key Takeaways

• Bad debt often conceals fraud. In check kiting, a variation of bust-out fraud, fraudsters deposit bad checks after large purchases and withdraw from the provisional credit before the payments are declined for insufficient funds. This can cause the account balance to double the original line of credit. These losses are categorized as bad debt rather than fraud because the fraudulent intent is not flagged.
• Fraud losses from bust-out and check fraud carry significant financial weight. Bust-out (credit card) fraud and check fraud rank as the first and fourth leading fraud types by case volume across enterprise banking, mid-market banking and fintech, with account takeover and identity theft ranking second and third. 31% of financial institutions face total fraud losses exceeding $1 million. A major U.S. financial institution reportedly suffered from an "infinite money glitch."
• Payment hold strategy rests on two core levers. Within a payment hold strategy, the payment amount to hold and the duration to hold it are the two key levers that determine its effectiveness. Even a simple evaluation of the day differential between the payment date and the payment posted date can be useful in setting these thresholds.
• Segmentation improves outcomes over blanket policies. In a case study involving a mid-tier U.S. bank, two challenger strategies were built using the FICO Behavior Score, account tenure and trended attributes such as account delinquency and payment/NSF patterns. The conservative strategy was expected to avoid 25.8% of bad payment amounts while holding only 1.4% of total incoming payments. The more aggressive strategy was estimated to prevent 53.7% of bad payment amounts but at a higher hold rate of 6.1%. Both strategies included a 100% hold on the payment amount for up to 5 days.
• Risk appetite must be deliberately set and continuously tested. Establishing an appropriate risk appetite involves maintaining a tolerable fraud capture rate or false positive ratio without exceeding a certain hold rate of all payments made. Tracking strategy performance and maintaining a champion/challenger framework are best practices for continuously testing and improving strategies using new datapoints, segmentations, and thresholds for the levers.

What Is Bust-Out Fraud?

Bust-out fraud typically involves fraudsters establishing what appears to be normal usage and repayment patterns for a revolving line of credit, before maxing out the limit with no intention to repay.

What Is Check Kiting and How Does It Differ from Bust-Out Fraud?

A variation of bust out-out fraud, known as check kiting, involves fraudsters intentionally depositing bad checks after large purchases, and subsequently withdrawing from the provisional credit limit and/or making additional purchases before the payments are inevitably declined due to insufficient funds (NSF). In many instances, this allows for the account balance to double the original line of credit, and the losses are categorized as bad debt because they are not flagged as fraudulent.

What Is the True Financial Impact of Bust-Out Fraud on Financial Institutions?

A recent survey found that bust-out (credit card) and check fraud rank as the first and fourth leading fraud types experienced by financial organizations (by case volume; second and third are account takeover and identity theft, respectively), spanning across enterprise banking, mid-market banking, and fintech. In fact, 31% of financial institutions face total fraud losses exceeding $1M. A recent article published by The Financial Brand also reports that a major U.S. financial institution suffered from this “infinite money glitch”.

How Can We Effectively Manage and Mitigate Bust-Out Fraud?

Bust-out fraud and check kiting often look normal at first, then quickly shift into high-risk activity. Bust-out fraud involves building a credible repayment history before maxing out credit with no intent to repay. Check kiting uses uncollected or unsupported funds to create false liquidity. Because these schemes can resemble routine credit loss or bad debt, detection depends on monitoring payment source quality, NSF patterns, account age, and sudden spending spikes. Prevention relies on real-time controls, payment holds, and analytics that separate legitimate customers from deceptive activity.

Customer Management Technology

The capacity to host and execute automated, real-time payment hold strategies, commonly referred to as "payment float" strategies, represents a critical component of any comprehensive approach to addressing bust-out fraud. Such strategies enable financial institutions to temporarily restrict access to credit associated with payments that appear to be funded but have not yet been confirmed as cleared, thereby limiting the opportunity for fraudulent exploitation. This capability is of particular value when deployed in response to defined risk indicators, including a marked increase in credit utilization, recent non-sufficient funds (NSF) activity, higher-risk payment sources, or atypical account behavior. In order to minimize any unintended impact on legitimate customers, payment hold strategies should be applied on a risk-based basis and reinforced by analytics, account tenure, and continuous transaction monitoring, rather than through broad, undifferentiated restrictions.

Payment Data

Valuable data points are attached to every payment that is made. For instance, information on the payment source is critical in assessing the legitimacy and reliability of incoming funds. Guaranteed payment methods, such as cash deposits or certified checks, typically indicate genuine payment behavior and carry minimal fraud risk. Confirmed fraudulent payment transactions are equally important datapoints to collect and leverage to drive strategy and operational improvements.

Analytics-Driven Strategies

Within a payment hold strategy, two levers play an important role: the payment amount to hold and the duration to hold the payment. If an account is flagged with an at-risk payment, the appropriate action would be to withhold a percentage of the incoming payment and only restore the available credit after a few days have passed. Note that low-risk customers should not be unnecessarily impacted by broad risk controls.

The thresholds for the two levers should be determined using analytics. Even a simplistic evaluation of the day differential between the payment date and the payment posted date can be surprisingly useful. By looking at the distribution of this differential, it can provide a good proxy of the time it takes for payments to clear. If perhaps 80% of all payments clear by day 5, 90% by day 6 and 98% by day 7, then a seven-day hold action is appropriate.

It is also a best practice to track strategy performance, as well as have a champion/challenger framework in place to continuously test and learn with various strategy enhancements using new datapoints, segmentations, and/or thresholds for the levers.

Goal Setting: Balance Risk Treatment and Customer Experience

Establishing an appropriate risk appetite is key to delivering personalized customer experiences while balancing fraud prevention. For instance, maintaining a tolerable fraud capture rate or false positive ratio without exceeding a certain hold rate of all payments made.

Case Study: Challenger Payment Hold Strategies at a Mid-Tier U.S. Bank

Financial institutions using FICO's customer management technology, such as FICO® Platform, commonly place a hold on the entire payment amount for a period of five to seven days. In one instance, FICO advisors collaborated with a mid-tier U.S. bank to develop two data-driven challenger strategies leveraging the FICO® Behavior Score, account tenure, and trended attributes such as account delinquency and payment or NSF patterns.

• The Conservative Strategy: Minimal Customer Impact. This approach is expected to avoid 25.8% of bad payment amounts while holding only 1.4% of total incoming payments, with a 100% hold on the payment amount for up to five days.

• The Aggressive Strategy: Maximum Fraud Capture. This approach is estimated to prevent 53.7% of bad payment amounts, at a higher payment hold rate of 6.1%, also with a 100% hold on the payment amount for up to five days.

   

How FICO Enables Financial Institutions to Address Bust-Out Fraud

FICO® Platform enables organizations to strengthen and optimize their credit lifecycle strategies through the application of automation and advanced analytics, supporting more effective, data-driven approaches to payment hold management and fraud risk mitigation.

Learn how FICO can help your institution detect, manage, and prevent bust-out fraud and check kiting before losses compound.

• Every year, tens of billions of dollars in bust-out fraud losses are silently absorbed into banks' unsecured bad debt, with analysts estimating this fraud accounts for 10% to 15% of the total. Left unaddressed, these losses distort financial reporting and mask a growing threat. Discover how to distinguish genuine bust-out fraud from legitimate bad debt and safeguard the integrity of your credit risk reporting before losses continue to compound.
• Bust-out fraud rings exploit disconnected systems, hiding shared identities and linked accounts across channels. The FICO^® Enterprise Fraud Solution, Powered by FICO® Platform closes those gaps with a unified, continually learning view of risk across every interaction and channel. Reduce losses, cut false positives, and strengthen compliance, without compromising customer experience. Download the solution sheet to learn more.
• Bust-out fraud and check kiting often exploit fragmented data and delayed detection across payment channels. FICO^® Falcon® Fraud Manager addresses this with more than 30 years of fraud-fighting expertise and a network of over 10,000 global financial institutions. In a case study with PULSE, a Discover company, Falcon Fraud Manager delivered a 50% increase in account detection rate, a 40% increase in fraud dollars blocked, and a 25% reduction in false positives. 
• Managing bust-out fraud requires more than detection, it requires the ability to act on risk signals like payment holds and behavioral scoring. Discover FICO Platform Action Capabilities to operationalize analytics and machine learning into mission-critical decisions, calibrate risk strategies with precision and automate customer management across every channel.
• Check fraud is resurging, reinforced by sophisticated skimming and AI-generated forgeries that evade conventional detection. At the same time, the growing adoption of instant digital payments is reshaping the fraud landscape, with 91% of consumers having sent one and 87% having received one, according to FICO research. Download the white paper, Evolving Fraud Management Strategies in the Digital Era, to see how AI-driven detection can help close these gaps.

Note: This is an update of a post from 2025.