Loan & Predatory Lending Scams
5 postsPredatory lending, debt-relief, and LATAM lending fraud.
The Loan-Scam Ecosystem: Seven Genres and Seven Operator Archetypes
Over a year of telemetry, a loan-scam ecosystem grew more than fifteenfold, pushing well over a million lending and debt lures through email and SMS.
Loan-Brand Churn: A Dual-Rail Subprime-Credit Lead-Gen Operation
Since late January 2026, one operator has abused two email rails, Amazon SES and a SparkPost relay, to push subprime loan and credit-card lures at scale.
Sixty Brands, Hundreds of Domains: A Single Loan Lead-Gen Operator
Since late 2025, one operator has run a multi-vertical loan and lead-gen scam network from hundreds of rotating domains and dozens of disposable brand names.
Rotating Domains, One Nameserver Pair: A Loan Lead-Gen Operator
Since December 2025, one operator has run a loan-funding lead-generation scam behind hundreds of rotating domains, all anchored to one small, shared backend.
Twelve Brands, Two Backends: A Single-Operator Loan-Smishing Network
Since December 2025, one operator has run at least twelve fake lending brands over dozens of domains that all funnel to two shared backend redirectors.