2025 Annual Credit Fraud Risk Report

Original report text

This text version is reconstructed based on the 36-page original PDF, retaining the report narrative, chapters and research scope; the cover, duplicate table of contents and purely decorative pages are not repeated. Localized figures are placed in context throughout this web edition, with the original PDF retained for reference.

About Threat Hunter

Threat Hunter was founded in 2017 and helps organizations identify and respond to business fraud, external digital risk, and API security threats. Its work combines cybercrime intelligence, risk data, product platforms, and specialist services.

The company provides mature and diverse products and services focusing on risk scenarios such as business fraud, data leakage, phishing and counterfeiting, and API attacks that different industries face in the process of digital development. It has been selected as a representative vendor in Gartner's technology maturity curve report and IDC's threat intelligence field for many times.

Headquartered in Shenzhen, Threat Hunter also operates offices in Beijing, Shanghai, and Chongqing, with Digital Risk Response Centers in Shenzhen and Chongqing. The company supports customers in China, Europe, the United States, South America, and Southeast Asia.

Original report charts, flow and case charts (original report, page 2) — Original report charts, processes and casesSource: Threat Hunter original report, page 2

Preface

In 2025, the financial lending field will struggle to move forward amid continued shocks. Fraud and chaos are spreading, and threat actors’ tactics are accelerating. What financial institutions are facing is no longer scattered attacks, but a complete set of professional, industrialized, and finely divided black industry chains. This batch and systematic offensive has triggered many large-scale risk cases and aroused high alertness from regulatory authorities, financial institutions and public security organs.

Threat Hunter research and analysis shows that the discussion volume related to malicious fraud risks and professional debt risks in the financial loan field in 2025 will surge by 200% and 168% respectively compared with the same period in 2024, indicating a significant risk proliferation trend. Judging from the performance of specific fraud scenarios, public opinion on fraud in the fields of corporate loans and consumer loans will both increase by more than 20% in the second half of the year in 2025. The risk exposures of these two types of businesses continue to expand, and the overall risk is relatively high.

It is worth noting that since the second half of 2025, the Ministry of Public Security and the State Administration of Financial Supervision have launched a heavy attack, successively cracking down on more than 200 major threat actor gangs, and have opened and investigated more than 1,500 cybercrime ecosystem criminal cases, with a total amount of nearly 30 billion yuan involved. At the same time, financial institutions continue to upgrade their anti-fraud defense systems under the dual pressures of regulatory compliance and exposure to non-performing assets. Under the increasingly tight fraud controls lines and increasing legal deterrence, the cost of illegal crimes and the difficulty of committing crimes in cybercriminal groups have increased significantly.

However, driven by huge illegal profits, there are still a large number of threat actor groups taking desperate risks, constantly innovating attack techniques and changing fraud methods. This offensive and defensive confrontation is far from over. The prevention and control pressure faced by financial institutions is still severe, and the anti-fraud work has a long way to go.

Credit Fraud Risk Overview 2025

1. Overview of Credit Fraud Risks in 2025

Threat Hunter observed that due to the special governance of Tencent WeChat platform in August 2025 in response to the "Operation Qinglang", focusing on cybercrime ecosystem and illegal groups to implement relevant fraud controls policies, and since the second half of 2025, the Ministry of Public Security and the State Administration of Financial Supervision have jointly deployed financial cybercrime ecosystem crackdowns, the discussion volume on financial loans in the second half of 2025 is higher than that in 2025 There was a decrease in the first half of the year, but the overall public opinion on the risk of malicious loan fraud still increased.

1.1 Public opinion on malicious financial fraud increased by 200% in 2025 compared with 2024

Overview of credit fraud risk in 2025 (Chart 1)Source: Threat Hunter original report, page 6

I. Overview of credit fraud risk for 2025 2 (page 6 of the original report) — Overview of credit fraud risk in 2025 (figure 2)Source: Threat Hunter original report, page 6

In 2025, Threat Hunter monitored and captured 6.8 million financial loan public opinions. Financial loan public opinions increased by 64% compared with 2024. Among them, malicious loan fraud public opinions accounted for 1.89 million, accounting for 28% of the total. Malicious loan fraud public opinions increased by 200% compared with 2024.

Financial loan public opinion: refers to all public opinions related to financial loan scenarios (including but not limited to fraud risks)

Malicious loan fraud public opinion: refers to the public opinion on fraud risks related to financial loan scenarios; such as debt taking, car financing, technology quota increase, beauty loan fraud, debt restructuring, AB loan, creating fake statements, credit repair, debt optimization and other public opinions.

In 2025, Threat Hunter monitored and captured a total of 37,000 financial loan groups, of which 18,000 were malicious loan groups, accounting for 50% of the total, an increase of 22% from 2024.

In 2025, Threat Hunter monitored and captured 330,000 active loan service accounts, of which 100,000 were fraudulent accounts (credit black intermediaries/threat actors) providing malicious loan services, accounting for 30% of the total, an increase of 135% from 2024.

Figure 1 (page 7 of the original report) — Financial malicious fraud increased by 200 per cent in 2025 over 2024 (figure 1)Source: Threat Hunter original report, page 7

Figure 2 (page 7 of the original report) — Financial malicious fraud increased by 200 per cent in 2025 compared to 2024 (figure 2)Source: Threat Hunter original report, page 7

Active loan servicing accounts: all active accounts related to loans

1.2 Popularity of malicious loan fraud business types in 2025 top 3: corporate loans, credit loans, housing loans

Malicious loan fraud refers to financial fraud that involves falsely advertising loan business in the name of a bank, packaging fraudulent loans, illegal loan increases, illegal re-loans, illegal cash-outs, induced loans, charging customers high fees, running away with money, defrauding customers for profit, issuing usury loans and other illegal businesses for personal gain.

Top3: Business Loans, Credits, Mortgage Chart 1 (page 8 of the original report) — Top3: Business Loans, Credits, Mortgages (Chart 1)Source: Threat Hunter original report, page 8

top 3: Business Loans, Credits, Mortgage Charts, 2025 (page 8 of the original report) — Top3: Business Loans, Credits, Loans (Chart 2)Source: Threat Hunter original report, page 8

Common fraudulent behaviors include debt taking, car financing for cash out, technology loan increase, beauty loan fraud, debt restructuring, AB loan, machine rental for cash out, making fake statements, credit report repair, debt optimization, etc.

In addition to corporate loans, credit loans, and housing loans, provident fund loans and car loans also have higher risk profiles, accounting for 11.94% and 11.94% respectively.

11.59%.

1.3 Main types of malicious loan fraud in 2025 top 3: professional debt, debt optimization, credit repair

Figure 1 Figure on major fraud types in malicious loans (page 9 of the original report) — Major fraud types of malicious loans (Chart 1)Source: Threat Hunter original report, page 9

Diagram of major fraud types in malicious loans (page 9 of the original report) — Major types of fraud in malicious loans (Chart 2)Source: Threat Hunter original report, page 9

Data in 2025 shows that malicious loans mainly involve more than 9 types of fraud such as professional debt, debt optimization, credit repair, material fraud, car financing fraud, debt restructuring, etc. Among them, professional debt risk accounts for as high as 37%, ranking first, and is the core attack method of threat actors;

Debt optimization and credit repair ranked second and third respectively, and the proportion of debt optimization agency complaint business has doubled.

Debt optimization: usually refers to the process of adjusting and optimizing the debtor's debt structure, repayment methods, interest costs, etc. through agency complaints, agency rights protection, etc., in order to reduce the debtor's repayment pressure and improve the financial situation. Debt optimization is related to debt evasion, which mainly involves the implementation of installment repayments, deferred installments, reductions and exemptions, etc. through threat actors' agency complaints, etc., so as to achieve the purpose of delaying and reducing debt repayments.

Note: Debt optimization includes: anti-collection, agency rights protection, agency complaints, interest refunds and other debt processing scenarios.

The main type of malicious loan fraud in 2025: Top3: professional debt default, debt optimization, correspondence repair chart 1 (page 10 of the original report) — The main type of malicious loan fraud in 2025: Top3: professional debt default, debt optimization, credit-record repair (Chart 1)Source: Threat Hunter original report, page 10

The main type of malicious loan fraud in 2025: top 3: professional debt default, debt optimization, correspondence repair chart (page 10 of the original report) — The main type of malicious loan fraud in 2025: Top3: professional debt default, debt optimization, credit-record repair (figure 2)Source: Threat Hunter original report, page 10

Counter-collection: Counter-collection is created by the debtor in order to respond to the collection of overdue loans and obtain interest exemptions, deferment/installment repayment, and elimination of overdue records.

The demand has arisen, and this has given rise to the group of anti-collection intermediaries. They use the purpose of illegal profit-making to induce or help financial consumers to avoid illegal activities of debt repayment obligations. They usually disguise themselves as "agency rights protection", "agency complaint" and other services, and interfere with the normal collection process of financial institutions through fictitious facts, forged materials, malicious complaints and other means.

Debt restructuring: refers to the behavior of black intermediaries advancing funds for individuals or companies that are temporarily unable to repay, pay off historical debts, and maintain credit reports, and then apply for multiple large loans, allowing those who have no ability to repay to borrow larger amounts from banks in disguise.

1.4 Top 5 malicious loan fraud risk areas in 2025: Guangdong, Sichuan, Shandong, Jiangsu, Zhejiang

Threat Hunter intelligence data shows that the top five provinces (including municipalities) with active malicious loan fraud in 2025 are Guangdong, Sichuan, Shandong, Jiangsu, and Zhejiang. Among them, the risk value in Guangdong is much higher than other regions.

In 2025, there was a sharp surge in communications recovery risks, with the second half of 2025 increasing by 199 per cent over the second half of 2024 (page 11 of the original report) — In 2025, there was a sharp surge in communications recovery risks, with the second half of 2025 increasing by 199 per cent from the second half of 2024Source: Threat Hunter original report, page 11

1.5 Credit repair risks will surge sharply in 2025, with a year-on-year increase of 199% in the second half of 2025 compared with the second half of 2024

The discussion volume on credit repair risks will continue to grow in 2025. The amount of public opinions on credit repair risks in the first half of 2025 increased by 116% compared with the second half of 2024. The amount of public opinions on credit repair risks in the second half of 2025 increased by 38% compared with the first half of 2025. The amount of public opinions on credit repair risks in the second half of 2025 increased by 199% compared with the second half of 2024.

In 2025, there was a sharp surge in communications recovery risk, with the second half of 2025 increasing by 199 per cent over the second half of 2024 (page 12 of the original report) — In 2025, there was a sharp surge in communications recovery risks, with the second half of 2025 increasing by 199 per cent from the second half of 2024Source: Threat Hunter original report, page 12

Among them, in December, affected by the national credit repair policy, the discussion volume in December was the peak of the whole year, an increase of 40% compared with November.

In 2025, there was a sharp surge in communications recovery risk, with 199 per cent increase in the second half of 2025 compared to the second half of 2024 (page 13 of the original report) — In 2025, there was a sharp surge in communications recovery risk, with a 199 per cent increase in the second half of 2025 compared to the second half of 2024 (figure 1)Source: Threat Hunter original report, page 13

On December 22, 2025, the People's Bank of China issued a special policy notice on personal credit repair. The policy is clear that starting from January 1, 2026, a one-time credit repair mechanism will be implemented for eligible historical personal overdue records of small amounts.

Since the introduction of the national credit repair policy, as of mid-January 2026, the implementation of the policy has attracted great attention from customers, financial intermediaries, threat actors, financial institutions and other relevant parties. However, there are significant differences in their focus and demands. The specific manifestations are as follows:

Credit fraud industry chain and risk types in loan scenarios

2. Credit fraud industry chain and risk types in loan scenarios

2.1 Analysis of credit fraud industry chain

Role of the credit fraud industry chain and lending process Figure — Fake material production, resource services, insiders of financial institutions and multiple intermediaries work together to complete customer recruitment and loan implementation.Source: Threat Hunter original report, page 13

The current credit fraud industry chain has formed a refined, specialized, large-scale division of labor system. Fraudulent roles are mainly divided into three role layers: upstream threat actors, midstream threat actors, and downstream intermediaries. Each role layer has a different division of labor.

Upstream threat actors: Responsible for researching the products of financial institutions or finding loopholes, having relationships and financial resources such as industry, resource service providers, fake material companies, etc., providing loan solutions, and final loan operators;

Midstream threat actors: Responsible for connecting upstream and downstream, recruiting, and assisting upstream in committing credit fraud;

Downstream intermediary: Responsible for receiving midstream information and directly recruiting target customers.

The following is a flow chart of the credit fraud industry chain:

2.2 Types of fraud risks in each loan scenario

In the field of financial credit, housing loans, car loans, consumer loans and corporate loans are all attacked by threat actors to varying degrees, and present different types of fraud risks.

In the mortgage loan scenario, threat actors often defraud large amounts of funds by inflating property valuations, taking advantage of policy loopholes to make arbitrage, packaging themselves as "debtors" or colluding with developers to make fake mortgages;

Due to the rapid approval and high degree of online approval of consumer loans, threat actors often use technical means to forge identities in batches, package application materials to commit loan fraud, artificially beautify credit reports, implement debt restructuring, or engage in "AB loan" fraud;

Chart of fraud risk types in each loan landscape (page 16 of the original report) — Type of fraud risk in each loan scenarioSource: Threat Hunter original report, page 16

For corporate loans, due to the large loan amounts, threat actors' attacks are more specialized. They often purchase shell companies, forge trade flows and collateral, and even manipulate supply chain finance to commit professional debt fraud, or modify data to commit material packaging fraud such as technology quota increases.

As for car loans, because vehicles are easy to transfer and liquidate, fraud often manifests itself in forging materials, car financing and cashing out, "buying cars under the same name", etc. After the loan is granted, the GPS is illegally removed and the vehicle is resold to avoid debt.

The following are the mainstream fraud methods currently faced in various loan scenarios:

The following will conduct a targeted dismantling and analysis of the core fraud risks in different credit loan scenarios based on the real risk intelligence that Threat Hunter has monitored over a long period of time.

Analysis of professional debt risk landscape

3. Analysis of professional debt risk landscape

III. Figure 1 for the analysis of occupational exposure risk (page 18 of the original report) — III. Analysis of occupational risk exposure (figure 1)Source: Threat Hunter original report, page 18

III. Flow analysis of occupational debt risk 2 (page 18 of the original report) — III. Analysis of occupational risk exposure (figure 2)Source: Threat Hunter original report, page 18

Professional indebtedness: refers to people who have absolutely no loan qualifications (such as pure white, novice, small flower, low education level) or low qualifications and willingness to take on debt, who apply for large bank loans under the package of threat actors. Professional debt-taking is for the purpose of high profits and has no intention of repaying the debt. Professional debts are mainly divided into 2 categories: one is "packaged loans" and the other is "bad debts". Packaged loans: the act of defrauding banks of high loans by fabricating identities and forged materials, such as "house", "credit", "business", "car". Bad loans: bad debts or non-performing assets under the name of a company affect the company's operation or reputation. The company uses equity transfer, asset disposal, mortgage, etc., and the debtor bears the company's debt alone, such as "Enterprise direct debt" and "bank direct debt" professional debt risks refer to the credit risks related to professional debt behavior. This risk is not only the highest risk type of fraud in the credit fraud industry chain, but also a core risk that financial institutions focus on and strictly prevent and control.

3.1 The discussion volume on occupational debt risks in 2025 increased by 168% compared with 2024

In 2025, Threat Hunter monitored and captured 370,000 public opinions on occupational debt risks. Among them, the amount of public opinions in the second half of the year increased by 59% compared with the first half of the year, and the overall amount of public opinions increased by 168% compared with the same period in 2024;

3.2 Top 5 provinces with debt-ridden areas in 2025: Guangdong, Sichuan, Shandong, Henan, Chongqing

Threat Hunter intelligence data shows that the top five most active provinces (including municipalities) for debt-related loan fraud in 2025 are Guangdong, Sichuan, Shandong, Henan, and Chongqing.

3.3 Popularity of debt-ridden cities in 2025 Top 5 cities: Chongqing, Guangzhou, Chengdu, Shanghai, Shenzhen

Threat Hunter intelligence data shows that the top five most active cities (including municipalities) for debt-related loan fraud in 2025 are Chongqing, Guangzhou, Chengdu, Shanghai, and Shenzhen.

Top5 Cities: Chongqing, Guangzhou, Chengdu, Shanghai, Shenzhen Chart (page 19 of the original report) — Top5 Cities: Chongqing, Guangzhou, Chengdu, Shanghai, ShenzhenSource: Threat Hunter original report, page 19

3.4 2025 New model of professional debt-assumption threat actors: from scattered fraud to professional industrialization

In 2025, in order to increase the loan approval rate and obtain higher amounts, these groups of threat actors have long stopped working alone. They not only actively join forces with other related groups to commit crimes, but also quickly implement safety isolation after the loan is obtained to avoid being implicated in subsequent explosions.

Different groups have their own resources. Some are good at consumer loans, some are good at housing loan operations, some are good at incubating and packaging long-term corporate loans, and some can open up channels of financial institutions. Together, they can complement each other's shortcomings, activate resources, and ultimately divide the benefits, forming a chain of interlocking interests.

2025 New patterns of occupational debt blackouts: from scattered fraud to professional industrialization (page 20 of the original report) — 2025 New patterns of hard-on-job black-out: from scattered fraud to professional industrializationSource: Threat Hunter original report, page 20

Its core features are concentrated in three aspects:

Upgrade of operating model: From a single fraudulent loan point to a diversified arbitrage system that integrates multi-channel resources, the attack direction and operating methods will be dynamically adjusted according to the level of risk, profit margin and supervision intensity.

Customer portrait optimization: Instead of focusing on “pure white households” with blank credit records, we will instead recruit “high-quality novices” with a small number of good credit records.

Loan applications from this group of people are more likely to be approved, which can further increase the success rate.

2025 New patterns of occupational debt blackouts: from scattered fraud to professional industrialization (page 21 of the original report) — 2025 New patterns of hard-on-job black-out: from scattered fraud to professional industrializationSource: Threat Hunter original report, page 21

Refined operation of scenarios: No longer blindly attack all loan scenarios, but based on the characteristics of different loan products, accurately calculate operating costs, cycles and returns, and achieve risk minimization and profit maximization through refined configuration.

The following is a comparison of the characteristics of various risk scenarios in the debt-taking process.

Credit fraud loan scenario risk analysis

4. Risk analysis of credit fraud loan scenarios

4.1 Analysis of current situation of mortgage fraud risks

Top5 provinces (including municipalities) in 2025: Chongqing, Sichuan, Guangdong, Shandong, Henan Chart 1 (page 23 of the original report) — Top5 provinces (including municipalities) in 2025: Chongqing, Sichuan, Guangdong, Shandong, Henan (Chart 1)Source: Threat Hunter original report, page 23

Top5 provinces (including municipalities) for loan fraud in 2025: Chongqing, Sichuan, Guangdong, Shandong, Henan (page 23 of the original report) — Top5 provinces (including municipalities) in 2025: Chongqing, Sichuan, Guangdong, Shandong, Henan (Chart 2)Source: Threat Hunter original report, page 23

4.1.1 Public opinion on mortgage fraud risks remained stable in 2025

4.1.2 Top 5 provinces (including municipalities) with regional popularity of mortgage fraud in 2025: Chongqing, Sichuan, Guangdong, Shandong, Henan

4.1.3 Top 5 cities with regional popularity of mortgage fraud in 2025: Chongqing, Guangzhou, Chengdu, Shenzhen, Guiyang

4.1.4 Upgrading of the housing loan threat-actor industry chain: from division of labor and collaboration to full-chain closed-loop fraud led by the “housing side”

Upgrading of the mortgage cybercrime chain: from division of labour collaboration to a chain-wide closed-ring fraud diagram dominated by the “home source” (page 24 of the original report) — Upgrading of the mortgage and cybercrime chain: from division of labour collaboration to chain-wide closed fraud dominated by the “home source”Source: Threat Hunter original report, page 24

With the high risk in the second-hand housing market, the industrial chain model is further evolving: Threat Hunter observed that this year there has been a new trend of being led by “threat actors” and integrating the entire process.

This fraud network covers many key links such as house collection, early advance financing, bank relationship smoothing, material forgery, loan operations, customer recruitment, etc. The gang started from collecting houses from the source and built a fully closed-loop crime process of "recruiting customers - packaging qualifications - operating loans - dividing stolen money - controlling the repayment fraud-control review period", and even extended to lead the subsequent decoration loan business.

This type of mortgage fraud is mainly based on mortgage loans, supplemented by operating mortgage loans. The specific risk conditions are as follows:

4.2 Analysis of current situation of corporate loan fraud risks

4.2.1 Public opinion on corporate loan fraud will continue to grow in 2025, with an increase of 24% in the second half compared with the first half.

4.2.2 Top 5 provinces with regional popularity for corporate loan fraud in 2025: Sichuan, Jiangsu, Zhejiang, Jilin, Inner Mongolia

Top5 Cities: Aoshima, Xiamen, Beijing, Chongqing, Shenzhen Chart 1 (page 26 of the original report) — Top5 Cities: Aoshima, Xiamen, Beijing, Chongqing, Shenzhen (Chart 1)Source: Threat Hunter original report, page 26

Top5 Cities: Aoshima, Xiamen, Beijing, Chongqing, Shenzhen Chart, 2025 — Top5 Cities: Aoshima, Xiamen, Beijing, Chongqing, Shenzhen (Chart 2)Source: Threat Hunter original report, page 26

4.2.3 Top 5 cities with regional popularity of corporate loan fraud in 2025: Qingdao, Xiamen, Beijing, Chongqing, Shenzhen

4.2.4 The highest risk of corporate loan fraud in 2025 is corporate debt

Corporate debt-taking: Corporate debt-taking is a form of corporate loan fraud with the purpose of obtaining funds without repaying the loan. Its core lies in disguising shell companies as healthy “high-quality companies” through systematic packaging and data maintenance in order to defraud huge bank loans.

Corporate loan fraud: refers to all fraud risks related to corporate loan scenarios, such as typical corporate debt obligations, technology advances, mortgage operations, corporate false material packaging and other fraud risks.

Corporate fraud risk scenarios are concentrated in four major categories: corporate debt-taking with "shell entities" as the core, technology-based credit increases by tampering with data, operating mortgage fraud involving overvaluation of collateral, and packaging fraud through fictitious operating data.

The highest risk of corporate credit fraud in 2025 was in the corporate debt overhang chart (page 27 of the original report). — The highest risk of corporate credit fraud in 2025 was corporate default.Source: Threat Hunter original report, page 27

Among them, enterprises take on debt for the purpose of obtaining funds by defrauding loans without repaying them, and their risk level is higher. Its model has evolved from simple material falsification to a complete industrial chain of organized "shell companies maintaining shells and internal and external collusion to defraud loans", posing the greatest threat to the asset security of financial institutions.

The following is the risk performance of each fraud risk model in corporate loan scenarios:

The packaging of corporate debt is a long-term packaging plan, which is more difficult and detailed. The core of corporate debt is "shell maintenance":

Through several months of systematic packaging and data maintenance, the shell company was disguised as having all the financial statements in industrial and commercial, taxation, bank flow and other dimensions.

A healthy "high-quality enterprise". This process is essentially a high-cost "data maintenance", and the ultimate goal is to use this ripened false subject as a tool to defraud huge bank loans.

The following is a multi-layered progressive packaging flow chart for corporate debt obligations.

4.3 Analysis of current situation of car loan fraud risks

Top5 provinces: Guangdong, Sichuan, Shandong, Zhejiang, Hebei Chart (page 29 of the original report) — Top5 provinces: Guangdong, Sichuan, Shandong, Zhejiang, HebeiSource: Threat Hunter original report, page 29

4.3.1 Public opinion on the risk of car loan fraud will grow steadily in 2025, with an increase of 13% in the second half compared with the first half.

4.3.2 Top 5 provinces with regional popularity for car loan fraud in 2025: Guangdong, Sichuan, Shandong, Zhejiang, Hebei

Top5 provinces: Guangdong, Sichuan, Shandong, Zhejiang, Hebei Chart (page 30 of the original report) — Top5 provinces: Guangdong, Sichuan, Shandong, Zhejiang, HebeiSource: Threat Hunter original report, page 30

In 2025, the risk of car loan fraud was unevenly distributed geographically, with Guangdong Province "leading" the country with high risks.

Risks throughout the year in Guangdong Province show distinct stage characteristics: May to July in the first half of the year was the peak period of concentrated risk outbreaks. After entering the second half of the year, as the heavy-handed rectification of cybercrime ecosystem continued to advance, public opinion on related risks has dropped significantly.

Compared with other regions, fraud methods in Guangdong are more covert, mainly manifested in two core modes:

The first is to accurately screen customers: it no longer randomly selects customers with poor qualifications or even three non-qualifications like in other regions, but specifically targets users with real qualifications and urgent financing needs;

The second is the upgrade of fraud methods: abandoning the previous excessive packaging operation path, and instead tending to rely on real qualifications and light packaging to operate, so as to avoid current fraud-risk screening and avoid compliance risks.

In 2025, the risk distribution for car fraud showed that the risk was concentrated in high-end fuel trucks and in a new energy brand in the head (figure 1)Source: Threat Hunter original report, page 31

The distribution of the risk of car fraud in 2025 shows that the risk is mainly concentrated in high-end fuel trucks and in a header of new energy brands (page 31 of the original report) — The distribution of risk brands for car fraud in 2025 shows that risk is concentrated mainly in high-end fuel trucks and in some header new energy brands (figure 2)Source: Threat Hunter original report, page 31

4.3.3 Top 5 cities with regional popularity of car loan fraud in 2025: Chongqing, Shenzhen, Guangzhou, Hangzhou, Beijing

4.3.4 The brand distribution of car loan fraud risks in 2025 shows that the risks are mainly concentrated in high-end fuel vehicles and a certain leading new energy brand

4.3.5 Public opinion on the risk of car loan fraud in 2025 will stage a regional "transfer war" due to regulatory crackdowns on threat actors

According to Threat Hunter monitoring intelligence data, the total public opinion on car loan fraud risks across the country remained stable in 2025, but there are significant differences in risk performance between regions.

Compared with the first half of the year, 55% of regional risk public opinions showed positive growth in the second half of 2025. Among them, the growth rates of Inner Mongolia, Guangxi, Sichuan and Fujian all exceeded 50%, and the upward trend was relatively obvious.

On the other hand, risk public opinion in 45% of regions still showed negative growth. Guangdong, Shandong, Hebei, Hubei, Shanghai and other economically active provinces and cities are included in this list, reflecting that public opinion about car loan fraud has been suppressed in these areas.

The risk of car-purchase fraud in 2025, as a result of regulatory efforts to counter the black market, was shown as a regional “transfer war” diagram (page 32 of the original report). — The risk of fraud in buying a car loan in 2025 due to regulation of the “transfer war” in the region against cybercrimeSource: Threat Hunter original report, page 32

Overall, the main reason for the large fluctuations in risk public opinion between regions is closely related to differences in regulatory policies and crackdown efforts. In the second half of 2025, regulatory authorities, financial institutions, and public security agencies jointly launched a crackdown, which effectively reduced the activity space of threat actors in strictly controlled areas and forced some fraudulent activities to move to areas with relatively loose policy environments. This resulted in dynamic changes in risk public opinion between different regions.

4.4 Analysis of current situation of consumer loan fraud risks

4.4.1 Public opinion on the risk of consumer loan fraud in the second half of 2025 increased by 20% compared with the first half of the year

top 5 Provinces: Sichuan, Shandong, Henan, Anhui, Chongqing Chart 1 (page 33 of the original report) — Top5 provinces: Sichuan, Shandong, Henan, Anhui, Chongqing (Chart 1)Source: Threat Hunter original report, page 33

Top5 provinces: Sichuan, Shandong, Henan, Anhui, Chongqing Chart, 2025 — Top5 provinces: Sichuan, Shandong, Henan, Anhui, Chongqing (Chart 2)Source: Threat Hunter original report, page 33

4.4.2 Top 5 provinces with regional popularity of consumer loan fraud risk in 2025: Sichuan, Shandong, Henan, Anhui, Chongqing

4.4.3 Top 5 cities with consumer loan fraud risk in 2025: Chongqing, Chengdu, Qingdao, Guiyang, Zhengzhou

4.4.4 Current status of consumer loan fraud in 2025: Packaged loan fraud has become the new normal

Current status of consumer credit fraud in 2025: packaging fraud has become a new norm (page 34 of the original report) — Status of consumer credit fraud in 2025: packaging fraud has become a new normSource: Threat Hunter original report, page 34

In 2025, the discussion volume on the risk of consumer loan fraud will continue to grow. The consumer loan scenario includes multiple types of risks, including package fraud (debt-taking), AB loans, and debt restructuring. Among them, package fraud is the most prominent fraud risk.

The following are examples of the risks of packaged loan fraud:

The following is the risk performance of each fraud risk model in consumer loan scenarios:

Status of consumer credit fraud in 2025: packaging fraud has become a new norm (page 35 of the original report) — Status of consumer credit fraud in 2025: packaging fraud has become a new normSource: Threat Hunter original report, page 35

Written at the end, financial anti-fraud offense and defense has entered a new stage of systematic confrontation. In 2025, credit fraud risks showed cross-scenario, specialization, and industrialization characteristics. Various scenarios such as professional debt, mortgage loans, car loans, and corporate loans will continue to derive new methods and new variants, and the overall prevention and control situation will be severe and complex. Although regulatory crackdowns continue to increase and the fraud-control system continues to upgrade, cybercrime ecosystem continues to iterate technology and change attack paths driven by huge profits. The pressure faced by financial institutions has not been relieved. Anti-fraud work is still a systematic and long-term arduous task.

As a professional research institution that has been deeply involved in the field of intelligence risk for a long time, we continue to track the dynamics of threat actors, analyze attack logic, and judge risk trends, and are committed to providing the industry with cutting-edge and in-depth risk insights and response references. The findings and analysis presented in this report are only part of our research results. We believe that only continuous tracking, professional research and open cooperation can build a more active defense system in this dynamic game.

Note: The data information provided in this report is estimated and analyzed by Threat Hunter based on large sample data sampling and collection, small sample survey, external intelligence data collection, data model prediction and other research methods. Due to the limitations of any data sources and technical methods in the field of statistical analysis, the data information estimated and analyzed based on the above methods are for reference only.