Research report / Credit Risk Research
H1 2026 Credit Fraud Risk Report
A half-year assessment of increasingly realistic, coordinated credit fraud across professional debt assumption, mortgage, business, auto, and consumer lending.
THREAT HUNTER / RESEARCH2026
RESEARCH REPORTH1 2026 Credit Fraud Risk ReportCredit Risk Research
RESEARCH ARCHIVE / 01THREAT HUNTER
A half-year assessment of increasingly realistic, coordinated credit fraud across professional debt assumption, mortgage, business, auto, and consumer lending.
This complete English reading edition is paired with the 35-page Chinese source and preserves its full approved web narrative, headings, research scope and figures. English label annotations are mapped to the unchanged source charts so their data remains verifiable. The original publication date remains unchanged.
business-loan fraud
auto and consumer-loan risk
Report reading progress
Read instructions
This text version is reconstructed based on the 35-page original PDF and the full text of the published web page, retaining the report narrative, chapters, tables, and original charts; the cover, duplicate table of contents, and purely decorative pages are not repeated.
Starting from the second half of 2025, under the background of continued tightening of supervision and continuous upgrading of fraud controls of financial institutions, the overall active space of financial industry has been compressed, but the risk has not disappeared, but has accelerated the evolution towards realization, refinement and industrialization. New operating methods have emerged in scenarios such as professional debt, corporate loans, consumer loans, housing loans, and car loans. Based on long-term monitored risk intelligence, this article will focus on breaking down the latest changes in credit fraud techniques and main scenarios in the first half of 2026.
Credit Fraud Key Takeaways, First Half of 2026
Chapter 1｜Credit Fraud Risk Data Analysis. The overall risk landscape of credit fraud in the first half of 2026 is presented from the dimensions of overall risk scale, main loan business, core fraud types and key regions.
Chapter 2 | Credit Fraud The development and changes in a high-pressure environment are shifting from extensive counterfeiting to authentic packaging. Cybercriminal operations gradually reduce the number of purely forged materials and instead use real back payment, real flow, real operations and light packaging to improve the credibility and approval rate of fraudulent applications.
Chapter 3 | Professional debt remains the core risk of credit fraud. Debtors have shifted from the elderly and low-qualified group in the past to young people with certain real qualifications. The screening of illegal assets has become more precise and the operations have become more covert.
Chapter 4｜The arbitrage space for mortgage fraud is shrinking. After restrictions on high-quality loans, cybercriminal groups began to give priority to properties with price differences, and used borrowers with real turnover, social security and local activity trajectories to improve the loan approval rate. And a relatively complete regional industrial chain has been formed in Chongqing.
Chapter 4｜The focus of corporate loan fraud turns to the manipulation of operating data. The QR-payment turnover inflation creates false business flow through real transactions, while the technology-enabled credit-limit inflation is upgraded from simple technical tampering to a compound attack that combines "technical operations, regional policy differences and internal relationships".
Chapter 4｜The main change in consumer loan fraud is genuine contribution top-ups. Cybercriminal groups improve the borrower's qualifications by paying back provident funds, personal taxes or social security. The difficulty in judging fraud has shifted from "whether the materials are authentic" to "whether the qualifications are reasonable."
Overall, credit fraud is shifting from “falsifying data” to “manipulating real data,” and from single-point material fraud to cross-scenario and cross-role industry chain collaboration. Financial institutions need to focus on identifying the purpose, business background and relationships behind the real data.
1. Credit fraud risk profile in the first half of 2026
1.1 Risk signal on malicious financial fraud in the first half of 2026 will increase by 37% year-on-year compared with the first half of 2025.
In the first half of 2026, Threat Hunter captured a total of 3.58 million financial loan risk signals and 1.12 million malicious loan fraud risk signals, accounting for 31% of the total. The malicious loan fraud risk signals increased by 37% year-on-year compared with the first half of 2025, and increased by 2% compared with the second half of 2025.
In the first half of 2026, Threat Hunter monitored a total of 31,000 active financial loan groups, including 14,000 malicious fraud groups, accounting for 45% of the total. Active financial loan groups increased by 32% compared with the second half of 2025, and malicious fraud groups increased by 17% compared with the second half of 2025.
In the first half of 2026, Threat Hunter captured a total of 228,000 active loan service accounts, including 56,000 fraudulent accounts (fraudulent credit intermediaries and cybercriminal groups) providing malicious loan services, accounting for 24% of the total.
1.2 Top 3 popular types of malicious loan fraud business in the first half of 2026: corporate loans, credit loans, car loans
The top five most popular malicious loan fraud business types in the first half of 2026 are: corporate loans, credit loans, car loans, provident fund loans, and housing loans.
1.3 Top 3 main types of malicious loan fraud in the first half of 2026: professional debt assumption, debt optimization, agency loan renewal
Data from the first half of 2026 shows that malicious loans mainly involve more than 10 types of fraud, including professional debt assumption, debt optimization, agency loan renewal, illegal limit increase, credit repair, material forgery, car financing fraud, debt restructuring, etc. Among them, professional debt risk accounts for 28%, ranking first, and is the core attack method of cybercrime operations; debt optimization, agency loan renewal, and illegal limit increase rank second, third, and fourth respectively, and the increase rate of illegal limit increase is obvious.
1.4 Top 5 malicious loan fraud risk areas in the first half of 2026: Sichuan, Hunan, Shandong, Guangdong, and Anhui
Threat Hunter Intelligence data shows that the top five provinces (including municipalities) with the highest risk of malicious loan fraud in the first half of 2026 are Sichuan, Hunan, Shandong, Guangdong, and Anhui, with the risk value in Sichuan being significantly higher than other regions.
1.5 Top 5 cities with malicious loan fraud risks in the first half of 2026: Shanghai, Chongqing, Beijing, Chengdu, Qingdao
Threat Hunter intelligence data shows that the top five cities (including municipalities) with the highest risk of malicious loan fraud in the first half of 2026 are Shanghai, Chongqing, Beijing, Chengdu, and Qingdao. Among them, the risk signal in Shanghai and Chongqing is much higher than other cities.
2. New changes in credit fraud under high-pressure governance
2.1 Credit, cybercrime ecosystem, new changes in fraud techniques
Since the second half of 2025, with the regulatory crackdown on financial cybercrime ecosystem and the upgrading of fraud controls of financial institutions, governance results have gradually emerged. However, driven by high profits, cybercrime operations continue to adjust and derive new fraud models.
The fraudulent techniques and performance of cybercriminal operations in various scenarios also show differentiated evolution, as follows:
| Loan scenario | Fraud type | Core Situation and Changes |
|---|---|---|
| mortgage | Financing of real estate, credit, enterprise and automobile portfolio, taking on debts from developers, false mortgages | High-rating and high-end loans are restricted, profit margins are narrowed, and illegal properties are turning to "bad" properties with large price differentials; customer qualification thresholds are raised, and the number of operable customers continues to shrink. |
| consumer loan | Package fraud (debt carrying) debt restructuring AB loan | "True payment" has become the mainstream in packaged loan fraud. Debt restructuring has exposed risks, and cybercrime operations have carried out functional divisions to avoid accountability. Against the background of the overall decline in customer qualifications, AB loans are rampant, and many places have launched a wave of special crackdowns. |
| business loan | Professional Debt Technology-Enabled Credit-Limit Inflation QR-Payment Turnover Inflation Business Loan Fraud Material Packaging | In the economic environment of invoicing, cybercriminal groups actively avoid risks and turn to merchants to implement incremental code fraud. Taking advantage of regional policy differences and inconsistent calibers between banks, they carry out targeted attacks. The fraud model is mainly based on real operations + "real data" or auxiliary packaging. |
| car loan | Financing cars and cashing out top-notch cars, MLM car buying routines | The target models are concentrated on popular models with high value retention rates to ensure cash-out space and circulation efficiency. The high discount rate and rapid risk exposure have forced some cybercriminal operations to transform. |
The following article will conduct a targeted dismantling and analysis of the core fraud risks in different credit loan scenarios based on real risk intelligence monitored by Threat Hunter over a long period of time.
3. Professional Debt Assumption Fraud Risk Landscape and Changes
Professional debt risk refers to the credit risk related to professional debt behavior, which mainly involves various loan scenarios such as housing mortgages, automobile consumption loans, business operation loans, and personal consumption loans.
3.1 The amount of risk signal on professional debt assumption risks in the first half of 2026 will decrease by 31% compared with the second half of 2025
In the first half of 2026, the Threat Hunter monitoring system captured more than 220,000 risk signals on professional debt assumption risks. Among them, the number of risk signals in the first half of 2026 dropped by 31% compared with the second half of 2025.
3.2 Top 5 most popular provinces with debt in the first half of 2026: Sichuan, Chongqing, Guangdong, Shandong, Henan
Threat Hunter intelligence data shows that the top five most active provinces (including municipalities) for debt-related loan fraud in the first half of 2026 are Sichuan, Chongqing, Guangdong, Shandong, and Henan.
3.3 Top 5 most popular cities with debt in the first half of 2026: Chongqing, Chengdu, Shanghai, Shenzhen, Guangzhou
Threat Hunter intelligence data shows that the top five most active cities (including municipalities) for debt-related loan fraud in the first half of 2026 are Chongqing, Chengdu, Shanghai, Shenzhen, and Guangzhou.
Monitoring data in the first half of 2026 shows that the scale of risk signal on debt risks in Chongqing is significantly higher than other cities across the country, ranking first among all cities. After analysis, Threat Hunter researchers found that Chongqing’s housing loan debt has formed a relatively complete regional industrial chain.
Threat Hunter data shows that the risk concentration of mortgage debt in Chongqing is high, and related risk signals account for 36% of the local risk signal on debt. Compared with other regions, Chongqing has formed a closed-loop housing loan and debt industry chain led by the housing source, covering the acquisition of housing, personnel recruitment, qualification packaging, loan application and capital cash-out, showing the characteristics of organization, closed-loop and refined division of labor. After completing a single mortgage loan, the debtor may be transferred to other regions or continue to handle other types of loans, resulting in cross-regional and cross-scenario personnel recycling and risk diffusion.
For detailed analysis of the operation methods of this part of illegal industry, please see 4.1.3 Analysis of Mortgage Scenarios.
3.4 The accelerated upgrading of professional debt-ridden cybercrime operations: high-quality debt-bearing people, realistic packaging, and refined internal division of labor
In the first half of 2026, against the background of continued tightening of supervision and tightening of fraud controls of financial institutions, the living space of professional debt-ridden criminals has significantly narrowed, the cost of committing crimes has increased, the loan approval rate has declined, and some gangs have been investigated, transformed or exited. However, the risk has not disappeared. Some illegal industries have begun to actively upgrade their crime patterns, shifting from low-cost and extensive material counterfeiting in the past to more precise customer group screening, more authentic qualification packaging, and more covert "industrial chain" collaboration.
4. Fraud risks and changes in major loan scenarios
4.1 Analysis of current situation and major changes in mortgage fraud risks
4.1.1 Risk signal on mortgage fraud risks in the first half of 2026 will drop by 21% compared with the second half of 2025
4.1.2 Top 5 provinces (including municipalities) with the hottest mortgage fraud areas in the first half of 2026: Chongqing, Sichuan, Guizhou, Shandong, and Henan
4.1.3 Top 5 cities (including municipalities) with the hottest mortgage fraud areas in the first half of 2026: Chongqing, Chengdu, Guiyang, Guangzhou, Shenzhen
4.1.4 Under high pressure, mortgage fraud patterns and profit margins shrink simultaneously
As mortgage loan fraud cases continue to be exposed and bank fraud controls policies continue to tighten, professional debt-ridden property owners have undergone significant changes in property selection, customer screening and arbitrage methods.
4.2 Analysis of the current situation and main changes of corporate loan fraud risks
4.2.1 Risk signal on corporate loan fraud remains stable in the first half of 2026, with a year-on-year increase of 19% in the first half of 2026 compared with the first half of 2025
4.2.2 Top 5 provinces (including municipalities) with the most popular areas for corporate loan fraud in the first half of 2026: Hunan, Anhui, Sichuan, Hebei, Shandong
4.2.3 Top 5 cities (including municipalities) with the most popular areas for corporate loan fraud in the first half of 2026: Hefei, Qingdao, Changsha, Chongqing, Shijiazhuang
4.2.4 Corporate loan fraud risk landscape in the first half of 2026: QR-payment turnover inflation and technology-enabled credit-limit inflations are prominent
In the first half of 2026, risk signal on the risk of corporate loan fraud has remained stable compared to the second half of 2025. Risk fraud types are mainly concentrated in five major categories: debt-taking by companies with "shell entities" as the core, technological loan increases by tampering with data, operational mortgage fraud involving overvaluation of collateral, QR-payment turnover inflation that inflates business data by using merchants to accompany them to swipe collection code flow, and packaged loan fraud implemented by fabricating business data. Among them, the QR-payment turnover inflation and the technology-enabled credit-limit inflation have grown rapidly and have become the two types of risks that deserve most attention in the current corporate loan scenario.
4.2.4.1 The QR-payment turnover inflation is an iterative upgrade of the traditional traffic manipulation process
In the first half of 2026, the risk signal on the QR-payment turnover-inflation fraud risk will increase by 87% compared with the second half of 2025.
The QR-payment turnover inflation is an advanced form of the traditional method of fabricated sales. By constructing the illusion of merchants' consignment sales, cybercriminal operators actually organize merchants across the country to brush each other's sales online, inflate business data, fabricate trade backgrounds, manipulate real UnionPay clearing flows, and create the illusion of steady growth in order volume, turnover, and revenue, thereby defrauding bank loans.
Its core characteristics are: the transactions are real but the demand is false, the data can be checked but the background is fake.
Comparison between QR-payment turnover inflational traffic manipulation and other traffic manipulation methods
4.2.4.2 Technology upgrade: from technology tampering to "technology + relationship" compound attack
In the first half of 2026, risk signal on the risk of technology-enabled credit fraud will continue to rise, with an increase of 10% compared with the second half of 2025.
Science and technology-enabled credit-limit inflation is a behavior by illegal industries to fraudulently increase the company's credit limit in financial institutions and obtain loans from financial institutions by illegally tampering with company operating data, inflating revenue scale and operating strength, and other means. Its core logic is to achieve a false upgrade of corporate qualifications through "data beautification", so that companies that originally did not meet the credit conditions can obtain credit lines that far exceed their actual operating capabilities.
4.3 Analysis of current situation and major changes in car loan fraud risks
4.3.1 In the first half of 2026, risk signal on the risk of car loan fraud will decrease by 8% compared with the second half of 2025.
Judging from monthly trends, risk signal on the risk of car loan fraud increased periodically in the first half of 2026, but from an overall half-year perspective, it was still down 8% compared with the second half of 2025.
4.3.2 Top 5 provinces with the most popular areas for car loan fraud in the first half of 2026: Guangdong, Sichuan, Shandong, Anhui, and Hebei
Threat Hunter research found that in the first half of 2026, the risk of car loan fraud in Guangdong Province was significantly higher than other regions in the country, ranking first among all regions. Judging from the monthly trend, risk signal broke out intensively in May, reaching the peak in the first half of the year; after entering June, the relevant risk signal fell sharply.
The car loan fraud techniques in Guangdong are more subtle than those in other regions. The specific manifestations are as follows: in terms of customer screening, they have shifted from "not rejecting all comers" to accurately targeting high-quality targets with real qualifications and in urgent need of funds; in terms of operational techniques, they have abandoned excessive packaging and switched to a new model of real qualifications + light packaging to avoid fraud controls and compliance reviews.
Monitoring shows that the risk of auto loan fraud in Guangdong has spread from the new car market to the second-hand car market. Risk signal on both types of businesses remains highly active, and the overall financing fraud risk in the region is at a high level.
4.3.3 Top 5 cities with hot spots for car loan fraud in the first half of 2026: Shenzhen, Chongqing, Shanghai, Hangzhou, Xi’an
4.3.4 The brand distribution of car loan fraud risks in the first half of 2026 shows that the risks are mainly concentrated in high-end fuel vehicles and a certain leading new energy brand
4.3.5 Risk signal on the risk of car loan fraud will generally decline in the first half of 2026
Threat Hunter monitoring data shows that in the first half of 2026, the total risk signal on the risk of car loan fraud across the country has shown a downward trend, and the risk level in most regions has declined compared with the second half of 2025.
From the perspective of regional structure, only 16% of regional risk signals have positive growth month-on-month, and the overall growth rate is weak. Among them, the growth rate in Shanghai, Shanxi, Tianjin, and Shaanxi exceeds 10%, but the growth momentum is limited. At the same time, 84% of regional risk signals showed negative growth, with Chongqing, Guizhou, Beijing, and Hunan all declining by more than 50%, indicating that the risk of car loan fraud in these regions has been significantly curbed.
The overall decline in the risk of car purchase fraud is closely related to the tightening of regulatory policies and the intensification of joint crackdowns. Under the severe crackdown, cybercrime operations are wary. Some have suspended fraudulent activities to avoid the limelight, while others have begun to transform or withdraw, resulting in a significant decline in overall risk signal activity.
4.4 Analysis of current situation and major changes in consumer loan fraud risks
4.4.1 Risk signal on the risk of consumer loan fraud in the first half of 2026 will drop by 9% compared with the second half of 2025
4.4.2 Top 5 provinces with the most popular consumer loan fraud risk areas in the first half of 2026: Sichuan, Guizhou, Shandong, Henan, Chongqing
4.4.3 Top 5 cities with consumer loan fraud risk in the first half of 2026: Chongqing, Guiyang, Chengdu, Tangshan, Taiyuan
4.4.4 Consumer loan fraud will escalate in the first half of 2026: genuine backpayment will become the mainstream
In the ongoing offensive and defensive game with financial institutions, illegal attack methods are also constantly evolving, and have shown significant upgrades in the past six months: from purely false packaging that relied on technical forgery in the past, to large-scale use of real data packaging, that is, through real repayment and other methods, the simulation degree of fraudulent behavior has been greatly improved.
From technical forgery to “authentic repayment”, core factors such as illegal fraud methods, target customer group portraits, operation cycles and capital flows have all undergone significant changes. The specific features of the old and new modes are compared as follows:
Threat Hunter survey data shows that in the past year, the core fraud techniques of cybercrime operations in the consumer loan scenario have reached a significant turning point. In the first half of 2025 and earlier, cybercriminal operations used technical forgery and purely false material packaging as the main means; but since the second half of 2025, the core method has switched to the "real repayment" mode.
The following are examples of consumer loan fraud recruitment advertisements released by cybercrime operations at different stages before and after the confrontation. By comparing these examples, we can clearly observe the evolution trend of cybercriminal operations in target customer profiles and operating modes.
5. Conclusion
In the first half of 2026, under the background of continuous upgrading of regulatory rectification and fraud controls of financial institutions, some credit fraud scenarios have declined, but cybercrime operations have not withdrawn, but has accelerated its evolution towards reality, refinement and industrialization. New operating methods have emerged in scenarios such as professional debt, housing loans, corporate loans, consumer loans, and car loans. Real repayment, QR-payment turnover inflation, and technological limit increase have further increased the concealment of fraud and the difficulty of identification.
As a professional institution that has been deeply involved in the field of financial intelligence and risk research for a long time, we have always insisted on in-depth tracking of cybercrime operations dynamics, accurate dismantling of attack logic, and forward-looking research and judgment of risk trends, and are committed to providing the industry with cutting-edge, pragmatic, and implementable risk insights and response references. The analysis and findings presented in this report are only a microcosm of our phased research results. We know very well that in this dynamic game with no ending, only continuous tracking, professional research and open cooperation can build a truly proactive and forward-looking defense barrier.
Complete report
Keep the full edition for reference
Download the English reading edition with localized figure annotations, or open the corresponding Chinese edition to verify original wording and source exhibits.