A bust-out usually runs in three stages. First, the fraudster opens accounts, sometimes with their real identity and sometimes with a synthetic one built up over months. Second, they behave like an ideal customer: small purchases, on-time payments and steady requests for higher limits. Third, once the limits are high enough, they max out every line at once and go dark.

From the lender’s side, the account looks healthy right up to the bust. That is what makes it hard to catch. The behavior that signals a good customer is also the setup for the attack, and when the account defaults it is easy to read it as a credit loss rather than fraud.