How Alternative Data Is Transforming Credit and Fraud Risk Models
A credit file describes what an applicant has already borrowed. It says nothing about the applicant who has never borrowed, and very little about the device submitting the application – which may have already submitted six others this week under different names.
Alternative data closes both gaps. This article covers what alternative credit data is, why it now feeds credit and fraud models, and what to check before adding a source to a live decision flow.
What counts as alternative credit data
Alternative credit data is any input used in a lending or fraud decision that does not come from a credit bureau file. In practice it falls into several categories:
- Cash flow and transaction records – deposit regularity, balance volatility, payment behaviour on existing obligations
- Utility, telecom and rent payments – a repayment record for applicants with no formal borrowing history
- Payroll and employment data – income verification independent of what the applicant declared
- Device and connection attributes – hardware and browser configuration, virtualisation and remote-access flags, network and geolocation consistency
- Behavioural signals from the session – typing rhythm, paste into sensitive fields, navigation that is either too hesitant or too linear
These categories prove different things, and treating them as one input is the most common mistake in early adoption. The first three speak to capacity and willingness to repay. The last two speak to whether the session looks like one real person applying once, or like an emulator, a remote-access tool, or an operator working through applications in volume.
Thin-file borrowers are unmeasured, not high-risk
The thin-file problem is usually framed as an emerging-market issue, but every credit market has uncovered segments: young borrowers, recent migrants, the self-employed, gig workers with irregular deposits. The file exists and is too sparse to separate a good risk from a bad one.
In fast-growing digital lending markets the share is far larger. Where informal income is common and credit penetration is low, most of the funnel has no usable file – not a slice of it. The lender then either declines by default, losing volume in the market growing fastest, or approves on evidence too thin to price the risk.
Alternative data restores separation in both cases. It is additive – these signals sit on top of bureau data where coverage is good, and carry more weight where it is not.
The same signals feed credit and fraud models
Device and session data is where the two model families meet, which is why alternative data has moved out of credit teams and into fraud operations. Randomisation is the clearest case. Device and browser attributes can be masked cheaply now, so one applicant can present a different technical identity on every attempt. Conventional checks are not built to register that, because a randomised device does not look wrong so much as it looks new every time.
Virtualisation flags, geolocation that contradicts the declared address, fields completed by paste rather than typing and sessions with no hesitation behave the same way. None proves fraud alone: legitimate users travel, change handsets and use unfamiliar networks. Correlation is what changes the picture – one anomaly is noise, several aligned in a single session is a pattern worth acting on.
This is the logic behind JuicyScore’s approach to fraud prevention: evaluating a wide set of device, connection and behavioural attributes in real time, without relying on direct user identifiers such as name, phone number or email, and returning a score plus a vector of attributes the lender feeds into its own models. The same output serves as fraud stop-markers at the top of the funnel and as additional separation inside the credit model further down.
The supply of usable data is narrowing
Two forces are tightening at once, and both favour signals carrying no direct identifiers. Regulators are the visible one: GDPR set the benchmark, and comparable regimes now operate across most active lending markets, each with its own consent and data-minimisation requirements.
Platform policy is the quieter constraint. App stores have restricted what lending applications may request from a handset, closing off contacts, photos, call logs, precise location and external storage, and browsers block cross-app tracking by default. Data a lending app could routinely collect a few years ago is now unavailable, whatever the local regulator permits.
Where alternative data models fail
Three failure modes recur.
- The first is stacking sources without measuring incremental lift – each one should be tested for what it adds beyond the model already in production, not for what it scores in isolation.
- The second is overstating the privacy position. Device identifiers and IP data can qualify as personal data under several frameworks, so “no personal data” is not a claim any vendor should make on a lender’s behalf.
- The third is model decay. Fraudsters adapt faster than borrowers change their spending habits, so fraud-facing signals need revalidation on a shorter cycle than credit-facing ones.
What this changes for risk teams
Alternative data has moved from the edge of the portfolio to the middle of it. It no longer answers what to do with applicants the scorecard cannot reach; it determines whether the scorecard still works for the ones it can.
Two things follow for risk leaders. Any new source has to prove incremental lift against the model already in production, because adding data that correlates with what you have costs latency and buys nothing. And the durable advantage belongs to lenders who can decide on data carrying no direct identifier, since that is the only category regulators and platform owners are not restricting at the same time.
