Date: 2026-04-01 | Database: prod-rs-edwreplica (Redshift) | Schema: actor
Sources: LE Fraud Analysis · Support Complexity Analysis
| 267,165,317 total actors on platform | 47,419,983 distinct phone numbers |
| 24,148,739 total legal entities | 20,664,484 phone+LE combinations analyzed |
| 85.5% of support calls resolve cleanly (phone + last 4 SSN) | 14.5% require agent disambiguation |
| 11,404 anomalous phone+LE combos (10+ actors) | 4 fraud LEs traced to coordinated 2020-10-17 batch registration |
| 3,350,000+ actors under null or unverified LEs | 265 phone numbers with 50+ actors (fraud infrastructure) |
When a customer calls support, agents resolve their identity using a two-step lookup:
Phone number ──┐
├──► pinned to a specific legal entity ──► actor list
Last 4 SSN ──┘
The central question: how many actors does the agent see after that lookup — and how often must they disambiguate?
pie title Phone-Only Lookup — Complexity Distribution (19.9M phones)
"Clean — 1 actor (74.1%)" : 74.14
"Low — 2 actors (17.2%)" : 17.24
"Medium — 3-5 actors (7.6%)" : 7.63
"High — 6-25 actors (1.0%)" : 0.98
"Extreme — 26+ actors (<0.01%)" : 0.01
pie title Phone + Last 4 SSN Lookup — Complexity Distribution (20.7M combos)
"Clean — 1 actor (85.5%)" : 85.53
"Low — 2 actors (10.3%)" : 10.27
"Medium — 3-5 actors (3.8%)" : 3.78
"High — 6-10 actors (0.36%)" : 0.36
"Extreme — 10+ actors (0.06%)" : 0.06
Adding last 4 SSN as the second lookup factor resolves ~44% of multi-actor ambiguity:
| Metric | Phone Only | Phone + Last 4 SSN | Delta |
|---|---|---|---|
| Clean (1-actor) lookups | 74.1% | 85.5% | +11.4pp |
| 2-actor disambiguation | 17.2% | 10.3% | −6.9pp |
| High complexity (6+ actors) | 1.0% | 0.4% | −57% |
| Extreme (10+ actors) | — | 0.06% (11,404 combos) | — |
The remaining 14.5% that still return 2+ actors after the SSN pin are explained by:
- Re-applications under the same LE on the same phone
- Co-borrowers sharing a phone number
- Fraud/anomalous LEs (8791540, 8778718, etc.) accumulating actors under a single phone
Across all 2+ actor phones, most actors have never completed identity verification:
xychart-beta
title "Unconfirmed Actor Share by Phone Complexity Bucket"
x-axis ["2 actors", "3 actors", "4-5 actors", "6-10 actors"]
y-axis "% Unconfirmed" 70 --> 90
bar [77, 81, 85, 89]
Agents are frequently disambiguating between identities where most have no verified SSN, DOB, or document on file — raising the bar for correct customer identification.
xychart-beta
title "% of Combinations with Actor Created in Last 30 Days"
x-axis ["1 actor", "2 actors", "3 actors", "4-5", "6-10", "10+"]
y-axis "% Active Last 30d" 0 --> 40
bar [4.2, 17.8, 26.2, 31.4, 32.9, 37.0]
The disambiguation burden scales with complexity and is actively growing. The 10+ actor anomaly bucket has:
- 99.3% active in the last year
- 37% with a new actor created in the last 30 days
These are not historical leftovers — they are ongoing accumulation patterns.
flowchart TD
A([Customer calls support]) --> B{Look up: Phone + Last 4 SSN}
B --> C{Actor count?}
C -->|1 actor\n85.5% of calls| D[✅ Direct lookup\nNo disambiguation UI needed]
C -->|2–3 actors\n12.8% of calls| E[⚠️ Disambiguation prompt\nAgent selects correct actor]
C -->|4–10 actors\n1.6% of calls| F[🔶 Disambiguation + extra signals\nVerify name · DOB]
C -->|10+ actors\n0.06% of calls| G[🚨 Flag as anomalous\nEscalate · require alternate verification]
D --> H([Serve customer])
E --> H
F --> I{Identity confirmed?}
I -->|Yes| H
I -->|No| J([Escalate])
G --> J
| Actor Count | Action | Rationale |
|---|---|---|
| 1 | Direct lookup | No ambiguity |
| 2–3 | Show disambiguation UI | Agent selects correct actor |
| 4–10 | Disambiguation + name/DOB prompt | Too many to list without extra signal |
| 10+ | Flag & escalate | Maps to fraud LEs — not a normal caller situation |
Of the 24M+ legal entities on platform:
pie title Legal Entity Health Distribution
"Single actor, fully confirmed (23.2%)" : 23.2
"Single actor, unconfirmed — incomplete funnel (39.8%)" : 39.8
"Normal re-application / co-borrower (21.1%)" : 21.1
"Elevated concern — monitor (14.8%)" : 14.8
"High anomaly — fraud signals (1.1%)" : 1.1
Note: Percentages are proportional estimates based on LE-count distributions from the bucketed analysis.
flowchart LR
A["🟢 NORMAL\n\nExpected funnel behavior\nand co-borrower patterns"]
B["🟡 MONITOR\nElevated unconfirmed\ntail under 1 confirmed ID"]
C["🔴 INVESTIGATE\n11-50+ unconfirmed\nunder 1 confirmed ID"]
D["🚨 ACT\nCoordinated batch reg,\nverified SSN fraud rings"]
A --> B --> C --> D
| Tier | Confirmed | Unconfirmed | LE Count | Signal |
|---|---|---|---|---|
| Normal — incomplete app | 0 | 1 | 9,604,756 | Expected drop-off |
| Normal — confirmed identity | 1 | 0 | 5,604,391 | Healthy baseline |
| Normal — co-borrower | 2–3 | 0 | ~82K | Joint account |
| Monitor | 1 | 2–5 | ~410K | Possible re-application probing |
| Monitor — growing tail | 1 | 6–10 | 27,673 | Automated probing likely |
| Investigate | 1 | 11–25 | 6,057 | Strong synthetic ID signal |
| Investigate | 1 | 26–50 | 435 | Likely fraud ring activity |
| Act | 1 | 51–100 | 64 | Mule identity anchor |
| Act | 4–7 | 500+ | 2 | Active fraud operation (LEs 8791540, 8778718) |
All four were created on the same day — 2020-10-17 (platform launch), indicating a coordinated batch registration event.
xychart-beta
title "Top Anomalous LEs — Total Actor Count"
x-axis ["8776525", "8791540", "8827633", "8778718"]
y-axis "Total Actors" 0 --> 1600
bar [1546, 1158, 583, 560]
| LE ID | Verified | Created | Actors | Open Accounts | Active Logins | Distinct Phones | Status |
|---|---|---|---|---|---|---|---|
| 8776525 | ❌ No | 2020-10-17 | 1,546 | 0 | 13 | 186 | Unverified SSN — likely identity mule pool |
| 8791540 | ✅ Yes | 2020-10-17 | 1,158 | 205 | 116 | 1,095 | Active today — large-scale synthetic ID operation |
| 8827633 | ❌ No | 2020-10-17 | 583 | 0 | 19 | 536 | Unverified, active as of 2026-03-31 |
| 8778718 | ✅ Yes | 2020-10-17 | 560 | 160 | 508 | 35 | Verified, extreme phone recycling ratio (508 logins / 35 phones) |
| 19082275 | ✅ Yes | 2020-12-19 | 217 | 42 | 1 | 2 | 1 phone, 216 unconfirmed — single operator |
| 53732559 | ✅ Yes | 2024-05-03 | 215 | 16 | 1 | 1 | 1 phone, recently created, 214 unconfirmed |
| 60477341 | ✅ Yes | 2024-12-03 | 170 | 7 | 2 | 1 | Newest anomalous LE — still accumulating |
Key pattern: LEs 8791540 and 8778718 are verified SSN legal entities with active open accounts and logins — they are embedded in the platform as functional customers, not just phantom registrations.
47.4M total distinct phone numbers. Most are healthy — but a small tail represents severe reuse:
xychart-beta
title "Phones by Legal Entity Reuse Level"
x-axis ["1 LE\n(normal)", "2-3 LEs\n(household)", "4-10 LEs\n(elevated)", "11-500 LEs\n(anomalous)", "500+ LEs\n(fraud infra)"]
y-axis "Phone Count (log scale, thousands)" 0 --> 50000
bar [47120, 1800, 110, 0.6, 0.003]
| Reuse Level | Phone Count | Likely Explanation |
|---|---|---|
| 1 LE | ~47.1M (99.4%) | Normal |
| 2–3 LEs | ~1.8M (3.9%) | Shared household / re-applications |
| 4–10 LEs | ~110K (0.2%) | VOIP or device reuse |
| 11–500 LEs | ~600 (<0.01%) | Recycled carrier or VOIP numbers |
| 500+ LEs | 3 numbers | Core fraud infrastructure anchors |
The 3 phones with 500+ LEs each have 26+ confirmed actors and collectively account for 11,152 actors. These are the anchor numbers of an active fraud operation and should be immediately blocked from standard lookup flows.
xychart-beta
title "% of LEs with Actor Created in Last Year — by Complexity Bucket"
x-axis ["1 actor", "2-3", "4-5", "6-10", "11-25", "26-50", "51-100", "100+"]
y-axis "% Active Last 1 Year" 60 --> 105
bar [63.8, 79.0, 90.3, 95.1, 98.1, 98.3, 98.0, 100.0]
Activity rate scales monotonically with LE complexity. The most anomalous LEs are also the most recently active:
| LE Bucket | % Active Last 30d | % Active Last 1yr |
|---|---|---|
| 1 actor (baseline) | 3.5% | 63.8% |
| 11–25 actors | 41.8% | 98.1% |
| 26–50 actors | 46.5% | 98.3% |
| 51–100 actors | 48.0% | 98.0% |
| 100+ actors | 23.5% | 100% |
The dip in 30-day activity for 100+ actor LEs (23.5%) is notable — the newest LE in this tier was created 2025-12-28, suggesting new LE creation may be shifting — but existing LEs in the tier continue accumulating actors (100% active last year).
| Priority | Action | Rationale |
|---|---|---|
| 🚨 P0 | Block the 3 phones with 500+ LEs from all lookup flows | Core fraud infrastructure — no legitimate caller is the 500th actor on a number |
| 🚨 P0 | Investigate LEs 8791540 and 8778718 | Verified SSNs, 205+160 open accounts, active logins as of today |
| 🔴 P1 | Implement 10+ actor escalation flag in support tooling | 11,404 combos map directly to fraud LEs; no normal caller reaches this tier |
| 🔴 P1 | Flag 265 phones with 50+ actors for agent warning | Recycled/VOIP numbers — agents need to know they are not seeing one person's history |
| 🟡 P2 | Add disambiguation UI at 2–3 actor threshold | Affects 12.8% of support calls; currently no structured agent guidance |
| 🟡 P2 | Track 10+ actor LE and phone+LE counts as a weekly metric | Both are growing; a trend line is needed to measure intervention effectiveness |
- Investigate the 3.35M null-LE actors — structural funnel drop-off vs. incomplete registration vs. something more anomalous
- Monitor LEs created after 2024 (53732559 created 2024-05-03, 60477341 created 2024-12-03) — newer fraud patterns may be emerging with smaller actor pools but the same operational signatures
- Cross-reference the 11,404 anomalous (phone, LE) combos against the fraud LE list to confirm overlap and identify any new LEs not yet in the known set
Full detail queries and raw results: multi_actor_le_fraud_analysis-2026-04-01.md · phone-actor-support-complexity-2026-04-01.md