How Scammers Defeat Time-in-Business Checks and What MCA Lenders Can Do About It

Shell Company Fraud Is Beating Your First Line of Defense

Time-in-business verification has long served as a foundational filter in MCA underwriting. If a business has been registered for three, four, or five years, it signals stability. It suggests the merchant has survived market cycles, maintained operations, and built real revenue. But a growing class of fraudsters has found a way to game this check entirely, and bank verification software for funders is becoming the critical backstop.

The scheme is straightforward. Scammers purchase aged shell companies or dormant business entities whose registration dates stretch back years. The Secretary of State records look clean. The EIN is legitimate. The legal formation date passes every automated TIB filter without raising a flag. Yet the actual business behind that registration is hollow. It may have opened a bank account only weeks ago, with no real operating history whatsoever.

A recent deBanked investigation in August 2026 highlighted this exact pattern: a company with nearly five years of registration history but an online footprint that looked like it launched yesterday. The TIB checked out. The SOS records confirmed it. Everything downstream of that check was compromised from the start. For MCA lenders relying on TIB as a gatekeeping metric, this is a systemic vulnerability, not an edge case.

Why Time-in-Business Checks Fail Against Sophisticated Fraud

Registration Date Is Not Operating History

The core problem is a conflation that has persisted across the industry for years. A business's legal registration date tells you when someone filed paperwork with a state agency. It tells you nothing about when that business started generating revenue, paying employees, receiving deposits, or incurring operating expenses. These are fundamentally different data points, and treating them as interchangeable creates the opening that shell company buyers exploit.

In legitimate cases, the gap between registration and operation is usually small. A business incorporates, opens a bank account, and starts transacting within weeks or months. But when a fraudster purchases a five-year-old dormant LLC, the gap becomes a chasm. The entity existed on paper for years while generating zero economic activity. The moment the fraudster takes control, they open a new bank account, manufacture a brief burst of deposits, and submit an MCA application that looks perfectly normal on the surface.

Secretary of State Records Cannot Detect This

SOS databases are designed to track legal status, not financial activity. They confirm whether a business is in good standing, when it was formed, and who the registered agent is. They do not track bank account opening dates, transaction volume, or revenue patterns. This means an underwriter who checks the SOS and sees a five-year-old active entity has confirmed exactly one thing: the paperwork is valid. The financial substance behind that paperwork remains completely unverified.

Some lenders supplement SOS checks with web presence analysis, looking for a business website, social media profiles, or online reviews. This helps catch the most obvious cases, but sophisticated fraudsters have adapted. They purchase aged domains, create backdated review profiles, and build minimal web presences that withstand cursory inspection. The only data source that cannot be easily fabricated is the banking record itself.

The Bank Account Age Mismatch Signal

When an underwriter reviews actual bank statements or, better yet, watches a live screen recording of a merchant's banking portal, the shell company scheme falls apart. A business that claims five years of operating history but shows a bank account opened three months ago is broadcasting fraud. Even if the fraudster opens the account earlier and manufactures deposits, the transaction patterns betray the scheme. Legitimate five-year-old businesses display recurring vendor payments, payroll cycles, tax disbursements, seasonal revenue fluctuations, and gradual growth patterns that simply cannot be replicated in a few weeks of staged activity.

This is precisely where AI fraud detection for business lending becomes essential. Machine learning models trained on thousands of legitimate merchant banking histories can identify compressed deposit timelines, missing expense categories, and artificially smooth cash flow curves that human reviewers might miss under time pressure.

How Asynchronous Bank Verification Exposes Shell Company Fraud

Screen Recordings Reveal What Statements Hide

Static bank statements, whether PDFs or printed documents, can be manipulated with widely available editing tools. Fraudsters alter dates, fabricate transactions, and adjust balances to match the narrative their TIB data tells. A PDF that shows 12 months of healthy deposits supports the story that the business has been operating for years, even when the underlying account is brand new.

Screen recordings of live banking sessions are fundamentally different. When a merchant logs into their actual banking portal and scrolls through transaction history on camera, the underwriter sees the real data as the bank displays it. The URL bar shows the bank's actual domain. The interface matches the institution's current design. Transaction dates, posting sequences, and balance progressions are visible in context. Exact Balance's browser-based recording captures all of this without requiring the merchant to install any software, creating a verified visual record that is orders of magnitude harder to fake than a downloaded statement.

AI-Powered Transaction Pattern Analysis

Beyond the visual verification, AI models can analyze the transaction patterns visible in recorded sessions to flag anomalies consistent with shell company fraud. Key signals include:

• Compressed deposit history: All deposits concentrated within the last 30 to 90 days despite claims of multi-year operations.
• Missing recurring expenses: No rent payments, utility bills, insurance premiums, or subscription charges that any real operating business would show.
• Round-number deposits: Repeated deposits of clean round amounts (e.g., $5,000, $10,000) rather than the irregular amounts typical of genuine business revenue.
• Absent payroll activity: No evidence of employee payments or contractor disbursements for a business that claims to have staff.
• Single-source deposits: All incoming funds from one account or one entity, suggesting the fraudster is cycling money from a personal account or accomplice.

These patterns are individually suggestive but collectively damning. An AI system that evaluates them in combination can produce a risk score within seconds of a recording review, giving underwriters a clear signal to investigate further or decline.

Building a Layered Verification Stack

The most resilient underwriting workflows in 2026 do not rely on any single data source. Instead, they layer multiple verification methods so that a fraudster who defeats one check is caught by the next. A practical layered approach looks like this:

1. SOS and TIB check: Confirm legal registration status and formation date. This remains a useful first filter, just not a sufficient one.
2. Web presence analysis: Verify that the business has a digital footprint consistent with its claimed history. Check domain registration dates, review histories, and social media activity.
3. Async bank verification: Request a screen recording of the merchant's live banking portal through Exact Balance. Review account opening date, transaction depth, and cash flow patterns.
4. AI anomaly scoring: Run the recorded session through pattern analysis to flag compressed histories, missing expense categories, and deposit irregularities.
5. Cross-reference check: Compare the bank-verified data against the application claims. Does the deposit volume match stated revenue? Does the account age align with the formation date?

Each layer adds friction for the fraudster while adding minimal friction for the legitimate applicant. A real merchant with years of operating history will have a bank portal that confirms their story in minutes. A shell company operator will not.

Why This Matters More for Canadian MCA Lenders Right Now

The Canadian alternative lending market is undergoing significant structural change. Shopify's recent transition from MCAs to loans in Canada, driven by 2025 regulatory amendments, has reshaped how major platforms operate north of the border. As embedded lenders adjust their product structures, independent MCA funders face both an opportunity and a heightened risk environment. Merchants who previously accessed capital through Shopify are now looking for alternatives, and fraudsters know it.

This shift makes robust verification more critical than ever. As we explored in our coverage of how Trust Science's Lenders API acquisition reshapes fraud prevention for Canadian MCA lenders, the Canadian market has unique fraud vectors, including bust-out schemes and synthetic identity fraud, that require purpose-built detection tools. Aged shell company fraud layers on top of these existing risks, compounding the threat for funders who rely on surface-level checks.

The consortium-data approach that platforms like Lenders API enable is valuable for catching repeat offenders across multiple lenders. But it does not solve the first-touch problem: when a fraudster presents a brand-new application with a newly purchased shell company, there is no consortium history to flag. The bank verification recording catches what the consortium cannot, because it forces the fraudster to show real banking data that contradicts their fabricated history.

Independent funders serving the Canadian SMB market should also consider how SMB lending fraud is concentrating in MCA specifically. As banks tighten credit standards and platform lenders restructure, the merchants most desperate for capital, and the fraudsters who impersonate them, are funneling into the independent MCA channel. Without layered verification that includes live bank portal review, funders are absorbing risk that larger platforms have already priced in or engineered away.

Frequently Asked Questions

How do fraudsters buy aged shell companies for MCA fraud?

Fraudsters purchase dormant or inactive business entities through online marketplaces and brokers that specialize in selling "shelf companies" or "aged corporations." These entities have legitimate formation dates, valid EINs, and clean Secretary of State records. The buyer assumes control of the entity, opens new bank accounts, and submits MCA applications that appear to come from an established business. The cost of acquiring such entities can range from a few hundred to several thousand dollars, making this a low-barrier, high-reward fraud technique.

Can bank statements alone catch shell company fraud?

Bank statements help but are not sufficient on their own. PDF and paper statements can be edited using consumer-grade software, allowing fraudsters to fabricate transaction histories that align with their shell company's claimed operating timeline. Screen recordings of live banking portal sessions are significantly harder to manipulate because the underwriter sees the bank's own interface rendering real data in real time. Combining statement review with live portal verification creates a much stronger fraud detection layer.

What is async bank verification for MCA lending?

Asynchronous bank verification allows MCA applicants to record their banking portal session at their convenience rather than joining a scheduled live call with an underwriter. The applicant receives a secure link, records their screen as they navigate their bank's website, and submits the recording for review. The underwriter watches the recording on their own schedule, verifying transaction authenticity, account age, and cash flow patterns. Exact Balance provides this workflow as a browser-based platform with AI-guided recording steps that ensure applicants capture all required information.

How does AI detect fake business histories in banking data?

AI models analyze transaction patterns across multiple dimensions: deposit frequency and regularity, expense category diversity, seasonal variation, payroll indicators, and balance trajectory over time. A legitimate business with years of history displays complex, varied transaction patterns that evolve organically. A shell company account opened recently shows compressed activity, missing expense categories, and artificially uniform deposits. Machine learning classifiers trained on thousands of real merchant profiles can score these differences automatically, flagging high-risk profiles for manual review before funding decisions are made.

Conclusion

Time-in-business checks served the MCA industry well when fraud was less sophisticated. That era is ending. Aged shell company purchases have turned SOS registration dates into unreliable signals, and any underwriting workflow that stops at TIB verification is leaving the door open to preventable losses.

The fix is not complicated, but it does require adding a verification layer that forces applicants to show real banking data rather than just claiming it. Asynchronous screen recording captures the live banking portal in a format that exposes thin histories, manufactured deposits, and account age mismatches that static documents can hide.

Exact Balance was built for exactly this scenario. Visit exactbalance.ca to see how async bank verification fits into your underwriting stack and closes the shell company gap before it costs you a funded deal.