Fraud and identity alerts review

How do we route mortgage fraud alerts to a reviewer with only the allowed dispositions, and record the decision and the evidence on the loan?

Treat every alert as a case with a fixed set of outcomes. When the fraud tools (identity, income, occupancy, undisclosed liabilities, property, participants) raise alerts, Callvu assembles the alerts with the file's evidence, classifies the severity under the lender's fraud policy, holds the file where the policy requires, routes the review to the fraud analyst in the Decision Desk with only the allowed dispositions (cleared with reasons, condition added, referred, declined), records the decision and the evidence on the loan, and files the suspicious activity report where the facts require.

In scopeComplex: multi-party handoffsCallvu moves: classify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The fraud report said 'high risk', the processor cleared it with 'reviewed', and the loan was repurchased.

Today, without Callvu

The fraud tool runs at submission and returns a report with alerts: an identity mismatch, an undisclosed mortgage, a participant on a watch list, a property flip. The processor scrolls, types 'reviewed, ok' in a comment, and moves on. The alert that mattered was the one the processor did not understand.

Fraud review is a decision with a limited set of dispositions, made by someone qualified, with evidence, recorded on the loan. The investors expect it; the quality control review tests it; a suspicious activity report may be required within 30 days of detection. A free-text comment is none of that.

The alerts are structured. The review should be too.

How it runs

From the requestto the system of record.

The fraud tools return alerts on a loan at submission or at a re-run. Callvu assembles them and opens the review case.

Fraud analyst: Disposes each alert in the Decision Desk with the evidence and only the allowed outcomes.
Underwriter: Receives the file with the dispositions and any conditions added.
Callvu: Assembles, classifies, holds, routes, records and refers.

Assemble and classify
Each alert is assembled with the file's evidence that bears on it (the identification, the credit report, the application's liabilities, the appraisal, the participants' licenses) and classified by type and severity under the lender's fraud policy; a severity that the policy holds for review stops the file at that point.
Chase and verify
Where an alert can be resolved by a document or an explanation (an undisclosed liability that was paid, an address discrepancy with a reason), the request goes to the borrower or the party through a link and the response is attached to the alert.
Decide
The fraud analyst disposes each alert in the Decision Desk with the evidence and only the allowed dispositions: cleared with reasons, condition added (routed to the condition process), referred for investigation, or declined. A disposition without a reason is not accepted.
Write back and refer
The dispositions, the reasons and the evidence are written to the loan in the LOS against each alert; a referral opens the investigation and, where the facts meet the threshold, the suspicious activity report within its deadline; a decline runs the adverse action process.

Where it ends: Every alert was disposed by a qualified reviewer with a reason and the evidence on the loan, the file was held where the policy required, and referrals and reports ran on their clocks. The Decision Trace shows the classification and each disposition; the Audit Trace shows the hold, the requests and the decisions.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

Bank Secrecy Act suspicious activity reporting (31 CFR 1020.320) and FinCEN mortgage fraud guidance: Suspected mortgage fraud meeting the threshold is reported on a suspicious activity report within 30 calendar days of initial detection, with the narrative FinCEN's mortgage fraud advisories describe; the review case records the detection date and the referral.
Investor and agency fraud prevention requirements (Fannie Mae Selling Guide A3-2 and the Mortgage Fraud Prevention requirements; Freddie Mac Guide 3201): Lenders must have fraud prevention and detection controls, review red flags, and report suspected fraud to the agency; the dispositions and the evidence are the record the agency and the quality control review test.
Identity Theft Red Flags rule (12 CFR 1022.90): Identity-related alerts are red flags under the program with a required response.

Company policies

Every alert is disposed with one of the allowed outcomes and a reason, by a qualified reviewer; a comment is not a disposition.
The severity tiers that hold the file are the lender's fraud policy, applied by Callvu.
Referrals and suspicious activity reports run on their clocks from the detection date.
The LOS holds the dispositions and the evidence against each alert.

Controls

Alert assembly with the file's evidence.
Severity classification with file holds.
Resolution requests to parties.
Decision Desk dispositions with required reasons.
Referral and reporting on clocks.
Record against each alert.

Clocks and deadlines

Suspicious activity report: Within 30 calendar days of initial detection where the threshold is met.
Review turn: The analyst is nudged on the policy's service level; the file hold is visible to the loan officer.

Documents and checks

The alerts with their types and severity
The evidence assembled per alert
The responses from parties
Each disposition with reason and the analyst
The referral and report records where applicable

In the Decision Trace

Each alert's classification and the hold decision.
Each disposition and its reason.
The referral decision.

In the Audit Trace

The alert receipt and the hold.
Each request and response.
Each Decision Desk step and the report filing.

The handoff

Between the front doorand the back office.

The front door

The fraud tools' alerts at submission or re-run.

The back office

The fraud analyst disposes from assembled evidence; the underwriter receives dispositions, not comments.

The Decision Desk

The fraud analyst disposes each alert in the Decision Desk with the evidence and only cleared with reasons, condition added, referred, or declined.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

Bank Leumi runs its home lending workflows on Callvu.

MTG-01

Community Bank of Mississippi runs TRID loans on Callvu.

MTG-02

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

What can the reviewer do with an alert?

Clear it with reasons, add a condition, refer it for investigation, or decline, each recorded with the evidence. A free-text comment is not a disposition.

Does the file stop?

At the severity tiers the lender's fraud policy holds for review, at the point the policy sets, with the hold visible.

When is a suspicious activity report filed?

Within 30 days of initial detection where the facts meet the threshold, from the referral on the case.

Related processes

Borrower identity verification Second review and quality control prefunding Automated underwriting findings follow-up Try it in the sandbox All home lending processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.