# Underwriting the thin-file customer with alternative data
Maria drives for a ride-hailing app, sells handmade goods online, and picks up weekend catering shifts. She earns a solid living. But when she applies for a $5,000 loan to buy a better car, the lender's system spits back a blank: no credit score, "insufficient history." In lending terms, Maria is a thin-file customer, someone with too little traditional credit data to score with conventional models.
She is not alone. The World Bank estimates that over a billion adults globally lack access to formal credit, and even in the US, tens of millions are "credit invisible" or unscoreable. For a fintech lender, these people are not bad risks. They are unmeasured risks. The opportunity is to measure them differently.
A conventional credit score (in the US, a FICO or VantageScore) is built mostly from your history with credit itself: credit cards, mortgages, auto loans, how reliably you repaid them. It is a record of past borrowing.
That creates a chicken-and-egg trap. You need credit history to get credit, and you need credit to build history. Young people, recent immigrants, and gig workers who transact in cash or across many platforms fall straight through.
The fix is not to lower standards. It is to find other signals that genuinely predict repayment.
"Alternative data" means any information about a borrower not found in a traditional credit report. Four categories do most of the work in fintech underwriting.
This is the strongest and most defensible source. With the customer's permission, the lender connects to their bank account (usually through an
What matters:
Cash-flow underwriting works because it measures capacity to repay directly, not by proxy. US regulators have signaled openness to it: see the interagency statement on the use of alternative data from the Consumer Financial Protection Bureau.
Millions pay rent and electricity reliably every month, yet those payments never appear on a credit report. Reporting them (through services that furnish rental and utility data to bureaus) can turn an invisible borrower into a scoreable one. It rewards exactly the behavior lenders care about: paying obligations on time.
In markets with weak formal banking, mobile phone behavior became the first serious alternative dataset. Top-up frequency, bill payment consistency, and account tenure correlate with repayment. Mobile-money histories (for example, in East African markets built on platforms like M-Pesa) let lenders underwrite people who never had a bank account.
Use this category carefully. Some device signals are predictive but legally risky, discussed below.
Some lenders ask applicants short questionnaires measuring conscientiousness, attitudes toward risk, or honesty. The theory: personality traits predict repayment when financial history is absent. Evidence is mixed and the approach is controversial, so treat psychometrics as a supplementary signal, not a foundation.
🎬 [VIDEO: "How Alternative Data Is Changing Credit Scoring" — youtube.com — a clear overview of cash-flow and non-traditional data in modern lending]
Here is where alternative data gets dangerous. More data means more ways to accidentally discriminate.
Two US laws set the frame:
Two concepts matter most.
Disparate treatment is using a protected characteristic directly. No serious lender does this on purpose.
Disparate impact is subtler and where alternative data goes wrong: a neutral-looking variable that ends up penalizing a protected group. Example: using ZIP code or shopping location as a feature can act as a proxy (a stand-in variable) for race, because neighborhoods are often segregated. The model never "sees" race, but it recreates the same bias.
This is why raw device and location data is risky. A feature like "phone brand" or "which apps you use" may quietly correlate with income, age, or ethnicity.
Under ECOA, if you deny credit you must give the applicant specific reasons (an adverse action notice). "Our AI said no" is illegal. You must be able to say something like "insufficient income stability over the review period."
That requirement kills black-box models unless you can explain them. It is why lenders lean on explainable AI techniques such as SHAP values, which attribute a model's decision to individual input features.
# Simplified: explaining why a thin-file applicant was declined
import shap
# model = trained credit risk model; X_applicant = one applicant's features
explainer = shap.TreeExplainer(model)
shap_values = explainer.shap_values(X_applicant)
# Rank features by contribution to the decision
top_reasons = sorted(
zip(X_applicant.columns, shap_values[0]),
key=lambda x: abs(x[1]),
reverse=True
)[:4]
for feature, impact in top_reasons:
print(f"{feature}: {impact:+.3f}")
# e.g. cashflow_volatility_90d: +0.41 -> pushed toward declineThe output must translate into plain-language reasons the applicant can understand and dispute.
Here is how a fintech would actually underwrite Maria.
1. Consent and connect. Maria authorizes the lender to view 90 days of bank transactions through open banking. Explicit, revocable consent is both a legal requirement and a trust builder.
2. Engineer cash-flow features. The system computes average net inflow, income coefficient of variation, minimum balance, overdraft count, and rent-payment consistency.
3. Screen features for proxy risk. Before training, the team tests each candidate variable for correlation with protected characteristics and drops or constrains the risky ones. Location-derived features get extra scrutiny.
4. Train and test for fairness. The model is evaluated not just on accuracy but on outcome differences across groups (for example, comparing approval rates and default rates). If a protected group is approved at a much lower rate without a matching risk difference, that is a disparate-impact flag to investigate.
5. Wrap in explainability. Every decision generates ranked reason codes for adverse action notices.
6. Monitor after launch. Models drift. A feature that was fair last year can become a proxy as populations shift. Fair-lending monitoring is continuous, not a one-time audit.
For Maria, the result: steady 90-day inflows, zero overdrafts, and consistent rent payments produce an approval that her blank FICO file never could.
Knowledge check
1. Why does the lesson describe thin-file customers like Maria as 'unmeasured risks' rather than 'bad risks'?
2. What is the fundamental 'chicken-and-egg' problem with conventional credit scoring described in the lesson?
3. According to the lesson, what is the correct strategic response to the failure of traditional files for thin-file customers?
4. Select ALL correct answers about why cash-flow data is considered a strong underwriting signal for thin-file customers.
Select all the correct answers.
5. Select ALL correct answers about the concept of 'alternative data' in fintech underwriting.
Select all the correct answers.
Chasing predictive power blindly. A variable can be highly predictive and still illegal to use if it proxies a protected class. Predictiveness is necessary, not sufficient.
Ignoring data quality. Bank data is messy. Misclassifying a peer-to-peer transfer as income inflates capacity and creates real losses. Robust transaction categorization is unglamorous but essential.
Over-collecting. Pulling every available signal expands both legal exposure and privacy risk. Collect what you can justify. Under privacy regimes like GDPR and various US state laws, data minimization is an expectation, not a nicety.
No human review path. Thin-file decisions sit near the margin. A manual review lane for borderline cases catches model failures and satisfies regulators that the system is not fully automated in a harmful way.
Thin-file underwriting is not charity. It is a competitive edgecompetitive edgeA lasting edge over competitors: a resource, capability or position they cannot easily replicate, letting a firm earn above-average returns over time.View full definition →. The customers legacy banks reject are a large, underserved market. A lender that can price their risk accurately captures profitable loans no one else will make, while building loyalty early in a customer's financial life.
The discipline is balancing three things at once: predictive accuracy, regulatory defensibility, and customer trust. Get one wrong and the other two collapse.