Security

Heron's shared fraud network lets rival loan funders flag defaults early, against $2 billion of yearly losses

A New York underwriting startup has quietly launched a shared early-default network for merchant cash advance funders, turning competitors' losses into everyone's early warning. It is live on the site, absent from the press feed, and the moat is the member list itself.

Vincent JiangVincent Jiang · 3 min read
Share
A black piggy bank marked Merchant Cash Advance next to a card payment terminal and banknotes
1 / 6Slide 1 of 6
The merchant cash advance market Heron's new network screens: advances against a merchant's future card sales, collected through terminals like this one.

A funder can run every check on a small-business loan applicant and still fund a fraud ring. That is the problem Heron, a New York startup legally called Open Credit Technologies, has quietly gone after. Its site now carries a Fraud Consortium page, live since September, that no press release and no news outlet has mentioned 12.

Every member's defaults feed a map of connected businesses

The mechanism on the page is simple. Members, mostly merchant cash advance funders, report confirmed early defaults to Heron each month with just a name, state and EIN, the business's tax ID. Heron maps every company connected to that default outward along the money, a Heron analyst reviews each linked business before it can trigger anything.

Every deal a member submits is then checked against the map before funding. A match returns a yes/no flag with the reason within the hour, wired to the member's CRM for auto-decline; funded deals stay monitored for 30 days 1.

Roughly $2B a year in losses, and a demo ring flagged in 27 minutes

The stakes are real money. Heron's page cites an industry estimate of roughly $2B lost to early-pay defaults every year 1. Its anonymised, illustrative walk-through shows a clean trucking applicant whose deposits are the ring paying itself: 19 businesses moving $2.1M among them, five reported early defaults, five merchant cash advance lawsuits, flagged 27 minutes after the file landed 1.

The moat is the member list itself

Pricing is a flat monthly fee with unlimited checks; the page quotes a consortium member saying one caught fraud pays for over a year of it 1. The strategic point is bigger. Heron already reads 60,000-plus submissions a day for 200-plus funders and brokers, and claims a 15% share of US businesses seeking capital 3.

The consortium turns that workflow position into a shared-data network: every member's defaults sharpen the flag for all, a moat a rival must rebuild member by member. The displacement is already proven. Good Funding's case study describes dropping its LexisNexis background pulls outright for Heron, with 59% of approvals now fully automated 4.

Competitors sharing losses through one vendor

Members are competitors sharing loss data through one vendor, and the demo file is illustrative, not a documented case 1. Non-members inherit the rings the network pushes away. Watch for member counts, a formal launch, and whether the August press cadence picks the product up; the latest release on Heron's PR feed is still the August 11 background-check announcement 2. With Insight Partners and Y Combinator backing it and a Head of Sales role posted at up to $400K OTE 5, the sales push is coming.

Get Security by email, free

The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.

Reader comments

0 comments

    More in Security

    All in this topic →

    Security

    CrowdStrike, SentinelOne and Evoke Security claimed the same seat inside Anthropic's Claude Cowork in 24 hours

    Anthropic's agent workspace created a security blind spot no endpoint tool can watch; SentinelOne, Evoke Security and CrowdStrike each claimed the seat inside it within about a day, and none disclosed what the seat pays. CrowdStrike shareholders are paying a category premium of 168 times forward earnings for it.

    Security

    Check Point Software revenue fell 1% to $670 million and billings fell 5%, and the recovery moved to 2027

    Third-quarter revenue fell 1% to $670 million, legacy license sales dropped about 19% and billings fell 5%, while CEO Nadav Zafrir conceded the recovery is more gradual than promised and now points to 2027. Seven analysts re-priced the stock within a day.

    Security

    CrowdStrike pays a reported $495 million for Fiddler AI and Dreadnode and unveils an AI kill switch

    The $495 million for Fiddler AI and Dreadnode came from the Wall Street Journal, not the company: mostly cash, closing in fiscal Q4 2027. Shareholders of a 49.8-times-book stock fund the layer that watches, tests and kills enterprise AI agents.

    Security

    Tenable's Q4 guide leaves out PHP2Shell demand, and CERT-FR flagged a 9.9 flaw in Tenable's own product

    Tenable beat its third quarter and ran nine sessions to a one-year high, but its own fourth-quarter guide prices the AI-and-PHP2Shell demand story at zero, and France's CERT-FR just flagged a 9.9 flaw in the company's identity product.

    Security

    Cellebrite's 154 European police contracts total €69.4 million, and the EU Ombudsman is probing the secrecy

    A Statewatch map counts 154 public contracts worth €69.4 million across Europe, EU funds included, while the Ombudsman probes EU secrecy over the company. CLBT reports Q3 on November 12.

    Security

    SailPoint wrote the rulebook for AI agent tool calls. The platforms bought it instead.

    SailPoint published the rulebook for policing AI agent tool calls on October 31. Workday, Cognition and Akamai spent October buying or shipping the same layer, and the December print must show whether anyone pays SailPoint for it.

    Get the newsletter

    The day's AI and market news, in your inbox every weekday.