Inside the 90 Seconds After You Apply for a Loan

"It said decision in seconds and I literally watched the spinner." That is a real Reddit comment, posted by a borrower waiting on an Upstart application last year. The spinner is not a stall. In the roughly 90 seconds between the moment you click submit and the moment an offer or a denial appears on screen, a stack of automated systems is doing more analytical work than a 1995 loan officer did in a week. Most of it is invisible to you. All of it shapes the number you see.

This piece is the second-by-second walkthrough nobody publishes, because the people who could write it work at the lenders and the people who write about lending usually don't go past "the lender pulls your credit." Here is what is actually happening, layer by layer, and what you can do about each piece before you submit.

T+0: click submit. What gets posted to the lender.

Your application form posts a structured payload to the lender's backend. Name, date of birth, SSN, address history, employment, stated annual income, requested loan amount, requested term, intended purpose. If you connected your bank account during the flow, an OAuth token from a vendor like Plaid, Finicity, or MX rides along, granting the lender read-only access to recent transactions.

The payload also carries data you didn't think you submitted: device fingerprint (browser, OS, fonts, screen resolution), IP address, timezone, session duration, how many times you edited the income field, whether you pasted your SSN versus typed it. The fraud team uses every byte.

T+0 to T+5 seconds: identity verification

The first stop is identity. Vendors such as Socure, LexisNexis, or Experian Precise ID take your name, SSN, DOB, and address and run them against header data and public records to confirm you exist and that this combination is plausibly you. Mismatches (an SSN that traces to a different DOB, an address that has never been associated with you) trigger a knowledge-based authentication step or a manual review queue.

This is also where the Bank Secrecy Act and KYC requirements get satisfied. Lenders are not optional KYC participants. They are required to verify identity before extending credit.

T+5 to T+15 seconds: the fraud layer

Identity verification confirms you are real. Fraud verification confirms it is actually you applying. The fraud stack looks at:

• Device fingerprint matches against a network of known-fraud devices.
• IP geolocation versus your stated address. An application from a Lithuanian IP for a borrower in Tulsa is a flag, not necessarily a decline.
• Application velocity: how many applications has this device, IP, or SSN submitted across the lender's network in the last 30 days?
• Synthetic identity score: combinations of real and fabricated data points that suggest the applicant is a constructed identity rather than a real person.

This is also where bank-login flows get scrutinized. A real applicant connecting a bank account they own looks different from a fraudster connecting a mule account, and the underlying transaction patterns reveal it within a few API calls. (If unsolicited "lender" pitches in your inbox feel suspicious, our piece on how to spot a personal loan scam walks the warning signs.)

T+15 to T+30 seconds: the bureau pull

Now the lender hits one of the three bureaus, usually TransUnion, Equifax, or Experian, depending on the lender's contract. At prequalification this is a soft pull (no impact on your score). At application this is a hard pull. The bureau returns your full credit file in milliseconds, and the lender computes a score: FICO 8, FICO 9, VantageScore 4.0, or a custom model trained on the lender's portfolio.

FICO weights, for reference, run 35% payment history, 30% amounts owed, 15% length of credit history, 10% new credit, 10% credit mix. Custom models reweight those categories and add bureau-attribute features (number of accounts opened in the last 12 months, oldest tradeline age, percentage of accounts ever 60+ days late). Our piece on soft pull, hard pull, and the quiet cost of rate shopping wrong covers the inquiry math in detail.

The borrower who said "I got declined and the letter said 'limited credit history' but I have a 720 FICO" was not lying or wrong. The lender's custom model weighted credit-history length more aggressively than FICO does, and his thin file (two cards, two years old) tripped a policy rule that FICO alone would not have caught.

T+30 to T+50 seconds: the cash-flow layer

If you connected a bank account, this is where the lender earns its decision. Plaid, Finicity, or MX delivers 12 to 24 months of transaction history. The lender's cash-flow analyzer (Plaid Check, internal logic, or a third-party scorecard) computes:

• Income consistency: are deposits regular, and do they match the income you stated?
• NSF and overdraft history: how often, how recently, how much.
• Discretionary cash flow: income minus rent, utilities, debt service, and non-discretionary spending.
• Existing debt service captured in the bank file but not yet on the bureau report (BNPL, payday loans, peer-to-peer obligations).

Plaid's LendScore (LS1), launched in 2024 to 2025 and built entirely on cash-flow signals, claims up to 25% better predictive performance than traditional bureau scores alone. That number is from Plaid's own announcement, but it tracks with what other cash-flow scoring vendors publish: bank-transaction data sees current behavior, while bureau data sees behavior from 30 to 60 days ago.

This layer is also why "same lender, same day, my wife and I got totally different rates" can happen for a couple with similar credit scores but different bank-balance patterns. Self-employed applicants in particular benefit from the cash-flow layer; our piece on income documents underwriters actually want from self-employed applicants walks the documentation play.

T+50 to T+70 seconds: the risk model

Now the heavy compute. The lender's risk model takes everything from the prior layers and produces a probability of default (PD). Upstart's published Model 18 uses more than 1,600 borrower features and over 2,500 engineered variables, and the company processes roughly 117,000 new repayment events per business day across its lending partners, which feeds daily retraining. Not every lender publishes that level of detail; most do not. The principle holds: modern PD models eat dozens of attributes a 2015 underwriter never saw.

Worth noting: Upstart includes APR itself as a model input, because affordability and adverse-selection patterns shift with rate. The model is not just predicting your default probability in isolation; it is predicting it conditional on the rate you would be offered.

Once a PD lands, the pricing engine maps it to a tier. The tier is a row in a pricing grid that combines PD, requested loan amount, term, and the lender's funding cost. Tier 1 borrowers get the prime rate. Tier 7 borrowers get the cap, often near the state usury limit. Two borrowers with identical FICOs can fall into different tiers because the model saw different things in their cash flow, employment stability, or bureau attributes. Our explainer on why two lenders quote you wildly different APRs on the same day goes deeper.

T+70 to T+85 seconds: fair-lending and policy overlay

Before the offer is rendered, the decision passes through a compliance overlay. ECOA Reg B requires the lender to be able to demonstrate that its model and its policy rules do not produce disparate impact on protected classes. State rate caps get checked: an offer that would be legal in Texas may need to be capped or denied in New York or Massachusetts. Anti-discrimination rules screen for prohibited bases. Adverse action queues stage the denial reasons that will appear on the notice if the application gets declined. (See our state cap guide on why a New York and a Texas borrower see different offers.)

Fair-lending compliance is not theater. The CFPB has scrutinized AI underwriting models specifically for disparate-impact concerns, and consumer-finance research groups have published research raising flags even on alternative-data models. No model is bias-free. The compliance overlay is where the lender documents its testing.

T+85 to T+90 seconds: the offer (or the decline)

If approved, the front end renders an offer: amount, APR, term, monthly payment, origination fee. Click through, and you land on the Truth in Lending disclosure box that finalizes the deal. If declined, an adverse action queue spins up to generate the notice required under ECOA and FCRA, with up to four specific reasons. Both paths happened in less time than it takes to refill a coffee.

What the borrower sees vs. what happened

What you saw: a spinner and an offer. What happened: identity verification, fraud screening, bureau pull, cash-flow analysis, risk modeling across 1,000+ variables, pricing-tier assignment, fair-lending overlay, and disclosure generation, in roughly the time it takes to read this paragraph.

This matters because the offer is the output of a system, not a single judgment. When the offer is bad or absent, the leverage you have is at the inputs.

Why the same applicant gets different offers from different lenders

Three reasons.

First, different feature sets. Lender A may run a custom model trained on near-prime fintech borrowers; Lender B may use a generic FICO cutoff with a thin overlay. Same applicant, different views.

Second, different pricing grids. Lender A's funding cost (warehouse line, ABS market, deposits) may be 200 basis points lower than Lender B's, and that gets passed through. Same risk, different rate.

Third, different policy rules. State caps, max DTI, max loan-to-income, prior-bankruptcy waiting periods, employment-tenure floors. A policy rule, not a model output, can cause a decline that reads as inscrutable on the adverse action notice.

What you can change before submitting that moves the offer

Some of the highest-leverage levers are the most boring.

• Pay down revolving balances before your statements close. The statement-date balance is what the bureau receives. Paying after the statement helps your bank balance, not your reported utilization.
• Time your application after positive payment activity has reported. Most issuers report monthly; check your statement cycles.
• Make sure your employer name matches what your bank deposits show. The cash-flow layer cross-checks. A mismatch can drop the income-verification score.
• Connect a bank account if you have positive cash flow and stable deposits. Skipping the connection forces the lender to rely on bureau data alone, which often produces a worse offer for thin-file borrowers.
• Use prequalification (soft pull) at two or three lenders before submitting a hard-pull application.

The borrower's leverage when the answer is no

If the system says no, you still have rights. The adverse action notice required under ECOA Reg B (12 CFR 1002.9) and FCRA section 615(a) must give you specific reasons (up to four), the bureau used, your credit score and key factors, and the right to a free credit report within 60 days. That is your diagnostic. Use it. We walk that letter line by line in your rights when a lender denies you.

The 90 seconds is not the end of your relationship with the data. It is the start.

Frequently Asked Questions