We have one of our deposit customers that has come to us with what is evidently a scam letter and we have tried to talk to them about this being a scam. However, the customer does not believe it is a scam and wants to borrow money. Do we have to take an application etc simply to follow the proper loan denial requirements if we are sure it is fraudulent phishing?

My compliance hat says we do, but it sure seems a waste of time. Any suggestions?

My gut says you must allow them to complete an application.

You can't refuse to take an application, you can only refuse to grant credit. It seems that you have already told the customer your decision, so in affect you have made a decision on the "application" already and this requires a AAN.