At a high level, here’s how to build an identity verification program
As users move through verification, you collect signals, assess risk in real time, and route each user to the appropriate flow.
Collect signals during verification
Assess risk in real time
Route to the appropriate flow
Collect signals during verification
Assess risk in real time
Route to the appropriate flow
The paradigm shift
As users move through verification, the IDV system evaluates signals in real time to assign a risk level: low, medium, or high. The system then automatically adjusts which verification steps they see.
There are three main approaches to assessing risk during identity verification.
Risk scoring models
Analyze the signals you collected during verification to assign a risk score and determine your next action.
For example, low scores get minimal friction while high scores route to manual review or automatically get rejected. Risk scores can feel easy to use, but they can also be opaque when you don't understand what determines the score.
Deep dive: high-fidelity fraud signals
Not all fraud signals are created equal. Some are noisy, prone to false positives, and difficult to interpret without context. On the flip side, high-fidelity signals provide reliable, actionable intelligence with minimal ambiguity.
High-fidelity signals share three characteristics:
- They’re difficult for fraudsters to fake or manipulate
- They have predictable false positive rates that you can tune
- They provide clear, actionable insight about fraud risk
Here’s how four high-fidelity signals work and when they’re reliable:
Device fingerprint
- When a single device is tied to multiple accounts
- Attempts to log into multiple accounts from the same device
- When a known fraudulent device tries to create a new account
IP address
- Access from high-risk countries
- VPN usage that masks a user’s location
- Geographic inconsistencies — e.g., an ID showing a California address while connecting from Nigeria
Image similarity
Link analysis
Device fingerprint
- When a single device is tied to multiple accounts
- Attempts to log into multiple accounts from the same device
- When a known fraudulent device tries to create a new account
IP address
- Access from high-risk countries
- VPN usage that masks a user’s location
- Geographic inconsistencies — e.g., an ID showing a California address while connecting from Nigeria
Image similarity
Link analysis
How adaptive IDV works in practice
01/03
Identity verification for fintech: a conversion-focused fintech app
A consumer lending app targets younger users who expect fast, mobile-first experiences. Its biggest competitive advantage is speed, so it wants to approve loan applications within minutes. Fraud is a concern, but so is conversion: losing a good customer costs more than accepting some fraud risk.
The tradeoff
The fintech app accepts a slightly higher fraud rate in the low-risk segment to maximize conversion. It concentrates its fraud-fighting resources on the 3% of users who present clear red flags. Conversion is strong while fraud losses remain acceptable relative to acquisition gains.
Low risk
- Trusted device with a clean reputation
- Email domain matches major providers
- Residential phone number, not VoIP
- Residential IP matches stated location
- Database check only
- Cross-reference name, DOB, address, SSN against credit bureau data
- No document upload required
Medium risk
- New device, but no red flags
- VPN usage, but all other signals clean
- Phone number is VoIP
- Database check
- Government ID upload
- No selfie required
High risk
- Device fingerprint linked to previous fraud
- IP address from a high-risk country
- Multiple failed database checks
- Government ID
- Selfie with liveness
- Manual review
“Building a leading marketplace that is both open to new supply partners and carefully curated requires a sophisticated approach. With this comes an enhanced complexity and responsibility to our supply partners and customers alike — we want to get this right.”