Latest / Fintech Conversations with Fexingo: Banking, Payments, and Financial Software Companies / How Fintechs Use AI to Detect Identity Fraud at Onboarding
Transcript
- Lucas: So there's this number I keep coming back to: according to the Federal Reserve's latest payments study, synthetic identity fraud is now the fastest-growing type of financial crime in the US, and it accounts for roughly 20 percent of charge-offs on unsecured credit. Luna: Twenty percent — that's massive. And synthetic identities are particularly tough because they're not stolen identities, they're completely fabricated. Lucas: Right. A fraudster takes a real Social Security number — often from a child or someone who doesn't use credit — and pairs it with a fake name, a fake address, maybe a fake date of birth. Over months they build a thin credit file and then they 'bust out,' maxing out credit lines and disappearing. Luna: And traditional credit bureau checks don't catch it because the file looks legitimate — it's just new. So how are fintechs trying to stop this at the onboarding stage? Lucas: That's the key — catching it at account opening, before the synthetic identity ever gets a credit line. And the main tool now is ai powered identity verification that combines document forensics, biometric liveness detection, and behavioral signals. Companies like Jumio and Onfido have built systems that check more than just whether a driver's license looks real. Luna: What else are they checking? Lucas: They look at the micro-details. For a passport or a license, they examine the font consistency, the hologram alignment, the UV pattern — things that are almost impossible to fake with a consumer-grade printer. But that's just the document side. Luna: Then there's the selfie. Lucas: Exactly. The user takes a selfie and the system checks that the face in the selfie matches the photo on the ID. But that alone isn't enough — fraudsters can use a high-res photo or a deepfake video to spoof that. So the systems now use liveness detection. Luna: Liveness detection meaning they check that there's actually a real person in front of the camera? Lucas: Yes. And there are a few ways to do it. One is active liveness — you ask the user to blink, turn their head, or smile. The AI analyzes the sequence of movements to ensure it's a real 3D face, not a video replay or a photo. But fraudsters have gotten clever: they use deepfake generators that can mimic those movements. Luna: So what's the next layer? Lucas: Passive liveness. The AI analyzes the ambient light, the skin texture, the micro-movements of facial muscles that a deepfake might not reproduce accurately. Some systems even use the phone's sensors — gyroscope and accelerometer — to detect if the phone is being held by a real person versus mounted on a rig playing a video. Luna: That's wild. So the phone itself becomes a fraud detection tool. Lucas: Exactly. And then there's behavioral biometrics. Even before the user submits the selfie, the system can analyze how they type, how they swipe, how they hold the phone. Fraudsters often fill out forms too quickly or too perfectly — real users pause, correct typos, hesitate. Luna: So the AI builds a behavioral profile in real time during the application flow. Lucas: Right. And it all happens in under a minute. The goal is to add friction for fraudsters without adding friction for real users. If a user's behavior and documents and face all check out, they're approved instantly. If something seems off, the system can escalate to a manual review or ask additional questions. Luna: But deepfakes are getting better. How do these systems keep up? Lucas: That's the arms race. The detection models are trained on millions of examples — both real and fake — and they're updated continuously. Onfido, for instance, publishes benchmarks showing that their liveness detection can reject 99.9 percent of deepfake attacks. But it's a moving target. Luna: And what about synthetic identities that use a real photo from a stolen ID but pair it with a fake SSN? Lucas: That's harder. The document might be real — stolen or bought on the dark web. But liveness detection can still catch it if the person taking the selfie doesn't match the photo on the ID. Of course, if the fraudster looks like the person in the stolen ID, that's a problem. But that's rarer. Luna: So the multi-layered approach is key — document, liveness, behavior. Lucas: Exactly. No single layer is perfect, but together they make it much harder to slip through. And fintechs are also starting to use network analysis — if a phone number or device has been associated with multiple applications in a short time, that's a red flag. Luna: That sounds similar to what credit card issuers do with velocity checks. Lucas: Very similar. But for fintechs, it's all happening at onboarding, not after the account is opened. The idea is to prevent fraud before it happens, rather than chasing losses later. Luna: And that's particularly important for neobanks and digital lenders that don't have a physical branch to verify identities in person. Lucas: Right. For a company like Chime or Varo, the entire relationship is digital. If a synthetic identity slips through and gets a debit card and a direct deposit setup, the fraudster can do a lot of damage before anyone notices. That's why these AI checks are becoming table stakes. Luna: It's also a regulatory pressure point. Regulators are increasingly expecting stronger KYC — know your customer — processes. If a fintech has too many fraudulent accounts, they can face fines or even lose their banking partners. Lucas: Absolutely. The Office of the Comptroller of the Currency and the Federal Reserve have both signaled that they're watching identity fraud closely. So fintechs have a compliance incentive too. Luna: Before we move on — and I know this is a bit of a shift — but thinking about the tools that keep this show ad-free and independent, it's really listener support that makes it possible. If you're getting something out of these episodes, a couple of dollars a month genuinely makes a difference — buy me a coffee dot com slash fexingo. Lucas: Yeah, that's right. It's a small thing that adds up and lets us keep digging into topics like this without any sponsor influence. So appreciate anyone who chips in. Luna: Alright, back to the detection arms race. Lucas, one thing I'm curious about: how do these AI models handle bias? There have been cases where facial recognition has higher error rates for people with darker skin. Lucas: That's a critical issue. Early versions of some liveness detection systems did have higher false-rejection rates for certain demographics. But the industry has improved significantly. Companies now train on diverse datasets that include a wide range of skin tones, ages, and lighting conditions. Luna: And regulators have pushed for testing and disclosure. Lucas: Yes. The New York Department of Financial Services, for example, has issued guidance on bias testing for AI used in insurance and banking. Fintechs that want to partner with big banks have to show their models are fair. So there's real market pressure to get it right. Luna: What about the user experience? If someone gets falsely rejected, that's a lost customer. Lucas: Exactly. That's why most systems have a fallback — if the AI isn't confident, it can route the user to a human agent for a video call. Some fintechs also allow multiple attempts: if the first selfie doesn't pass, the app prompts the user to try again in better lighting. Luna: So it's a balance between security and conversion. Lucas: That's the core tension. Every extra step reduces fraud but also reduces the number of legitimate users who complete onboarding. Fintechs are constantly A/B testing to find the sweet spot. Luna: And as deepfakes get better, that sweet spot may shift. It seems like we're headed toward a world where verifying identity online requires multiple modalities — something you have, something you are, and something you do. Lucas: I think so. And maybe eventually something like a digital identity wallet, where your verified identity is stored cryptographically on your phone and you just approve sharing it with a new app. That would eliminate a lot of the manual verification steps. Luna: But that also raises privacy questions. Lucas: It does. But the technology is moving fast. For now, the focus remains on making AI at onboarding as robust as possible, because the cost of getting it wrong — both financial and reputational — is huge. Luna: And as synthetic identity fraud grows, the pressure to get it right will only increase. Lucas: Exactly. This is one of those areas where fintech is building the front line of defense for the entire financial system.