Which signals reveal identity impersonation before you open an account or disburse a loan?

Identity impersonation can be detected before you open the account or disburse the loan if you cross-check four kinds of signals: the document, the liveness check, the device and the applicant's behavior during the application. None of them decides alone. Together they let you approve quickly when everything lines up and send to human review the cases where something does not match.

How does impersonation work at onboarding and before disbursement?

Someone impersonating another person usually starts with leaked or purchased data and a photo of the victim's national ID card, obtained through a messaging scam or taken from some earlier paperwork. With that, they try to open an account that will later receive money from other frauds, or apply for a loan in the victim's name and divert it to an account they control.

Disbursement is the most delicate moment, because that is when the money leaves. A change to the destination account, the phone number or the email made minutes before should raise an alert, even if onboarding was approved without objections weeks earlier.

Think of a consumer lending fintech that approves applications from a phone. An applicant submits a legitimate ID card, a selfie that matches the photo and a clean history. What does not fit is everything else: the phone number was activated two days ago, the application was completed in less time than it takes to read the terms and the same device appears that week in other applications under different names. Each control, on its own, would have let it through. Seen together, they justify stopping the case and reviewing it before the money goes out.

What does document validation reveal?

Document validation confirms that the document is authentic and that it belongs to the person presenting it. In practice it includes:

• Checking the ID card data against the official sources your institution is authorized to access.
• Reviewing the image for signs of editing: fonts that do not belong, cropped edges, shadows that do not follow the light in the scene.
• Detecting photos taken of a screen or a photocopy instead of the physical document.
• Comparing the document photo with the selfie and, when they exist, with images of the same person in earlier applications.

An authentic ID card can be in the wrong hands, so this step solves part of the problem. The other part depends on proving that the person presenting it is its owner.

What is a liveness check for, and where are its limits?

A liveness check verifies that a real, present person is in front of the camera. It detects two kinds of attack. Presentation attacks happen when someone shows a photo, a video or a mask. Injection attacks happen when the attacker replaces the camera feed with a manipulated video or an AI-generated face, something people now attempt with deepfake tools anyone can get. Catching the latter requires checking the device and the integrity of the session along with the image.

The check has limits worth knowing. Poor lighting, a low-quality camera or an older person's difficulty following instructions can lead to legitimate customers being rejected. That is why passive liveness, which analyzes the image without asking for gestures, usually demands less effort than active liveness, and the flow needs an alternative path for anyone who cannot complete it.

There is a legal side too. Ecuador's Organic Law on Personal Data Protection (LOPDP) classifies biometric data as sensitive data and prohibits processing it except in the cases the law itself provides for, such as the data subject's explicit consent for clearly specified purposes. Define with your legal team which basis applies in your case, how long you keep the images and who can see them, and explain to the customer what their face is used for. Our data protection page explains how we handle this kind of information.

What do the device and behavior tell you?

While the customer completes the application, their device and the way they interact leave signals that an attacker controls with more difficulty than a document:

• Emulators, phones with a modified operating system or virtual cameras installed.
• The same device used in several applications with different identities.
• A location or network that does not match the declared address, or services that hide the connection.
• A SIM card activated or swapped a few days before the application, when it is possible to verify.
• Data copied and pasted into fields a person types from memory, such as their name or date of birth. People rarely hesitate when they type their own details.

Add to that the inconsistencies across sources: an email created the day before, declared income that does not fit the economic activity, a personal reference who shares a phone number with another applicant. Each one has innocent explanations. Several at once form a pattern that deserves a second look.

These signals are personal data too. Collect the ones that help prevent fraud, tell the customer you use them and avoid reusing them for other purposes without a legal basis that allows it.

How do you reduce friction for honest customers?

Friction drops when controls adjust to the risk of each case. If the document, the liveness check and the device match, the customer moves forward with no extra steps. If one signal appears, the flow asks for an additional verification. If several appear, the case goes to a person.

A few practices make the difference:

• Explain why you are asking for an extra step. People who understand the reason tend to complete it with less annoyance.
• Give the analyst the full context (which signal fired, with what data and at what moment) so they can resolve it the same day.
• Avoid rejecting on a single weak signal. An unfair rejection is almost never visible: the customer goes to another institution and nobody records it.
• Measure the rejections that are later reversed and the drop-off at each step of the flow. Those two figures show you what friction is costing you.
• Before disbursement, review what changed since approval, such as the destination account or the phone number, instead of repeating the whole process.

It also pays to test the flow the way an attacker would. An offensive cybersecurity assessment of the onboarding app shows whether someone can inject a video, skip a step or reuse a session that was already approved.

A good starting point is to draw your current flow and note, step by step, which signal you validate, with which vendor and what happens when it fails. With that map, our Identity and fraud service helps you decide what to add and where, without lengthening the path for applicants, and Credit origination and service makes sure the rest of the application flows. If you want to review it with us, write to us and set up a working session with your risk and technology teams.