Plaid takes a defense-in-depth approach when it comes to fraud detection. You can leverage diverse fraud risk signals as needed depending on your risk appetite. Our Identity Verification (IDV) solution uses many powerful tools to help detect fraud and protect your platform from bad actors. Below is a brief overview of various checks that can be done whenever a user moves through Identity Verification. Though not absolutely comprehensive, it covers our general approach to detecting fraudulent activity.
\nWhether the overall Risk check passes or fails is determined by the Risk Rules that you configured in the template. As you review these different checks, please remember that no single check gives a conclusive yes or no as to whether the user is fraudulent; all of the fraud and risk checks need to be considered holistically.
\nThe configurable Risk Rules cover eight categories: Phone, Email, Network, Device, Behavior, Stolen Identity, Synthetic Identity, and Facial Duplicate. Several additional checks below (Age Estimation, DMV Checks) are surfaced in the IDV session but are not part of the configurable Risk Rules.
\nPlaid leverages fraud risk metadata that you’re already collecting in the background of a user’s verification session – which means that it doesn't introduce customer friction. The following categories of data are collected, analyzed, and assigned a risk level. We’ll go into more detail for these robust risk indicators below.
\nFacial Duplicate Detection
\n\nAge Estimation
\n\nDMV Checks
\nPlaid has an integration with the American Association of Motor Vehicle Administrators (AAMVA) DMV checks directly in our Identity Verification (IDV) solution.
\nWhen a user submits a US driver's license for Documentary Verification, our system can now seamlessly cross-reference key data points, such as driver’s license number, date of birth, gender, first name, and last name, with the corresponding DMV records. This adds a powerful layer of authenticity and accuracy to your identity verification process, acting as a robust form of step-up authentication.
\nEnabling AAMVA DMV checks is straightforward for existing Plaid IDV clients. You will find an option for \"DMV/Secretary of State Validation\" within the Workflow tab of your IDV templates.
\nStolen Identity Fraud Score
\n\nSynthetic Identity Fraud Score
\n\nNetwork Risk
\nAs mentioned in the fingerprinting section, we perform a highly accurate check that helps us detect if we have seen the current user before. This check is consistent and reliable even over months of time as long as the user visits from the same computer. We track how many times we've seen a specific device create separate Identity Verification sessions, both within your integration and across our platform, and we estimate risk from that based on the time frame within which those separate sessions were created. We view it as risky if multiple sessions are created on your platform in the same day or week, since this is likely a user with multiple accounts on your service. Likewise, we look at account velocity during the last 3 months across our entire network in order to flag devices that seem to be creating a large number of accounts across different services.
\nWe check for:
\nDevice and IP Risk
\nWhen the end user opens the Identity Verification UI, we start by \"fingerprinting\" the session by looking at hundreds of different attributes, including:
\nOn top of using IP Address for fingerprinting, we do a number of IP fraud checks:
\nPhone Risk
\nWe also perform an external account registration check on the user's phone number. We check 14 different services to see if the user's phone is linked to accounts elsewhere on the web.
\nEmail Risk
\nWe support (and highly recommend) providing a user's email address when doing a verification so it is associated with the session. If it is provided, we perform these checks:
\nBehavioral Analytics
\nWhen the user goes through the Identity Verification UI (note this cannot be done if using Data Source Verification via API only), we monitor and assess how a user enters their PII to assess how familiar they are with it or if they exhibit behavior that’s typical of fraud rings or bots. We look at things like:
\nIf the exhibited behavior is consistent with bad actors, fraud rings, or bots, we flag these behaviors and provide a “User Behavior” risk level. Based on the acceptable risk level set, Identity Verification will either prevent a risky user from completing the signup process or simply inform you of the risk level.
","user_segment_ids":[]}}