identity verification Archives

IDV Vendor Fraud Networks: Are They Fraud Silos?

Fraud silos take place when companies band together to share fraud data, but the networks are vendor-specific walled gardens.

Fraud networks

I talked about this in my October 8 post “From S y nthetic Identities to Zombie Identities.“

Zombie identities go from place to place, never stopping. Google Gemini.

One way to catch all these zombies is for companies to band together. If the zombie appears at one company, then the other companies are warned if the zombie appears at their doorsteps.

And there are moves to create these fraud networks.

“Veriff sponsors a pooled fraud network, as does Socure, LexisNexis Risk Solutions, Mitek Systems, Persona, Sift, and probably some other IDV companies.”

Another fraud network

Well, add my buddies at Incode to the list.

“TrustGraph [is] Incode’s privacy-preserving trust network built for the agentic era. TrustGraph connects fraud and trust signals across participating institutions without pooling, exchanging, or exposing customer data, so financial institutions, marketplaces, and AI companies can detect repeat fraud and agentic fraud and recognize legitimate customers who have been verified elsewhere. In Incode’s early access program, institutions using TrustGraph detected up to 53% more fraud than with their existing models alone.”

Fraud silos are the IDV version of walled gardens. Google Gemini.

But they’re all fraud silos

All right and fine and wonderful and amazing and stuff, but there’s one teeny tiny problem. If Veriff finds a zombie identity, it only helps if you’re on Veriff’s network. If you are on Incode’s network, you won’t learn anything. And vice versa. Fraud silos don’t help anybody.

Needless to say, this is by design. In essence, identity verification customers have to choose which walled garden they want as their prison.

You can find a walled garden in identity verification also. From Google Gemini.

So which fraud network are you going to choose? The one with the most participating businesses? Or the one that is best at detecting fraud? What about one with the rebel persona? The one that reads driver’s licenses in 195 countries rather than a mere 190? When you engage in competitive analysis, engage in meaningful competitive analysis.

What if the vendors cooperated and created one mega-fraud network?

Or maybe, just maybe, some of these vendors will band together and create a mega-fraud network with businesses from multiple vendors. Imagine a massive network in which all 80+ identity verification companies share their fraud data with customers in all the vendor ecosystems.

Or maybe not. The likelihood of that happening is similar to the likelihood of Facebook allowing my Bredemarket page to post links to LinkedIn…

Walled gardens are like virtual flypaper. Google Gemini.

Prospects, who consider “proprietary” a bad word, often face these choices of which proprietary ecosystem to join. Why should they join yours?

Maybe Bredemarket can help you state your benefits: https://bredemarket.com/watch-book/

Revised 10/28/2026.

From Synthetic Identities to Zombie Identities

We’ve talked about synthetic identities to death, but what about zombie identities?

“Zombie identities” is the term Veriff uses to describe a particular type of synthetic identity.

“Some identities never really disappear. They keep coming back to apply again and again. The same stolen document, the same face, the same device; rejected on one platform, then recycled on the next. And the next. We call them zombie identities. And traditional onboarding checks weren’t built to recognize a fraudster coming back for another attempt.”

Unless you’re using continuous authentication, persistence never really comes up. And identity verification doesn’t catch it, since you normally apply once and are either accepted or rejected. But what if the fraudulent identity is applying all over the place? What about your website? Your partner’s website? Or your competitor’s website?

There are two possibilities for these zombie identities.

Identity verification works. If it works on one site, it can work on others.
Identity verification doesn’t work. Now you’d think that the fraudster would discard the rejected identity, but they don’t; “a rejection isn’t the end, either. It’s feedback: fraudsters adjust the lighting, swap the document, change the device, and try again.”

It’s a lot easier to adjust an existing identity than to create an entirely new one. So that’s how the zombies come out to play.

So how do you stop the zombie? You can’t destroy its brain or its cells like you would with physical zombies. Veriff suggests the blocklist.

“Closing this gap means looking beyond the current session. That means biometric blocklists that flag a face tied to confirmed fraud. CrossLinks that connect the same document, device, IP or network appearing under different names. And intelligence that spans organizations.”

That last part requires cooperation between companies, even competitors. Veriff sponsors a pooled fraud network, as does Socure, LexisNexis Risk Solutions, Mitek Systems, Persona, Sift, and probably some other IDV companies. If one company reports fraud, this is shared with the pool so other companies in the pool are protected.

And if you’re not in the pool…too bad.

The RIVR Expansion is Not a Flood, But an Irrigation

When the land is dry, you irrigate. As threats mushroom, the Department of Homeland Security (DHS) is proposing a RIVR expansion.

Mushrooms in the desert, symbolizing the need for the 2026 RIVR expansion. — Google Gemini.

RIVR is the current name for the DHS’ Remote Identity Validation Rally, addressing ways to know who you’re dealing with. The “rally” format allows participants to test new technologies. Perhaps those technology will eventually meet Identity Assurance Level 3 (IAL3).

To encourage participation, the test results from participants are anonymized, and the identities are only revealed if participants choose to reveal them because of stellar performance. Here’s what Microblink said:

“Microblink was evaluated under the anonymized identifier DVS6. Among all participating vendors, Microblink was the only provider to meet RIVR “high performing” system benchmarks across every measured accuracy metric.”

Just a warning that RIVR tests are kind of like NIST tests. They’re sliced and diced in so many ways that almost everyone can claim to be the “winner” of the test. But as I mentioned before, this particular test resulted in a bunch of losers.

In the past, RIVR concentrated on basic identity document validation to ensure that a California driver’s license really was a California driver’s license. The rallies concentrated on topics such as basic document validation, the “selfie to ID” facial recognition matching process common in identity verification, and both active and passive presentation attack detection (liveness).

The 2026 RIVR expansion adds deepfake detection. Google Gemini.

But the 2026 RIVR expansion encompasses new testing related to deepfake detection.

“To build more robust evaluations, DHS S&T is calling on organizations that can produce or share examples of identity deepfakes attacks and the methods used to create them. Identity deepfakes, which may include face-swap videos or digitally generated or altered identity documents. This data will help the S&T develop a more complete and rigorous dataset for testing.”

This data-gathering exercise is a prelude for additional testing.

“December 2026: Applications open for companies developing presentation attack detection (detecting physical spoofing like masks or photos) and Biometric Deepfake Detection (detecting AI-generated impersonations, such as in video chats or teleconferencing).”

At the same time, DHS is also gathering “a broader set of real and fraudulent passports and driver’s licenses.”

Why? Because security of the homeland doesn’t just include keeping planes from flying into buildings. It also includes digital attacks to our infrastructure.

Watch and book.

https://bredemarket.com/watch-book/

My Fake Book…and My Real One

Inspired by Alan Beck’s Facebook post.

This book about how to pretend you’re an A.I expert on social media is a GAME CHANGER 🔥

Chapter 3, page 47: steal other people’s posts that are going viral and post them as your own.

Why didn’t I think of that?

But if you haven’t already figured it out, Alan’s book in the last picture—and my book in the next picture—are fake.

Me, in a comment on Alan Beck’s Facebook post. Google Gemini.

Although perhaps I could slop the book. Here’s the introduction; Google Gemini just has to write the rest.

Google Gemini’s Introduction to the book Buy Anything You See on the Internet Using AI

In today’s endless digital marketplace, the challenge is rarely finding something to buy—it is finding the exact thing you want amidst an ocean of results. Whether you spot a sleek pair of sneakers in a passing crowd, a unique piece of vintage furniture in a background photo, or an unnamed kitchen gadget featured in a short video clip, traditional search engines often fail us. Keying in descriptive keywords like “blue patterned tie” or “retro desk lamp” usually yields thousands of irrelevant listings, leaving shoppers feeling frustrated. Artificial intelligence changes this equation entirely, turning any image, screenshot, or vague idea into an instant, actionable doorway to purchasing.

This book serves as your complete blueprint for mastering AI-driven shopping tools to locate and buy virtually anything you encounter online or in the physical world. By leveraging multimodal AI models, visual recognition engines, and smart browser extensions, you can bypass traditional keyword search limitations altogether. You will learn how to feed real-world visual input into AI systems, extract hidden metadata, track down obscure suppliers, compare prices dynamically across global storefronts, and verify product authenticity before committing your hard-earned money.

Navigating this new era of commerce requires more than just knowing which apps to download; it demands a strategic understanding of how AI interprets visuals, text, and seller reputations. As automated agents and smart shopping assistants become more integrated into our daily browsing habits, the boundary between seeing an item and owning it has virtually disappeared. By the time you finish this guide, you will possess the practical skills and confidence needed to turn any visual discovery on the internet into a seamless, successful purchase.

Chapter Outline

Chapter 1: The Death of the Keyword – Understanding how visual AI and multimodal models are replacing traditional search engines in e-commerce.
Chapter 2: Master of the Snap – How to take, crop, and optimize photos and screenshots for maximum AI visual recognition accuracy.
Chapter 3: Decoding the Unseen – Using AI vision tools to identify brand names, materials, and design details from obscure or low-resolution images.
Chapter 4: The Global Sourcing Engine – Reverse-image searching and prompt engineering techniques to find original manufacturers, wholesale suppliers, and direct distributors.
Chapter 5: Smart Bargain Hunting – Automating price comparisons, tracking dynamic discount codes, and setting up intelligent price-drop alerts.
Chapter 6: Dodging Scams & Knockoffs – Leveraging AI to analyze seller trustworthiness, verify product reviews, and spot counterfiet listings.
Chapter 7: The Future of Autonomous Shopping – How AI agents will soon handle product selection, negotiation, and automated checkout on your behalf.

John again, plugging a REAL book

Once I saw the first words of the introduction, I groaned. Endless digital marketplace?

But if you have an interest in the factors of identity verification and authentication, I know of a real book you can buy….my book.

Proving Humanity: The Six Factors of Identity Verification and Authentication.

Why are identity verification and authentication important? How do you perform identity verification and authentication?

Drawing on over 30 years of expertise in biometrics and identity technology, I go beyond the traditional three-factor and five-factor models to explore a comprehensive six-factor framework. From the vulnerability of passwords to the innovative science of DNA and behavioral biometrics, this book provides a deep dive into how we prove who we are—and how fraudsters try to stop us.

Here are the contents of the real book:

Preface
Introduction
The First Factor: Something You Know
The Second Factor: Sonething You Have
The Third Factor: Something You Are
The Fourth Factor: Something You Do
The Fifth Factor: Somewhere You Are
The Sixth Factor: Somewhat You Why
Multi-Factor Authentication
Conclusion

Interested? Click the image below.

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket. Click on the image to purchase. — Purchase “Proving Humanity: The Six Factors of Identity Verification and Authentication” by clicking above.

Why Big Companies Can’t Perform Identity Verification Themselves

When someone asked on LinkedIn why IDScan.net had all that personably identifiable information in the first place, I remembered something about the ability to perform identity verification. Specifically, I remembered one significant sentence from my paradox of identity verification. Emphasis mine.

“To prevent fraud you have to risk fraud by giving selfie plus ID to a firm you don’t know—not Meta or Hertz, but a third party vendor you don’t know.”

Look at simple (?) facial recognition, which Amazon and Google and Meta could perform if they weren’t scared of their own customers. (That fear may have subsided.)

What is identity verification?

But identity verification is much more complex.

Yes, it includes facial recognition as well as related disciplines such as presentation attack detection and injection attack detection.
But it also includes analysis of a government-issued secure document such as a driver’s license or passport. This analysis checks some of the document’s security features to determine whether it is authentic.
Then it naturally compares the live face against the driver’s license face to see if they belong to the same person.

And in many cases that’s not enough, as identity verification goes beyond who you are and what you have. That includes checking state or provincial motor vehicle records to confirm that the motor vehicle agency knows about this license it supposedly entered.
Or it checks credit records, utility records, and the like to confirm that a person is associated with an address, a birthdate, or other personally identifiable information.
Or, and as long as they’re at it, the identity verification process ensures you’re not on an anti-money laundering (AML) sanctions list, a list of politically exposed persons (PEP), or a similar blocklist. Hertz may not care, but Bank of America certainly does.

So who can do all of this?

Who can’t perform identity verification

I will tell you who can’t.

Meta can’t do all this, and neither can Amazon or Google.

And Hertz can’t do all this either, and neither can Bank of America or Jerry Rainbow’s Cannabis Shoppe.

Jerry Rainbow can't perform identity verification at his cannibis shop. — Google Gemini.

Why? Because multi-billion dollar companies, and Jerry, don’t understand all the skills needed. Sure Amazon can route goods within warehouses, but it doesn’t know squat about ghost images or microprinting, much less how to check PEP lists.

Who can perform identity verification

So Meta et al outsource their identity verification work to companies that most of you don’t know.

But I do. I worked at Incode for a year and analyzed over 80 of its competitors while I was there.

(Dirty little secret: NONE of these identity verification vendors author ALL their algorithms. Sure they may own intellectual property for certain tasks, but they buy the other tasks from other suppliers.)

But who are you?

Are you a large company trying to understand the identity verification market?

Are you an identity verification company trying to understand your own market?

Do you need confidential help to analyze and plan the impossible?

Google Lyria. Public Domain.

Perhaps Bredemarket’s identity verification and product marketing expertise is what you need.

Talk to me.

Oh, as a postscript: remember when I created three similar videos last Saturday night? I also created a fourth one just for the identity folks.

“The Midnight Line.” Google Lyria. Public Domain.

Multiple Alias Fraud Affects the Administration for Children and Families: Know Your Sponsor

Multiple alias fraud by sponsors of unaccompanied alien children

Multiple alias fraud exists everywhere, including in purported sponsors for unaccompanied alien children. And this illustrates another “know your” use case: to Know Your Customer, Know Your Business, Know Your Recruiter, etc., we now add Know Your Sponsor.

In effect, sponsors kinda sorta function like foster parents, who not only take care of the children, but also ensure that they attend all immigration hearings…including removal from the country. But as long as they’re in the country, we need to make sure that they are under good care.

Often sponsors are family or close relatives of the unaccompanied alien children. However, non-family may become sponsors. Sponsors go through a vetting process. Vetting includes background checks, home visits…and identity verification. Identity verification of sponsors is essential to conform to statutory requirements and battle human trafficking.

Notice of proposed rulemaking to combat multiple alias fraud

So how do we battle this sponsor fraud?

The Administration for Children and Families posted a Notice of Proposed Rulemaking (ACF-2026-0199-0001) that proposes to solve the problem.

“In March 2023, ORR established an Integrity & Accountability (I&A) Team as an independent body within ORR [Office of Refugee Resettlement] with defined responsibilities to detect, prevent, mitigate, and report potential fraud and exploitation in the sponsor application process. The I&A Team is responsible for reporting all suspected fraud-related incidents to the HHS Office of Inspector General (OIG) and to the U.S. Department of Homeland Security (DHS) for law enforcement assessment and, where appropriate, criminal investigation. The I&A Team found multiple instances of potential fraud, both perpetrated by or perpetrated on UAC [unaccompanied alien children] and potential sponsors. Examples included instances of UAC and sponsors using altered birth certificates or unaltered birth certificates belonging to other people. The team found that some potential fraud involved collusion with family members in the country of origin. For example, the I&A Team identified ten UAC who were released to sponsors with falsified documents in October 2024. In one case, the I&A Team found that a woman and her partner attempted to sponsor a total of 15 UAC by using multiple aliases over a five-year period. The aliases were only discovered when the sponsor underwent fingerprinting. These cases illustrate the importance of biometric verification and cross-case comparison of identifiers, including names, dates of birth, addresses, telephone numbers, email addresses, and other application data, to identify potential fraud schemes involving aliases, recycled contact information, or repeated sponsorship attempts.”

Why is ACF important?

Too bad, because Administration for Children and Families provides worthwhile services. It promotes the economic and social well-being of families, children, individuals, and communities. It does this by providing federal leadership, partnership and resources for the compassionate and effective delivery of human services. Their clients range from domestic violence victims to families affected by disasters to foster children reaching adulthood.

And yes, ACF also serves refugee resettlement, including unaccompanied alien children.

And as far as I’m concerned, using multiple alias fraud to make money off of alien children is despicable.

Now if only ACF’s parent department, the Department of Health and Human Services, can correct its AI hallucinations in research reports.

Also note how fingerprinting is used throughout the immigration process: not only for catching the border crossers, but for taking care of them, including the most vulnerable. And fingerprint applications go far beyond the Department of Homeland Security.

The Paradox of Identity Verification

Preventing fraud risks fraud. Others have made this observation, and now I have also.

Someone posted this on Threads:

“FB wants me to upload a pic of my passport, birth certificate, license, ETC to be able to use Messenger due to “unusual activity”. Anyone ever had this issue? Because I am definitely not doing that.”

I quote posted:

“The great paradox of identity verification, ripped from today’s headlines. To prevent fraud you have to risk fraud by giving selfie plus ID to a firm you don’t know—not Meta or Hertz, but a third party vendor you don’t know.

“I do happen to know a bunch of them, having worked for @incodetech and researching 80+ competitors. But they’re mostly anonymous.

“Until they make the news.”

Then I shared the link to my post about a company that is now infamous.

https://bredemarket.com/2026/09/06/now-i-can-say-the-name-idscan-net-the-153-million-record-hack/

IDScan.net notification of data security incident — Screenshot

The Incident

My 45-second video summary of recent Bredemarket blog posts. The posts discussed the hack at IDScan.net of over 153 million driver’s licenses and other data.

The Incident. Google Lyria. Public Domain.

Here are the three most important posts I’ve written:

Data Aggregation of Driver’s License Data Comes at a Cost (The Nexus Hack)

So Do We KNOW Which Identity Verification Company Was Hacked to Give Nexus the 153 Million Driver’s Licenses?

Now I Can Say the Name IDScan.net (the 153+ million record hack)

Now I Can Say the Name IDScan.net (the 153+ million record hack)

I was reluctant to reveal the party involved in the massive hack of 153+ million driver’s licenses and other data.

But now the company, IDScan.net, has spoken.

And as I noted earlier this morning, many other firms must send out notifications now.

IDScan.net notification of a data security incident

(Original here.)

On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization. Upon this discovery, we took immediate steps to secure our systems and engaged a team of third-party specialists to help determine the full nature and scope of the incident. This investigation is currently ongoing.

While the investigation is ongoing, IDScan.net has determined that an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud. The types of information contained within the affected data may include full names and driver’s license or other government-issued identification numbers.

Though full access to the information required payment, in an abundance of caution, we are notifying potentially impacted individuals of this incident and providing access to free credit monitoring and identity protection services. If you have questions about this incident or would like to enroll in the credit monitoring and identity protection services, please call 1-833-516-2980, Monday through Friday, between 8 AM and 8 PM ET, excluding holidays. You may also write to us at 8814 Veterans Memorial Blvd, Suite 3-124, Metairie, LA 70003.

Individuals are encouraged to remain vigilant against incidents of identity theft and fraud by reviewing credit reports and account statements for suspicious activity and to detect errors. Individuals may also place a fraud alert or credit freeze by contacting the credit reporting agencies: TransUnion 1-800-680-7289, P.O. Box 2000 Chester, PA 19016, transunion.com; Experian 1-888-397-3742, P.O. Box 9554 Allen, TX 75013, experian.com; Equifax 1-888-298-0045, P.O. Box 105069 Atlanta, GA 30348, equifax.com. Individuals can further educate themselves regarding identity theft, fraud alerts, credit freezes, and steps to protect their personal information by contacting the credit reporting bureaus, the Federal Trade Commission (“FTC”), or their state Attorney General. The FTC may be reached at 600 Pennsylvania Ave. NW, Washington, D.C. 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261.

In response to this incident, we immediately began an investigation and reviewed our policies and procedures related to data security. We are also cooperating with federal law enforcement on their investigation.

So Do We KNOW Which Identity Verification Company Was Hacked to Give Nexus the 153 Million Driver’s Licenses?

(Update: Statement from IDScan.net. You heard it here last.)

No, we don’t really KNOW yet.

If you missed the story about the 153-plus million Driver’s licenses on the dark web, see my post from yesterday.

Data Aggregation of Driver’s License Data Comes at a Cost (The Nexus Hack)

Bredemarket blog, September 3, 2026.

Specifically:

“The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.”

Of course, the Nexus hackers may be lying to misdirect anti-fraudsters and cover their tracks. Fraudsters are not trustworthy people.

But if the Nexus hackers are telling the truth about the source of the hacked driver’s license data, some identity verification company is going to be in very big trouble.

Now some of you are saying, “But John…we KNOW who the identity verification company is!”

Yes, I know that the Krebs on Security article stated that some of the hacked ID cards were for marijuana dispensaries, and that a particular named ID verification company does business with marijuana dispensaries.

And that some of the hacked data appears to have been from car rental agencies, and this same ID verification company does business with a very large car rental agency.

And the FBI opened an investigation in its office where this ID verification company happens to be headquartered.

So how come I’m not naming the company now?

Two words: Richard Jewell.

Richard Jewell, hero turned suspect turned hero.

He was falsely accused of the Atlanta Olympics bombing in 1996.

By August 2007 he was dead from complications from diabetes; he was only 44. His mother, who was caught in the same negative press onslaught, outlived him by over a decade.

So I’m waiting for more definitive information. Smoke isn’t enough.