We’ve talked about synthetic identities to death, but what about zombie identities?
“Zombie identities” is the term Veriff uses to describe a particular type of synthetic identity.
“Some identities never really disappear. They keep coming back to apply again and again. The same stolen document, the same face, the same device; rejected on one platform, then recycled on the next. And the next. We call them zombie identities. And traditional onboarding checks weren’t built to recognize a fraudster coming back for another attempt.”
Unless you’re using continuous authentication, persistence never really comes up. And identity verification doesn’t catch it, since you normally apply once and are either accepted or rejected. But what if the fraudulent identity is applying all over the place? What about your website? Your partner’s website? Or your competitor’s website?
There are two possibilities for these zombie identities.
- Identity verification works. If it works on one site, it can work on others.
- Identity verification doesn’t work. Now you’d think that the fraudster would discard the rejected identity, but they don’t; “a rejection isn’t the end, either. It’s feedback: fraudsters adjust the lighting, swap the document, change the device, and try again.”
It’s a lot easier to adjust an existing identity than to create an entirely new one. So that’s how the zombies come out to play.
So how do you stop the zombie? You can’t destroy its brain or its cells like you would with physical zombies. Veriff suggests the blocklist.
“Closing this gap means looking beyond the current session. That means biometric blocklists that flag a face tied to confirmed fraud. CrossLinks that connect the same document, device, IP or network appearing under different names. And intelligence that spans organizations.”
That last part requires cooperation between companies, even competitors. Veriff sponsors a pooled fraud network, as does Socure, LexisNexis Risk Solutions, Mitek Systems, Persona, Sift, and probably some other IDV companies. If one company reports fraud, this is shared with the pool so other companies in the pool are protected.
And if you’re not in the pool…too bad.