Identity verification fraud · onboarding
Verify the person. Not the forgery.
Synthetic identity rings open accounts with forged documents, deepfakes injected through virtual cameras, photos held up for the liveness check and stolen documents. Omnareth checks every document and selfie result before the account opens, and recognizes the ring's device, a reused document or a reused face across onboardings.
| # | Event | Decision |
|---|---|---|
| 1 | Genuine applicant scans a passport | ALLOW |
| 2 | Tampered driving licence from the ring's emulator | DENY DOCUMENT_TAMPERED |
| 3 | Deepfake selfie through a virtual camera, same emulator ▲ Repeat offender; device watched |
DENY INJECTED_FEED |
| 4 | Photo held up to the camera, same emulator ▲ One device across three onboardings: case opened |
DENY LIVENESS_FAILED · WATCHLIST_MATCH · REPEAT_OFFENDER · DEVICE_HOPPING |
| 5 | Genuine selfie passes on the fourth try | FLAG TOO_MANY_ATTEMPTS |
| 6 | The ring presents the genuine applicant's stolen passport ▲ One passport on two onboardings: case opened |
DENY DETAILS_MISMATCH · IDENTITY_REUSE |
| – | Analyst confirms the device case ▲ Emulator blocked everywhere |
analyst · state |
| 7 | After a reviewer lowers the face-match threshold, a 41% match retries | DENY WATCHLIST_BLOCK · REPEAT_OFFENDER · DEVICE_HOPPING |
| 8 | Genuine applicant scans a national ID card | ALLOW |
How it fits
A check before the account opens
A ring opens hundreds of onboardings under invented names. Each one fails or passes on its own; the ring only shows across onboardings. Your system sends each request to Omnareth and acts only on what it allows.
The onboarding
The details the applicant declared and your policy: accepted documents, the lowest face match you accept, attempts allowed.
Document and selfie checks
A document must be accepted, current, untampered and match the declared details; a selfie must be live, real and match the document.
One device, many applicants
The ring's device is held responsible, never the person whose document was stolen.
Reference rules
14 rules, ready to adapt
Authorization checks fail closed, and every rule names who it holds responsible when it fires.
| Threat | What Omnareth checks | Rule code | Decision |
|---|---|---|---|
| Details Do Not Match | The date of birth on the document must match the one declared. | DETAILS_MISMATCH | DENY |
| Document Expired | An expired document cannot prove identity. | DOCUMENT_EXPIRED | DENY |
| Document Not Accepted | Only document types the business accepts may be used. | DOCUMENT_NOT_ACCEPTED | DENY |
| Document Tampered | Deny a document whose security features or data show tampering. | DOCUMENT_TAMPERED | DENY |
| Onboarding Not Open | Checks run only on open onboardings. | ONBOARDING_NOT_OPEN | DENY |
| Face Does Not Match | The selfie must match the document photo above the business's threshold. | FACE_MISMATCH | DENY |
| Injected Camera Feed | A selfie streamed from a virtual camera or emulator may be a deepfake. | INJECTED_FEED | DENY |
| Liveness Failed | A selfie must come from a live person, not a photo, screen or mask. | LIVENESS_FAILED | DENY |
| Too Many Attempts | Flag a selfie after more attempts than the policy allows. | TOO_MANY_ATTEMPTS | FLAG |
| Device Across Onboardings | Flag a device implicated in denied checks on 2+ other onboardings in 24 hours. | DEVICE_HOPPING | FLAG |
| Document or Face Reused | A document or face belongs to one person; seen on another onboarding, it may be stolen or synthetic. | IDENTITY_REUSE | FLAG |
| Repeat Offender | Flag events involving an identity implicated in two or more denied events in the last 30 days. | REPEAT_OFFENDER | FLAG |
| Blocked Identity | Identities blocked on the fraud watchlist may not take part in any onboarding event. | WATCHLIST_BLOCK | DENY |
| Watched Identity | Identities under watch may proceed only with a flag for review. | WATCHLIST_MATCH | FLAG |
The insider case
Threshold lowered. Still refused.
After the analyst confirms the case, a reviewer paid by the ring lowers the face-match threshold to zero. The selfie passes every onboarding check. Omnareth refuses it on the watchlist, and the audit record shows the block it acted on.
Victims are not suspects
Only the identities a rule implicates are held responsible. Genuine customers named in a fraud attempt are never counted against.
Policy as rules
Your checks run on every request, with the reason and a remediation step recorded.
For auditors and regulators
Every refused request is sealed with what was known at the time, and verifiable later.
Adapt the model
The Onboarding model, its rules and its fraud identifiers are plain JSON you can change.
Pilot program
Put identity verification fraud prevention to work in 90 days
One lane, facility or process, in shadow mode, with results measured against criteria we agree with you. Qualified companies and organizations can apply.