The challenge
A fast-scaling European neobank was onboarding 50,000 new customers per month and growing. Speed was central to its brand promise — customers expected account approval in under two minutes. But this speed was being exploited. Fraudsters were using synthetic identities (combinations of real and fabricated personal data) and, increasingly, AI-generated deepfake documents and liveness spoofs to pass KYC checks at scale.
The bank's existing KYC provider offered standard document verification and a basic liveness check — adequate for 2021, but increasingly ineffective against the new generation of generative AI attacks. Fraud losses from identity fraud were growing at 38% quarter-on-quarter, and the unit economics of the onboarding funnel were deteriorating rapidly.
The challenge was acute: tighten identity controls to stop the fraud without slowing down legitimate onboarding or damaging the conversion rates the business depended on.
Root cause analysis
The engagement began with a three-week deep-dive into the neobank's identity fraud data. Analysis of confirmed fraud cases revealed three primary attack vectors:
- Synthetic identity bust-out fraud — fraudsters building creditworthy synthetic profiles over 6–12 months before simultaneously maxing out credit facilities and disappearing
- Deepfake document injection — AI-generated identity documents and manipulated genuine documents bypassing standard OCR-based verification
- Liveness check spoofing — pre-recorded video injection and 3D mask attacks defeating the existing passive liveness solution
A secondary finding was that the bank's KYC data was not being used for ongoing fraud monitoring post-onboarding — identity signals gathered at account opening were siloed and unavailable to the transaction fraud team.
"Their deep understanding of both sophisticated fraud tactics and the customer experience was game-changing. They don't just build walls — they build smart, efficient defences."
— Chief Compliance Officer, European Neobank
The solution
Adversarial liveness & document verification layer
Replaced the existing liveness provider with an adversarial-trained active liveness solution incorporating injection attack detection. Added a document forensics layer specifically trained on AI-generated document artefacts — pixel-level inconsistencies, metadata anomalies, and font rendering tells that standard OCR systems miss entirely.
Synthetic identity detection model
Built a synthetic identity risk scoring model combining identity data consistency checks, network analysis (shared addresses, devices, and phone numbers across applications), credit bureau velocity signals, and behavioural biometrics captured during the onboarding journey. High-risk applicants were routed to enhanced due diligence rather than outright declined, preserving conversion for edge cases.
Identity-to-transaction data bridge
Connected the KYC data layer to the transaction monitoring system for the first time, enabling identity risk scores to inform real-time payment decisions. Customers with elevated identity risk scores received tighter transaction limits and enhanced monitoring for the first 90 days — significantly reducing bust-out fraud exposure.
Conversion impact
Critically, the enhanced controls did not hurt the business. By routing step-up verification only to genuinely risk-flagged applicants (approximately 4% of total volume), the vast majority of legitimate customers continued to experience sub-two-minute onboarding. The false positive rate for identity rejection was reduced from 2.8% to 0.6%, and legitimate conversion rate improved by 8% as unnecessary friction was removed from the clean applicant flow.
Looking ahead
The framework was designed to evolve. A feedback loop was established to continuously retrain the synthetic identity model on confirmed fraud cases, and a roadmap was delivered for the next generation of controls — including passive behavioural biometrics during onboarding and real-time deepfake audio detection for telephone channel attacks, anticipating the next wave of AI-assisted identity fraud.
Related case studies
Scaling fast?
Identity fraud scales with growth. Let's talk about protecting your onboarding funnel.
Get in touch →