Identity Fraud Protection
Confirm the person behind a high-risk action, return signed evidence, and let customer policy decide what happens next.
01 · Request
POST /v1/verification_sessions{
"type": "identity",
"workflow_id": "wf_identity_step_up"
}02 · Hosted challenge
Verify your identity- Document or mDL
- Face and liveness
- Configured context
Identity check complete
03 · Signed result
verification_session.verified- signature check
- verified server-side
- evidence
- method results
- decision
- customer policy decides
Proof
Evidence you can inspect before policy acts
Inspect credential paths, full results, signed delivery, and retention before evaluating fit.
Credential choice
Government ID and mDL paths share a compact session event.
Configured checks
Selected checks run; full available results require authenticated session expansion.
Compact signed webhook
Carries status, current method, audit/workflow context, timestamps, and an available document or NFC summary.
Authenticated detail retrieval
Full available results stay outside the webhook; retention remains method-specific and contract-scoped.
Why identity fraud is outrunning fraud-scoring stacks
Risk systems use device, network, payment, and account history to flag actions; they do not establish who presents a credential.
The Entrust 2026 Identity Fraud Report reports rising digital forgery and deepfake pressure: context, not Stile performance.
Signals find the moment
Synthetic identities can look ordinary; customers can look unusual; genuine documents can be misused. Scores decide when evidence warrants friction.
Evidence tests the person present
A high-risk action triggers an identity challenge; the user presents a credential; configured checks run; signed evidence returns; customer policy makes the final decision. Stile does not replace monitoring or authorization policy.
How it works
Challenge only when risk warrants it
A risk signal can request stronger evidence at the moment of action. Stile returns the signed result; the customer's policy makes the decision.
Trigger
A risk or workflow system requests an identity challenge for a high-risk action.
Verify
The user presents a Government ID or mobile driver’s license. Stile runs the configured document, face, liveness, and network checks.
Decide
Stile returns signed identity evidence. Customer policy makes the final decision to approve, escalate, delay, or decline.
Next action: inspect the returned evidence, then Read integration docs or Request technical review.
Workflow configuration
Configured checks
- Government ID captureRequired
- Data extractionNormalized
- Selfie-to-ID comparisonThreshold 0.80
- Required
- IP geographyRegion only
- VPN/proxy analysisSignal
Customer routing
On check failure: Return signed failed evidence and flag the action for additional review in customer policy.
User challenge
Confirm your identity
This check was requested before account recovery can continue.
Choose method
Powered by Stile · Signal-only return
Session report
Identity check complete
Synthetic session · Government ID
- Credential
- Government ID barcode cross-referencePassed
- Data extraction
- Name, date of birth, expiry normalizedComplete
- Selfie-to-ID
- Score 0.94 · above threshold 0.800.94
- Liveness
- Score 0.98 · above threshold 0.80Passed
- IP geography
- California, US · synthetic regionContext
- VPN/proxy
- No proxy signal in fixtureClear
Simulated compact event body
Method rows show raw simulated check evidence. Compact webhook booleans are gated by the overall session outcome; confidence is the overall document score, not face similarity.
{
"id": "evt_demo_verified",
"object": "event",
"type": "verification_session.verified",
"data": {
"object": {
"id": "vks_demo_identity",
"object": "verification_session",
"status": "verified",
"type": "identity",
"client_reference_id": null,
"current_method": "document_capture",
"age_tier": null,
"jurisdiction": null,
"jurisdiction_audit_declared": null,
"jurisdiction_audit_ip_derived": null,
"jurisdiction_audit_resolved": null,
"jurisdiction_audit_source": null,
"jurisdiction_audit_mismatch": null,
"verification_path": null,
"workflow_version_id": null,
"livemode": false,
"created": 1767225600,
"completed_at": 1767225604,
"verification_result": {
"method": "document_capture",
"confidence": 0.99,
"age_verified": false,
"age_estimate": null,
"identity_verified": true,
"face_match_passed": true,
"barcode_cross_ref_match": true,
"liveness_score": 0.98
}
}
},
"created": 1767225604
}Signed result handoff
Production webhook signatures arrive in HTTP headers and must be verified server-side.
Data minimization
- Raw captures
- Deleted after completion by default
- Signed outcome and audit metadata
- Retained under the customer’s configured and contractual scope
Customer policy makes the final decision from the returned evidence. A failed configured check can route the action to additional review.
Verification methods
Evidence paths configured for the action
Government ID and mDL are alternative rails. The signed event stays compact; retrieve available full results through authenticated session expansion. No check decides fraud or authorization.
Method 01
Government ID
- Establishes
- Captures and extracts a supported credential, then checks visible and machine-readable elements; it does not prove the presenter alone.
- Signed output
- Compact session plus available document summary.
Method 02
Mobile driver's license
- Establishes
- Requests selected wallet attributes and validates issuer-signed presentation, subject to issuer, device, jurisdiction, and protocol.
- Signed output
- Compact session status and current method; wallet detail excluded.
Method 03
Selfie-to-ID comparison
- Establishes
- Compares a live selfie with the credential portrait against a threshold; the score is evidence, not a fraud verdict.
- Signed output
- Optional face_match_passed in document summary; threshold and score excluded.
Method 04
Liveness
- Establishes
- Evaluates camera presentation with the configured method; scope varies by provider, model, device, and deployment.
- Signed output
- Optional liveness_score in document summary; other method evidence excluded.
Method 05
IP geography and VPN/proxy
- Establishes
- Returns coarse IP geography and VPN/proxy indicators for routing; they cannot identify a person or establish fraud.
- Signed output
- Jurisdiction audit fields when available. The per-request VPN heuristic is never persisted or included.
Government ID
- Establishes
- Captures and extracts a supported credential, then checks visible and machine-readable elements; it does not prove the presenter alone.
- Signed output
- Compact session plus available document summary.
Mobile driver's license
- Establishes
- Requests selected wallet attributes and validates issuer-signed presentation, subject to issuer, device, jurisdiction, and protocol.
- Signed output
- Compact session status and current method; wallet detail excluded.
Selfie-to-ID comparison
- Establishes
- Compares a live selfie with the credential portrait against a threshold; the score is evidence, not a fraud verdict.
- Signed output
- Optional face_match_passed in document summary; threshold and score excluded.
Liveness
- Establishes
- Evaluates camera presentation with the configured method; scope varies by provider, model, device, and deployment.
- Signed output
- Optional liveness_score in document summary; other method evidence excluded.
IP geography and VPN/proxy
- Establishes
- Returns coarse IP geography and VPN/proxy indicators for routing; they cannot identify a person or establish fraud.
- Signed output
- Jurisdiction audit fields when available. The per-request VPN heuristic is never persisted or included.
Integration
Define the challenge and verify the webhookCreate a session, verify its signed webhook, then retrieve deeper results server-side for customer policy.
The retention boundary, stated once
Verification processes sensitive identity and biometric material. The lifecycle separates those inputs from evidence used for delivery, routing, and audit.
Retention is method-specific. Confirm the path, finalization event, configured collision data, retention period, contract, and regional law.
01 · Capture
Inputs used for the check
ID images, mDL data, and biometric captures are processed only when the configured evidence path requires them.
02 · Complete
Raw captures leave the path
When a verification is finalized, document images, raw OCR, first and last name, date of birth, and document number are purged from the capture record.
03 · Evidence
The signed outcome remains
Method results and audit metadata support the downstream decision. Biometric collision data follows its configured retention period and is deleted when that period expires.
The surrounding stack
Where an identity layer sits in a fraud stack
Upstream systems request proof; Stile returns evidence; policy acts.
| Category | Product role | Output |
|---|---|---|
| Behavior and device intelligence | Interprets device, network, and behavior. | Risk signals. |
| Decisioning and rules engines | Applies customer scores and policies. | Customer action. |
| Orchestration layers | Routes provider evidence through configured workflows. | Orchestrated result. |
| Payment-fraud scoring | Evaluates payment exposure using account, device, and network context. | A payment risk score. |
| Transaction-time identity verification | Tests the presenter against identity evidence. | Signed identity evidence. |
Use cases
Where identity fraud risk concentrates
Target proof where the wrong person creates risk.
Account recovery
Step up recovery when the expected account holder may be absent.
Trigger: elevated recovery riskMarketplace onboarding
Confirm seller representatives before privileged access; this does not replace KYB.
Trigger: representative verificationHigh-value transaction
Challenge unusual transfers selected by customer policy.
Trigger: customer risk policyReturning-user reverification
Request fresh evidence after dormancy, profile/device change, or elevated permission.
Trigger: identity freshness
FAQ
Identity fraud protection questions
Implementation, evidence, scope, and retention for technical evaluators.
What does the signed result contain?
The signed webhook contains session status, current method, jurisdiction audit, workflow, timestamps, and an optional document or NFC summary. It excludes collected data, metadata, URLs, wallet detail, and full results. Verify the Stile-Signature header over the raw body server-side. Retrieve and expand the session through an authenticated server request for deeper evidence.
Does Stile replace a fraud-scoring platform?
No. A risk or workflow layer requests proof. Stile runs the configured challenge and returns signed evidence; customer policy decides the action.
What happens when a configured check fails?
The signed event reports failed status and current method, plus a narrow document or NFC summary when available. Retrieve method detail server-side through the authenticated session/results API. Customer policy may retry, review, delay, or decline. Use check failed or additional review required; it does not label a person as fraudulent.
What does the liveness test claim cover?
For the configured AWS Rekognition Face Liveness path, iBeta identifies the listed v1.0 backend, device, and configuration. Liveness tested by an NVLAP-accredited lab to ISO/IEC 30107-3 PAD Level 1 and Level 2, with zero successful spoofs. This covers presentation attacks at the camera in those configurations, not injection, face-match accuracy, bias, or application security. Review the iBeta presentation-attack-detection confirmation letters.
What data remains after a session?
Retention separates method inputs from outcomes, audit metadata, and configured collision data. Confirm path, configuration, contract, and law.
Add identity evidence to the moments your fraud stack flags
Keep risk systems. Add a targeted challenge, inspect signed evidence, and let customer policy decide. Deeper detail stays in canonical sources.
Bring one high-risk action, evidence, and routing.
Technical evaluation
Review one high-risk action with the technical team
Map the trigger, evidence path, signed result, and customer-owned next action.