Fraud Signals

Verifa collects over 150 fraud signals during the capture and verification process. These signals feed into the risk_assessment check, which produces a composite risk score (0–100) that can route sessions to approval, review, or rejection.

How signals are collected

Signals come from three sources:

1. Client-side (capture flow) — Behavioral analysis, device fingerprinting, bot detection, and integrity checks collected by the capture JavaScript or mobile SDK.
2. Server-side (network) — IP analysis, geolocation, velocity tracking, and timezone validation performed during the capture request flow.
3. Verification engine — Document forensics, duplicate detection, and identity graph analysis performed during workflow execution.

Signal categories

Behavioral signals

Collected during the capture flow by analyzing how the user interacts with the verification UI.

Device signals

Client-side device fingerprinting and automation detection.

Network signals

Server-side analysis of the request origin and network behavior.

Document forensics signals

Analysis of uploaded ID document images for tampering and quality issues.

Identity graph signals

Cross-session duplicate detection via hashed identity links.

Integrity signals

Validates that the client-side signal payload hasn’t been tampered with.

Biometric signals

AI-generated face detection.

Mobile-specific signals

Collected by the mobile SDK (not available in web capture).

Risk scoring

All triggered signals are aggregated into a composite risk score by the risk_assessment check.

Risk levels

Hard blocks

Certain signals trigger an automatic hard block regardless of the composite score:

• bot_detected (when configured as block)
• virtual_camera (when configured as block)
• camera_injection_detected (when configured as block)
• integrity_checksum_mismatch (when configured as block)

Per-signal actions

Each signal can be configured with one of three actions:

Configure signal actions per organization to tune risk sensitivity.

Viewing signals for a session

$
curl https://api.withverifa.com/api/v1/sessions/session_abc123/risk \
>
  -H "X-API-Key: vk_live_your_key_here"

1
{
2
  "risk_score": 35,
3
  "risk_level": "medium",
4
  "triggered_signals": [
5
    { "signal": "vpn_detected", "weight": 25, "action": "flag" },
6
    { "signal": "high_distraction", "weight": 5, "action": "flag" },
7
    { "signal": "front_exif_stripped_jpeg", "weight": 10, "action": "flag" }
8
  ],
9
  "triggered_count": 3,
10
  "hard_blocked": false
11
}

Using risk scores in workflows

The risk_assessment check is auto-injected into every workflow. You can use conditional nodes to route based on the risk level:

1
{
2
  "risk_gate": {
3
    "type": "conditional",
4
    "routes": [
5
      {
6
        "conditions": [
7
          { "field": "risk_assessment.risk_level", "op": "==", "value": "critical" }
8
        ],
9
        "target": "reject_terminal"
10
      },
11
      {
12
        "conditions": [
13
          { "field": "risk_assessment.risk_level", "op": "==", "value": "high" }
14
        ],
15
        "target": "review_terminal"
16
      },
17
      {
18
        "conditions": [],
19
        "target": "approve_terminal"
20
      }
21
    ]
22
  }
23
}

Related

• Verifications & Checks — The risk_assessment and duplicate_detection checks
• Workflows — Route sessions based on risk level
• Web Capture Flow — How signals are collected automatically
• Mobile SDK — Mobile-specific fraud signals