FinCEN has warned that criminals are using generative AI to create fraudulent identity documents and synthetic identities designed to bypass verification controls. Your point-in-time authentication systems weren't built for this threat model. When a deepfake can pass biometric verification and a synthetic identity can clear KYC checks, you need continuous trust assessment, not just stronger gates.
This checklist helps you implement continuous identity trust frameworks that detect AI-driven fraud throughout the customer lifecycle, not just at onboarding.
What This Checklist Covers
This checklist addresses the operational controls needed to move from point-in-time identity verification to continuous trust scoring across customer and employee accounts. It's designed for security engineers managing authentication systems, fraud analysts monitoring account behavior, and compliance teams ensuring you meet evolving regulatory expectations around identity risk.
You'll implement behavioral baselines, trust decay mechanisms, and contextual authentication that adapt as AI-powered phishing, deepfake impersonation, and synthetic identities evolve.
Prerequisites
Before starting this checklist, confirm you have:
- Baseline authentication logs: At minimum, successful and failed login attempts with timestamps, IP addresses, and device fingerprints for the past 90 days.
- Transaction monitoring capability: Real-time or near-real-time access to customer transaction data.
- Cross-functional authority: Security, fraud, and compliance teams aligned on trust score thresholds that trigger action.
- Identity data retention policy: Clear retention periods that satisfy both your risk models and regulatory obligations under the Bank Secrecy Act.
Checklist Items
1. Establish Behavioral Baselines for Each Identity
Document normal patterns for login times, transaction amounts, device usage, and geographic locations per account. Store baseline parameters for comparison.
Example: Your system flags a wire transfer initiated from a new device in a non-baseline timezone, even if the credentials are valid and Multi-Factor Authentication passed.
2. Implement Trust Decay on Dormant Accounts
Reduce trust scores automatically when accounts show no activity for defined periods. Set thresholds: 30 days of inactivity triggers enhanced verification; 90 days requires full re-authentication.
Example: A customer who hasn't logged in for 60 days faces step-up authentication before executing a high-value transaction, regardless of correct credentials.
3. Cross-Reference Identity Attributes Against External Watchlists
Query OFAC, FinCEN, and relevant watchlist screening sources during transactions, not just at account opening. Automate checks when trust scores drop below defined thresholds.
Example: A mid-lifecycle PEP designation triggers immediate review and enhanced due diligence, even if the customer passed initial KYC.
4. Monitor for Synthetic Identity Indicators Across the Account Lifecycle
Track for impossible combinations: SSN issued after stated birth year, address histories that don't align with credit bureau data, phone numbers registered to multiple identities.
Example: Your system detects that an account's stated address has no utility history and the SSN appears on three other accounts, triggering a synthetic identity investigation before approving a credit line increase.
5. Deploy Device Fingerprinting with Anomaly Detection
Capture browser characteristics, operating system details, and hardware identifiers. Flag when familiar credentials appear from unfamiliar device profiles.
Example: A login from a device with a different screen resolution, timezone setting, and browser plugin set than the customer's established pattern triggers step-up authentication, even with correct password and MFA.
6. Implement Velocity Checks on Identity Attribute Changes
Limit how frequently customers can modify email addresses, phone numbers, shipping addresses, and payment methods. Require enhanced verification for changes within 30 days of previous modifications.
Example: A request to change both email and phone number within 48 hours of a password reset triggers manual review and requires the customer to verify identity through an out-of-band channel.
7. Score Trust Dynamically Based on Contextual Signals
Combine authentication strength, behavioral deviation, transaction risk, and time-since-last-verification into a single trust score. Define score thresholds that trigger different authentication requirements.
Example: A customer with high trust (recent login, familiar device, in-pattern transaction) completes a payment with passive authentication. The same customer from a new location with a large transaction faces step-up MFA.
8. Establish Step-Up Authentication Triggers
Define specific scenarios requiring additional verification: transactions above dollar thresholds, sensitive account changes, logins from new countries, or trust scores below acceptable levels.
Example: Your policy requires biometric verification for wire transfers above $10,000 when initiated from a device not seen in the past 30 days, regardless of password correctness.
9. Create Trust Recovery Procedures
Document how accounts regain trust after triggering alerts. Require manual review, not just time passage, for accounts flagged for synthetic identity or deepfake indicators.
Example: An account flagged for potential compromise requires the customer to verify identity in-branch or through video call before trust score resets, preventing automated trust recovery that attackers could exploit.
10. Log All Trust Score Changes with Justification
Record every trust score modification, the signals that triggered it, and the resulting authentication requirements. Retain logs per your Bank Secrecy Act obligations (typically five years).
Example: An auditor can trace why a specific transaction required step-up authentication by reviewing the trust score at transaction time, the behavioral deviations detected, and the threshold policy in effect.
11. Test Trust Frameworks Against Known Fraud Patterns
Simulate account takeover scenarios, synthetic identity applications, and deepfake authentication attempts. Verify your trust scoring detects these patterns before they reach production.
Example: A penetration test using AI-generated identity documents triggers your synthetic identity detection controls during the simulated account opening process.
12. Define Trust Score Transparency for Customers
Determine what you'll communicate when requiring step-up authentication. Balance fraud prevention (don't reveal detection methods) with customer experience (explain why verification is needed).
Example: Your step-up prompt says "We noticed unusual activity and need to verify your identity" rather than "Your trust score dropped due to device fingerprint mismatch."
Common Mistakes
Treating Continuous Trust as Point-in-Time Verification with More Frequency: Running the same KYC checks monthly doesn't create continuous trust. You need behavioral analysis that detects deviation from established patterns, not repeated static verification.
Setting Trust Thresholds Without Cross-Functional Input: Security teams setting score thresholds in isolation create customer friction. Fraud teams have pattern data; compliance teams know regulatory tolerances. Combine their expertise.
Failing to Account for Legitimate Behavioral Changes: Customers travel, buy new devices, and change addresses. Your trust decay should distinguish between suspicious changes (simultaneous email and phone updates) and expected ones (login from a location matching a recent flight purchase).
Over-Relying on Device Fingerprinting Alone: Attackers can spoof device characteristics. Device signals are one input to trust scoring, not a definitive identifier.
Ignoring Trust Score Drift: If 80% of your transactions trigger step-up authentication, your thresholds are miscalibrated. Monitor false positive rates and adjust scoring algorithms based on confirmed fraud cases.
Next Steps
Start with items 1, 4, and 7 (behavioral baselines, synthetic identity indicators, and dynamic trust scoring). These create the foundation for continuous assessment without requiring new authentication infrastructure.
Then implement step-up triggers (item 8) that use your existing Multi-Factor Authentication systems. You're not replacing your authentication methods; you're making them contextually adaptive.
Document your trust framework decisions. When examiners ask how you're addressing AI-driven identity fraud (and they will, given FinCEN's warnings), show them your behavioral monitoring controls and trust decay policies. Point-in-time verification won't satisfy that question much longer.
