Your fraud prevention toolkit likely includes transaction monitoring and account takeover alerts. However, if you're waiting until after account opening to start fraud detection, you're already behind. New-account fraud requires a different control framework, one that starts the moment an application form loads.
This checklist outlines the technical and procedural controls you need to detect synthetic identities, bot-driven applications, and credential stuffing before fraudulent accounts enter your system.
What This Checklist Covers
You'll implement a layered verification approach that combines static identity checks with dynamic behavioral analysis. Each item addresses a specific attack vector: document forgery, automated form submission, identity element reuse, and legitimacy-building through non-financial accounts.
This isn't about adding friction. It's about deploying the right friction at the right moment in your application flow.
Prerequisites
Before you start, confirm you have:
- Application flow instrumentation: Your forms must capture keystroke dynamics, mouse movements, and submission timing.
- Identity verification vendor evaluation criteria: Understand what "dynamic verification" means in your RFP (live video, liveness detection, document authenticity checks).
- Cross-application correlation capability: Detect when the same identity elements appear across multiple applications.
- Customer communication plan: Explain why you're requesting video verification or additional steps.
Checklist Items
1. Implement behavioral analytics on application forms
Deploy keystroke pattern analysis and form interaction monitoring. A three-page bank account application completed in two seconds indicates bot activity.
What good looks like: Your system flags applications with submission times under human-possible thresholds and identifies identical typing patterns across multiple submissions. You can distinguish between autofill (legitimate) and scripted form population (suspicious).
2. Add dynamic identity verification to static document checks
Static verification, like scanning a driver's license, is easily circumvented by AI-generated documents. Layer in live verification: require the applicant to hold their license next to their face on video, then perform an action.
What good looks like: You're using both document verification (checking security features, format consistency) and liveness detection (confirming a real person is present). Your vendor can detect deepfakes and pre-recorded video loops.
3. Screen for identity element reuse across applications
Monitor whether the same photograph, date of birth, or Social Security number appears in multiple applications within a short timeframe. Fraudsters use pieces of real PII to establish multiple accounts.
What good looks like: Your system maintains a rolling window (30-90 days) of identity elements from all applications. When a Social Security number appears in three applications in one week, you trigger manual review before any account opening proceeds.
4. Verify legitimacy of supporting digital accounts
Check the age and activity patterns of email addresses and phone numbers provided during application. Newly created email accounts with no established history often indicate fraud setup.
What good looks like: You're querying email age, domain reputation, and whether the email has been seen in previous fraud incidents. Phone numbers are checked against VOIP databases and compared to the applicant's stated location.
5. Integrate AI-based document authenticity detection
Human reviewers can't reliably distinguish AI-generated identity documents from legitimate ones. Deploy AI tools that analyze document structure, font rendering, and security feature placement.
What good looks like: Your vendor provides a confidence score for each submitted document. Scores below your threshold trigger secondary verification. You're not relying on visual inspection alone.
6. Establish cross-institutional data sharing for new-account patterns
New-account fraud detection requires collaboration. Work with identity protection service providers and industry consortiums to share (anonymized) fraud patterns and compromised identity elements.
What good looks like: You participate in at least one fraud intelligence sharing network. When a synthetic identity is confirmed at another institution, you receive an alert if that identity has applied at yours.
7. Deploy credit freeze monitoring and PII exposure alerts
While this is consumer-facing, prompt applicants to verify their credit isn't frozen and offer dark web monitoring for their information. This creates a partnership model.
What good looks like: During application, you inform applicants about free credit freeze services and identity monitoring. You track whether applicants who fail verification had recent PII exposure events.
8. Build fraud cost modeling to justify AI investment
Calculate your current new-account fraud losses, regulatory fine exposure, and customer remediation costs. Compare this to the cost of AI-based verification tools integrated into your existing tech stack.
What good looks like: You have a documented business case showing that AI tools, which integrate with your current application platform, cost less than back-end fraud losses, chargebacks, and regulatory penalties.
Common Mistakes
Waiting until onboarding to start verification: Detection must start when the form loads.
Assuming static checks are sufficient: AI-generated documents and background-check-sourced PII defeat static verification. You need dynamic, real-time validation.
Treating friction as universally bad: Customers accept verification steps when you explain the protection they provide. The friction isn't the problem, unexplained friction is.
Ignoring vendor integration claims: Verify API compatibility, data flow, and latency impact. Test integration before procurement.
Overlooking identity element correlation: A single application might look legitimate. Five applications in one day using variations of the same name and birthdate is a pattern, but only if you're looking across applications.
Next Steps
Start with behavioral analytics and dynamic document verification, these address the highest-risk gaps in static identity checks. Then build out cross-application correlation and identity element reuse detection.
You don't need to deploy all eight controls simultaneously. But you do need to accept that new-account fraud detection is now a partnership across institutions, service providers, and customers. Static identity verification belonged to an era when fraudsters worked manually. That era is over.
