Identity fraud does not end when a customer passes onboarding. Criminals may create an account with stolen evidence, take control of a legitimate account later, manipulate profile information, or exploit recovery procedures after trust has already been established.
Digital businesses therefore need to maintain identity confidence throughout the customer lifecycle. Face++ supports this approach through document checks, OCR, 1:1 face comparison, liveness detection, and risk controls that can be applied during onboarding, login, sensitive activity, and account recovery.
1. Onboarding: Fraud Enters the Customer Relationship
Onboarding establishes the original relationship between a person, their identity evidence, and an account. If fraudulent information is accepted at this stage, every later decision may rely on an untrustworthy reference.
Common onboarding risks include:
- Stolen or altered identity documents
- Portrait substitution
- Synthetic identity information
- Deepfake or injected facial media
- Printed-photo and screen-replay attacks
- Repeated account creation using related identities
- Inconsistencies between submitted and encoded data
A layered workflow should evaluate document quality, authenticity, extracted fields, facial similarity, genuine presence, device risk, and application context.
Face++ 1:1 face comparison determines whether the current face and document portrait are likely to belong to the same person. Liveness detection separately evaluates whether the sample comes from a live person rather than a photograph, video, or mask.
2. Login: Valid Credentials Do Not Confirm the User
After onboarding, attackers may obtain passwords, session tokens, email access, or one-time codes through phishing, malware, credential stuffing, or social engineering.
Warning signs can include:
- Login from a new device or environment
- Impossible or unusual geographic activity
- Repeated authentication failures
- Emulator, automation, or injection indicators
- Sudden changes in normal session behavior
- Multiple accounts connected to the same device
Most trusted logins should remain low friction. When risk increases, the platform can trigger step-up face verification against the enrolled reference, together with liveness and device analysis.
This confirms more than possession of a credential: it helps determine whether the person behind the session is the verified account holder.
3. Profile Changes: Redirecting Account Control
Fraudsters often change contact details before attempting financial abuse. Replacing an email address, phone number, password, payment account, or recovery channel can weaken the legitimate customer’s control while strengthening the attacker’s position.
Higher-risk changes may include:
- Replacing multiple contact fields in one session
- Adding a new withdrawal or payment destination
- Updating information from an unfamiliar device
- Changing recovery settings immediately after login
- Modifying personal data that conflicts with the verified identity
Platforms should assess the requested change together with device history, authentication strength, customer behavior, and identity confidence. Sensitive changes can require a fresh face comparison and liveness check before becoming effective.
4. Transactions: Identity Risk Becomes Financial Risk
A legitimate account can become fraudulent after takeover. Alternatively, an account created by a fraud ring may initially behave normally before being used for credit abuse, money movement, marketplace fraud, or withdrawal.
Transaction-related identity risk may rise when the customer:
- Adds an unfamiliar beneficiary
- Initiates an unusually large transfer
- Changes payment details before withdrawal
- Uses several connected accounts
- Acts outside established behavioral patterns
- Combines a new device with a sensitive transaction
Step-up verification can help reconnect the transaction to the trusted customer identity. However, a successful face match should not automatically approve the transaction. Liveness, device intelligence, transaction context, beneficiary relationships, and account history should also influence the decision.
5. Ongoing KYC: Identity Evidence Can Become Outdated
Identity confidence can weaken over time. Documents expire, customer information changes, business ownership evolves, and previously low-risk accounts may develop new compliance or fraud indicators.
Ongoing controls may be triggered by:
- Document expiry
- Major profile changes
- Beneficial-ownership updates
- New sanctions or PEP information
- Unusual account activity
- Repeated verification failures
- Changes in customer risk classification
Reverification should be proportionate. Some cases may require only updated information, while others may require a new document, fresh face capture, liveness detection, or manual review.
6. Account Recovery: The Attacker Challenges the Trusted Identity
Account recovery is especially vulnerable because the user may no longer possess the normal authenticators. Fraudsters can exploit this process by claiming a lost device, compromised email account, changed phone number, or forgotten credentials.
A stronger recovery workflow can combine:
- Existing account and device history
- Recovery-channel risk
- Trusted identity records
- A fresh facial capture
- Face comparison with the enrolled customer
- Liveness and capture-integrity checks
- Additional evidence or manual review
Face++ FaceID capabilities are designed for identity checks across onboarding, login, and account recovery rather than only initial registration.
7. Cross-Account Relationships Reveal Coordinated Fraud
Reviewing each account independently can hide fraud-ring activity. Several apparently unrelated accounts may share:
- Similar or repeated faces
- Identity documents or contact details
- Devices, networks, or capture environments
- Payment instruments and beneficiaries
- Synchronized behavioral patterns
- Common recovery destinations
Where legally permitted and appropriately governed, 1:N face search can return similar candidates from an enrolled collection, together with confidence information. These results can support investigation into duplicate or connected identities but should not establish fraud on their own.
8. Building Lifecycle-Based Identity Controls
A lifecycle strategy assigns controls according to the event and current risk:
- Low risk: Continue with standard authentication
- Elevated risk: Apply face verification or stronger authentication
- Uncertain identity: Request recapture or updated evidence
- Sensitive event: Combine face match, liveness, and contextual analysis
- Unresolved case: Route to manual review
- Strong combined-risk evidence: Restrict or reject according to policy
The platform should record the trigger, evidence, model version, threshold, and decision. No individual OCR result, face score, device signal, or behavioral anomaly should determine the outcome alone.
9. Frequently Asked Questions
Q1. Is identity verification only required during onboarding?
No. Risk-based identity verification can also protect login, profile changes, transactions, ongoing KYC, and account recovery.
Q2. Does a successful face match prove that an account is safe?
No. It establishes facial similarity, not the legitimacy of the document, capture path, transaction, device, or account behavior.
Q3. How does Face++ support lifecycle identity verification?
Face++ provides capabilities including OCR, 1:1 face comparison, 1:N face search, and liveness detection that can support identity checks at different lifecycle events.
Q4. Should every high-risk event require full document verification?
Not necessarily. Controls should reflect the event, existing evidence, regulatory requirements, and potential impact. Some events may require only face reverification, while others justify renewed document checks.
10. Maintain Identity Confidence Beyond Onboarding
Customer identity is not a permanent one-time result. It is an evolving level of confidence that can strengthen or weaken as devices, evidence, behavior, account control, and risk change.
By integrating Face++ face comparison, liveness detection, OCR, and facial search with document, device, behavioral, and transaction signals, digital platforms can apply stronger verification at the moments where identity risk matters most.
