The digital onboarding has revolutionized how companies buy customers but has also opened up new opportunities for fraudsters. Understanding attack vectors and how to fight back is crucial to protecting your business and your customers.
The Scenario of Fraud in Mexico
Identity fraud in Mexico has grown exponentially with the digitization of financial services. The most common modalities include:
Identity theft
Using document and data from real people without their consent to open accounts or apply for credit.
Fakes
Credentials of electors, passports or altered or completely built with fictitious data.
Deefakes
Synthetic videos generated with AI that suppress the appearance of real people to mislead biometric checks.
Synthetic identity
A combination of real and fictitious data to create identities that do not belong to any real person.
Economic impact:
According to the Condusef, complaints about potential identity theft in Mexico have increased by more than 50% in recent years. The average cost for an incident of fraud can exceed $50,000 pesos, without counting the reputational damage and operational costs of research.
Capes of defence: A comprehensive approach
Effective fraud prevention requires multiple layers of protection that work as a whole:
1Verification of documents
First line of defence that analyzes the authenticity of the identity document:
- • Detection of physical and digital alterations
- • Verification of safety elements (holograms, UV, microprinting)
- • Validation of document format and structure
- • Automatic data collection (OCR) with consistency validation
- • Real-time consultation with official databases (INE, RENAPO)
2Biometric monitoring
He confirms that the person submitting the document is his legitimate holder:
- • Facial Comparison between Selfie and photo of document
- • Liveness detection to confirm physical presence
- • Detection of deepfakes and digital manipulations
- • Multicatch consistency analysis
3Validation of data
Cross information against multiple sources to detect inconsistencies:
- • Monitoring CURP against RENAPO
- • Validation of RFC with SAT
- • Consultation of blacklists and sanctions
- • Verification of home voucher
- • Detection of synthetic or inconsistent data
4Performance analysis
Detects suspicious patterns during the onboarding process:
- • Abnormal tightness of complete process
- • Multiple attempts from the same device
- • Geolocalisation inconsistent with declared data
- • Typical browsing patterns of bots or scripts
- • Unusual registration hours
Warning signs (Red Flags)
Your system should be set up to detect these warning signs:
| Category | Warning sign | Level of risk |
|---|---|---|
| Document | Photo of document blurred or cut | Medium |
| Document | INE reported as missing or stolen | Stop |
| Biometric | Low facial coincidence with document | Stop |
| Biometric | Life-proof failure | Stop |
| Data | CURP does not match document information | Stop |
| Data | Disposable electronic mail | Medium |
| Behave | Multiple failed attempts at verification | Medium |
| Behave | VPN or proxy detected | Medium |
Mitigation strategies
Real-time verification
Valids documents and identities against official databases at the time, not after.
Multifactor Authentication
Combines something that the user has (phone), you know (OTP) and is (biometrics).
dynamic risk scouting
Assign multiple-sign risk scores and adjust controls with level.
Continuous monitoring
Don't stop at onboarding. Monitoring post-registration transactions and conduct.
Security and experience balance
The greatest challenge is to implement robust controls without creating excessive friction for legitimate users.
- Additive friction: Intensified controls only when risk signs are detected
- Passive verification: Using technologies that require no additional user actions
- Clear Feedback: When something's wrong, explain how to solve it.
- Multiple attempts: Retries with improved guide before rejecting
Key monitoring technologies
Approval rate
Percentage of users that successfully complete onboarding
Fraud rate found
Unlocked fraud attempts vs. total applications
Positive misconduct
Legally rejected users
Verification time
Average length of onboarding process
Compliance and documentation
Beyond preventing fraud, you have to be able to prove your due diligence:
- Keep evidence from every check (images, results, timprints)
- Documents decisions approving or rejecting
- Keep auditory login from the whole process
- Implement clear climbing policies for suspected cases
- conduct regular monitoring performance audits
Conclusion
The prevention of digitally onboarding fraud isn't a one-time project but a continuous process of improvement. The fraudsters are constantly evolving their technologies and your defense should be evolving with them. Investing in robust identity monitoring technologies is best protection from financial losses and reputable damage.