Digital Account Onboarding: The First Defense Against Fraud

In today’s increasingly digital world, financial institutions are looking to unlock new growth opportunities through improved customer convenience and experience. Digital account opening has become a popular way of pursuing these opportunities. However, this shift brings fraud risks that need careful management.

Recent data breaches have placed massive amounts of personal information into criminals’ hands that they can use in digital onboarding processes. Generative artificial intelligence (AI) tools also have made creating fake digital documents and synthetic identities easier and more effective. In addition, bots and automated scripts can help criminals attempt high-volume account openings that exploit onboarding weaknesses and overwhelm financial institutions’ systems.

Unlike in-person onboarding — where staff can verify physical documentation or use face-to-face interaction to evaluate customer risk — digital channels lack these safeguards.

Pre-Onboarding

Criminals often use bots and automated scripts to attempt digital account openings or gather intelligence on a financial institution’s account opening procedures. In doing so, they may inadvertently give off risk signals indicating they are likely to be suspicious actors. Behavioral analytics tools can be used to evaluate the user’s keystroke speed, mouse movements, or use of frequent copying and pasting, which can provide meaningful clues as to whether the user is human.

Device and network-based signals, such as time zone, geolocation, IP address, device hardware specifications and software/browser configurations, can be analyzed for indications about whether the user is legitimate. Does the user’s geolocation match the customer address provided? Is the actor using a virtual private network (VPN)? Has the device already been used in multiple prior account opening attempts? Examining these device and network-based signals can help financial institutions make a risk-based determination about whether a user is likely to be a legitimate customer.

Identity Verification: Going Beyond Legacy Processes

Robust identity verification is a key aspect of new account fraud prevention, whether conducted in person or digitally. Rather than relying on the verification of physical documents or face-to-face interactions, digital identity verification relies heavily on remote tools, such as document uploads, biometric checks and third-party data validation. Each of these methods can be used to infer information about the legitimacy of the applicant’s identity and whether the application is fraudulent.

Organizations should determine whether the individual or organization opening the account is a real person or business and whether their claimed identity is their actual identity. With the help of third-party vendors, financial institutions can consider how to best implement additional security methods, such as documentation verification, liveness checks, device assessments, and/or verification of identity attributes (e.g., email address, phone numbers). In choosing which specific method(s) to employ, organizations should consider the level of user interaction (e.g., a liveness check requires more user interaction than the verification of identity attributes), cost, their risk tolerance and the sophistication of their systems.

Post-Onboarding

Once an account has been created, it is important for organizations to continue to monitor the account and customer transactions for anomalies or suspicious activity. Financial institutions may consider additional controls for digitally opened accounts that were determined to be “high risk” during the onboarding process. For example, controls could include lower transaction limits, delayed funds availability, transaction friction, or enhanced monitoring rules during the early life of the account. Organizations also may consider monitoring new accounts opened digitally to check whether bots or automated scripts are being used to access these accounts, which could be a signal of fraudulent intent.

For any new account, whether opened digitally or in person, it is important to consider that criminals often wait extended periods of time before they attempt fraudulent activity using the account. During this time, they may attempt to “season” the account with benign activity or have interactions with customer service. After some months, criminals then may begin to monetize the account by applying for loans/credit or depositing forged checks or funds obtained via scams. Ongoing transaction and account monitoring is important to detect potential anomalies even after the account can no longer be considered “new.” Financial institutions also can conduct periodic analyses to identify accounts that have been dormant or with limited activity. Both are potentially indicators of money mules (people who transfer illegally acquired money on behalf of someone else).

Next Steps

Addressing the fraud risks associated with digital account opening is important to help minimize customer and organizational losses and maintain customer trust. Financial institutions have a range of approaches and tools to consider in adopting appropriate fraud controls to enable digital account opening safely, such as behavioral analytics, device signals, robust identity verification, and continuous account and transaction monitoring. By leveraging diverse risk signals across the account lifecycle and tailoring controls to the digital environment, financial institutions can better manage new account fraud, synthetic identity fraud, money mules and other risks associated with digital account opening.

Additional Resources

Synthetic Identity Fraud Mitigation Toolkit | Fedpayments Improvement
Scams Mitigation Toolkit | FedPayments Improvement
New Account Fraud and Digital Account Openings | Federal Reserve Financial Services (Off-site)

Stay Connected

Keep informed about the Fed’s efforts to support payment security and mitigate fraud by joining the FedPayments Improvement Community.