Overview

Non-document fraud signals that assess identity risk from an IP address, email address, and phone number — adding a passive, low-friction layer to document and biometric verification.

---

Document and biometric verification confirm that a person holds a genuine identity document and matches it. Fraud prevention signals answer a different question: does the surrounding context look legitimate? These checks analyze the digital attributes a person presents during onboarding or authentication — their IP address, email address, and phone number — to estimate risk before, during, or alongside document verification.

Because they run on data the user already provides, these checks are typically passive and low-friction: they add little or no extra effort for legitimate users while surfacing risk that a document scan alone cannot detect, such as synthetic identities, location spoofing, or account-takeover attempts.

These are non-document checks. They complement — rather than replace — document and biometric verification, and are most effective when combined as part of a layered (defense-in-depth) approach.

How non-document signals fit into a verification journey

Non-document signals are commonly used in three ways:

• Pre-checks — Run early in a journey to filter out obvious fraud (for example, a disposable email or a datacenter IP) before spending time and cost on document capture.

• Risk scoring — Combined into an overall risk assessment that informs an allow, deny, or manual-review decision.

• Step-up triggers — When a signal looks risky, the journey can require additional verification (such as document capture or biometrics) instead of failing outright.

The signals covered in this section

IP Geolocation

Email Intelligence

Phone Intelligence

Why a layered approach matters

No single signal is conclusive on its own — a VoIP phone number or a VPN connection is not proof of fraud, and many legitimate users have both. The value comes from correlation: when several signals disagree with each other or with the identity being claimed (for example, an IP in one country, a phone number registered in another, and a recently created email with no history), confidence in the risk assessment rises. Layering these signals reduces both fraud losses and false rejections of genuine users.