What does the warning 'Suspicious Behaviour' indicate?

When reviewing identity verification results, you may occasionally encounter a 'Suspicious Behaviour' warning. This flag is generated by our verification vendor to signal potentially fraudulent activity that warrants further attention before approving the case.

What Triggers the 'Suspicious Behaviour' Warning?

The warning is issued when a document or user interaction is linked to an exceptionally high fraud risk score. This risk score is calculated based on a number of behavioural and data-driven signals, including:

1. Document-Based Risk

• Use of digitally altered or forged IDs

• Previously blacklisted documents or formats

• Suspicious metadata in the uploaded document (e.g., unusual image properties, tampering attempts)

2. Device & Network Indicators

• Multiple verification attempts from the same device or IP address across different platforms within a short timeframe

• Use of known fraudulent or flagged devices

3. Historical Patterns

• Use of identical documents by multiple users

• Previously flagged or declined verifications from the same IP/device/email address

What Should You Do?

When a 'Suspicious Behaviour' warning is raised, it's best practice to:

1. Request an alternative ID document from the user.

2. Manually review the flagged case in detail.

3. If needed, reach out to the end user for clarification.

4. Escalate the case internally to your compliance team for review.