Late last year, a Veriff Verification Specialist was reviewing a routine identity check when something caught their eye: a handler – the person operating the accounts behind the scenes –, visible in a reflection in the session's media. That one detail uncovered a collusion scheme of more than 500 accounts. All of them ran on the same devices under different identities.
No single check would have caught it. Viewed alone, each session could pass. The pattern gave the ring away: the same hardware turning up again and again behind hundreds of "different" people.
That's how organized fraud works now. The ring doesn't build one account. It builds an identity it can reuse.
Identity is what fraud rings trade in
Rings don't start with money. They start with identity: credentials stolen by malware, leaked in breaches, or combined into synthetic personas. Once an identity works, the ring keeps using it. It gets tested on one platform, refined, then used again elsewhere.
One compromised identity can open a fintech account, move funds through a crypto exchange, then show up on a marketplace to cash out. Each business along the way sees only its own part. Only the ring sees the whole path.
What it took to expose the ring
In the 500-account case, three kinds of analysis worked together:
- Link analysis connected sessions that looked unrelated.
- Device and network fingerprinting showed that "different" users were on the same hardware.
- Behavioral anomaly detection, plus a trained human eye, caught what automation alone might have missed.
Inside a single business, this is what Veriff CrossLinks does. It uses document, device, network, and behavioral signals to flag links between sessions that may point to a high-risk user or a fraud ring. FaceBlock works alongside it: once you’ve identified a fraudster, their facial biometrics go on your blocklist, so repeat attempts at your business are stopped automatically.
Seeing across organizations
Within one platform, that pattern recognition is powerful. But most rings don't stay on one platform.
That's why Veriff built Industry CrossLinks. It draws on Veriff's global customer network to uncover fraud patterns and block repeat offenders across different organizations. It does this through privacy-preserving technical signals – no personal data or customer identity is shared between organizations. A fraudster caught at one business doesn't start fresh at the next.
After Money20/20
Veriff sponsored Money20/20 USA in Las Vegas this year, and our fraud experts spent four days meeting payments, fintech, and marketplace teams. The setting fit the problem. Thousands of businesses that serve many of the same customers were in one building, and fraud rings target them in exactly the same way: one platform after another.
Fraud rings already work across organizations. The defenses should too. Turning one business's catch into another's early warning shouldn't be optional. It should be a standing requirement.
Secure your copy of the Veriff Identity Fraud Report today and stay one step ahead of the latest fraud trends, tactics, and insights shaping the industry.
