Late last year, a Veriff Verification Specialist was reviewing a routine identity check when something caught their eye: a handler – the person operating the accounts behind the scenes –, visible in a reflection in the session's media. That one detail uncovered a collusion scheme of more than 500 accounts. All of them ran on the same devices under different identities.

No single check would have caught it. Viewed alone, each session could pass. The pattern gave the ring away: the same hardware turning up again and again behind hundreds of "different" people.

That's how organized fraud works now. The ring doesn't build one account. It builds an identity it can reuse.

Rings don't start with money. They start with identity: credentials stolen by malware, leaked in breaches, or combined into synthetic personas. Once an identity works, the ring keeps using it. It gets tested on one platform, refined, then used again elsewhere.

One compromised identity can open a fintech account, move funds through a crypto exchange, then show up on a marketplace to cash out. Each business along the way sees only its own part. Only the ring sees the whole path.

Inside a single business, this is what Veriff CrossLinks does. It uses document, device, network, and behavioral signals to flag links between sessions that may point to a high-risk user or a fraud ring. FaceBlock works alongside it: once you’ve identified a fraudster, their facial biometrics go on your blocklist, so repeat attempts at your business are stopped automatically.

Source link