Step 1
The customer opens the form
The Web SDK or the in-app SDK starts together with the application or registration form. From that moment the session records the device, typing rhythm, pastes and time spent on each step.
Behavioral analysis and linked-account detection in anti-fraud
A fraudster with a genuine passport passes the document and face check. What gives them away is something else: how they fill in the form, what device they came from, and how many accounts are already linked to that device, phone number or card. NeuroVision collects these signals in every session and passes them to your rules together with the KYC result.
- Behavior, device and network in every session
- Links between accounts without face recognition
- Cloud in Russia or your own environment
Behavioral anti-fraud: what you can see when the document and face are fine
Anti-fraud based on documents and biometrics answers whether the passport is genuine and whether a live person is in front of the camera. Behavior and device answer a third question: is this person coming in honestly, and is it not their first time. For the overall scheme, see — on the anti-fraud page.
-
A genuine passport, someone else’s application
A money mule brings their own document and passes Liveness. The form is filled in for them by a handler: the data is pasted from the clipboard in seconds, and the same device has already submitted applications under other names.
-
One farm, hundreds of accounts
Farms register accounts by hand on different numbers and documents. What stays common is the devices, the network, the payout details and an identical form-filling rhythm.
-
A bot or an emulator instead of a phone
A script fills in the form with no pauses or movements, an emulator gives itself away by its system parameters, and a virtual camera substitutes the video stream. This is visible even before the document check.
-
Not transaction monitoring
This is about login, application and account. The transactions of an already served customer are checked by fraud monitoring, and links between accounts in transactions are handled by — KYT.
Session signals: behavior, device, network and attempt history
The signals are collected by the Web SDK or the app SDK while the scenario is running. You do not need to request them separately: they arrive in the session data next to the document and face result. You add your own signals — from your backend and bot protection — to the same rules.
- Typing rhythm and time spent on each step of the scenario
- Data pasted from the clipboard instead of typed
- Mouse movements and touches: a person or a script
- Device and browser fingerprint in every session
- Emulator, virtual camera, video stream substitution
- A document photographed from another device’s screen
- Owner, activity and phone number lifetime
- IP address, VPN, proxy, network country
- Disposable email addresses
- A series of failed shots — the session is blocked
- Different documents or people in one session
- All sessions of one user by their ID on your side
Linked-account search: six matches that the graph is built from
Each new session is compared with your company’s past sessions. A match on one attribute is a reason to take a closer look; on several at once — a reason to investigate. The face does not take part in the link search.
-
One device
The device and browser fingerprint has already appeared in sessions under other names. The most common trace of a farm and a mule handler.
Matched on:
-
One phone number
The number is already linked to another account or registered to someone other than the person filling in the form. A fresh SIM card strengthens the signal. Phone check.
Matched on:
-
One document
The passport number has already appeared in another session or is on your stop list. It helps when a person changes their number and email. Passport validity.
Matched on:
-
One set of payout details
The card or wallet for withdrawal is the same across several accounts. The details are passed by your system — the graph weighs them equally with the rest.
Matched on:
-
One network and one time
A batch of registrations from one network in a short time. A shared address proves nothing by itself — in an office or a family it is shared too.
Matched on:
-
One filling style
The same typing rhythm, the same pauses, the same sequence of actions across different “people” — a sign that one operator is filling in the forms.
Matched on:
From the first click to the decision: three steps of a behavioral check
Behavioral signals are collected silently — an honest customer does nothing extra. Extra steps appear only for those whose session looks risky.
Step 2
The session is compared with past ones
The fingerprint, number, document and payout details are checked against your company’s past sessions. The response contains the links found, their number and the attribute they were found by.
Step 3
Rules choose the action
Your rules decide: let through, ask for the document and Liveness again, or send the application to an analyst. The analyst sees all linked sessions on one screen.
A shared device, number or passport: how to read a link that has been found
-
One weak attribute
A shared network or a shared popular phone is common: a family, an office, a student dormitory. Such a signal raises the weight of others but does not stop the application on its own.
-
A strong attribute
A shared document or shared payout details under different names almost always mean that one recipient of the money is behind the accounts. It makes sense to stop the payout and investigate.
-
A combination of attributes
One device, fresh numbers, an identical filling style and a shared withdrawal card — the picture of a farm. The decision on the whole group is made by an analyst, not by an automatic rule.
The graph shows that accounts are linked, not who is behind them. If you need to make sure you are dealing with the owner of the document, the customer goes through the document and Liveness again: the face is matched only against the photo in that document.
Clicks, device and Federal Law 152-FZ: why behavior is not biometrics
Behavioral and technical signals are personal data if they can be linked to a person. They become biometric only when they are used to establish identity. We use them to assess session risk, not to recognize a person.
Personal data
If the signal is linked to an account
Personal data is any information that relates, directly or indirectly, to an identified or identifiable person. The device fingerprint and behavior in a specific customer’s session fall under it — process them under the general rules of the law.
Not biometrics under Art. 11
Unless identity is established
Biometric personal data is information about physiological and biological characteristics that can be used to establish identity and that the operator uses for that purpose. Typing rhythm as a session risk signal is not used to establish identity.
Legal basis and consent
The operator decides — your company
The legal basis for processing is chosen by the operator: a contract initiated by the customer, consent or another basis under the law. If the basis is consent, from 1 September 2025 it is given separately from other documents.
The decision — with the person
Not by automation alone
A decision that produces legal consequences cannot be made solely on the basis of automated processing without the person’s written consent. A link in the graph is a reason for rules and an analyst, not a verdict.
The face is separate
Under the biometrics law
We do not build links by face. A match against your company’s list of faces is shown only as a candidate: the employee sees the snapshot from the session and the photo from the list and decides. Matching a selfie to the photo in the document and Liveness work as usual.
152
Legal entities and sole proprietors only, under a contract · Data in Russia
A family with one router and a shared office laptop: false links without blocks
Every session — with the reason for the decision
The more signals, the higher the risk of cutting off an honest customer. Behavioral anti-fraud pays off when it tells a farm from a family.
- 01
Weight, not a veto
No single behavioral signal rejects on its own. It adds weight to the session risk, and you set the threshold and the action.
- 02
A step up instead of a rejection
A suspicious session gets an extra step: a document, Liveness or a number check. An honest customer passes it in a minute, a farm does not.
- 03
Your own exceptions
Corporate networks, points of sale and partner devices are marked by you as trusted — links through them do not raise the risk.
- 04
Reason log
For each session you can see which signal fired and which rule chose the action. This is needed both for handling a customer complaint and for tuning thresholds.
- up to 6 free attempts per step
- 3 actions: let through, extra step, send to analyst
- 1 session one person
Application farms, bonus hunting, mules: where linked accounts cost money
-
Microfinance and fintech
- A repeat application after a refusal under another name, farms of applications for a first interest-free loan, mules with handlers.
- Industry page
-
Marketplaces and services with bonuses
- Welcome bonuses and referral payouts across dozens of accounts of one operator. Links by device and withdrawal card.
- Industry page
-
Bookmakers
- Multi-accounts for free bets and limit evasion. Each has their own document, while the device and wallet are shared.
- Industry page
-
Online games and esports
- Smurf accounts, account boosting for sale, botters. A script’s style and an emulator are visible in the session.
- Industry page
-
Banks
- Online applications for cards and loans, internet banking login from a new device. Transactions after login — in fraud monitoring.
- Industry page
-
Crypto services and exchangers
- A network of accounts to evade limits and for transit. Links by device complement the check of wallet addresses.
- Industry page
The price of behavioral analysis and link checks
No subscription fee for checks: you pay for the ones performed. Behavioral analysis and the link graph are priced by session volume and installation option.
Behavior, device and links
on request
depends on the number of sessions per month, channels (website, app) and cloud or on-premise installation
Phone check
from ₽5 each
Phone and document
Phone check — from 5 ₽ each: owner, activity, number lifetime. Document with anti-fraud — from 16 ₽, with Liveness — from 29 ₽. “16 in 1” by passport — ₽50. Learn more — price matrix.
Modules are enabled individually
Test period — 1 month on a real flow.
- Behaviour
- Device
- Emulators
- Link graph
- Phone
- Document and Liveness
Integration: signals from the Web SDK, the app and your backend
Behavioral signals are collected by the same SDK that guides the customer through the document and Liveness. No separate integration is needed for behavior.
Terms
Test period — 1 month; payment for completed checks; session data retention is set in the scenario; personal data deletion — on request via the API.
Device fingerprint, farm, emulator: a glossary of behavioral anti-fraud
A short guide to the terms you will meet in the rules and the session report.
- Behavioral analysis
- Risk assessment based on how a person acts in a session: typing rhythm, pastes, movements, time spent on steps.
- Behavioral analytics
- Behavioral biometrics
- Recognizing a person by their typing style, mouse movement or touches. In NeuroVision anti-fraud these signals assess risk, not identity. Learn more in the article.
- Behavioral biometrics
- Device fingerprint
- A set of device and browser parameters by which sessions from one device can be linked together.
- Device fingerprint
- Linked accounts
- Accounts under different names with a shared device, number, document or payout details.
- Linked accounts
- Link graph
- A diagram where accounts are points and shared attributes are lines between them.
- Link graph
- Account farm
- Mass creation of accounts by one operator, by hand or with scripts, for bonuses, loans or resale.
- Account farm
- Emulator
- A program that pretends to be a smartphone on a computer or a server.
- Emulator
- Video stream substitution
- Submitting a recorded or generated video to the check instead of an image from the camera. Deepfake protection.
- Injection attack
- Step up
- An extra check only for a risky session: a document, Liveness or a number.
- Step-up
- Biometric personal data
- Information about physiological and biological characteristics used to establish identity (Art. 11 of Federal Law 152-FZ).
- Biometric data
Read also
How to build anti-fraud on risk signals without losing honest customers — in our blog.
42 27
Anti-Fraud, Liveness and Deepfake Protection
Behavioral Biometrics: Keystroke Dynamics and Touch Dynamics Combined With Mouse Movement Analysis
444 19
Anti-Fraud, Liveness and Deepfake Protection
Fraud Metrics: How to Measure the Effectiveness of an Anti-Fraud Architecture
385 10
Anti-Fraud, Liveness and Deepfake Protection
Anti-fraud: what it is and how to prevent online fraud
35 27
KYC, AML and Digital Identification
Invalid Passport: 12 Grounds Under the Law, How to Check, and What a Company Should Do
Frequently asked questions about behavioral analysis and linked accounts
It is a risk assessment based on how a person goes through the form and session: typing rhythm, pastes from the clipboard, movements, time spent on steps, device and network. Such signals catch fraudsters whose document and face are fine.
The document and Liveness answer whether the passport is genuine and whether the person is alive. Behavior and device answer whether they came in honestly and are not linked to other accounts. In NeuroVision all three layers work in one session. The overall anti-fraud scheme.
A new session is compared with your company’s past sessions by device fingerprint, number, document, payout details, network and filling style. The response contains the links found and the attribute they were found by.
No. Links are built without face recognition. A match against your company’s list of faces is shown only as a candidate: the decision is made by an employee who sees both images. Matching a selfie to the photo in the document works as usual. More about the law.
No. The signals are collected by the SDK while the customer fills in the form. An extra step — a document, Liveness or a number — appears only for a risky session.
Yes. The session receives emulator and virtual camera indicators, and Liveness separately checks for video stream substitution. Deepfake protection.
It should not. A shared network is a weak attribute: it adds weight but does not stop the application. You mark trusted networks and devices yourself, and the decision on a group of accounts is made by an analyst.
Under Art. 11 of Federal Law 152-FZ, biometrics is information about physiological and biological characteristics that the operator uses to establish identity. Session signals are not used for that. But they are personal data if they can be linked to a person.
You, as the operator, determine the legal basis for processing: a contract initiated by the customer, consent or another basis under the law. If the basis is consent, it is given separately from other documents.
This is about login, application and account. The transactions of an already served customer are checked by fraud monitoring, and links between accounts in transactions — by KYT.
Behavioral signals are collected by the same Web SDK or the SDK for iOS and Android that guides the customer through the document and Liveness. The result arrives by webhook, the status — via the API. Installation — in the cloud in Russia or in your environment. Documentation.
Behavioral analysis and the link graph — on request, based on session volume. Phone — from ₽5 per check, document — from ₽16. Test period — 1 month on a real flow. Price matrix.
We will find linked accounts in your application flow
Tell us where you are losing money — on bonuses, loans, payouts or registrations — and how many sessions you have per month. We will pick the signals, set up the rules and give you test access.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
