Step 1
Set the scenario
In your account, pick the checks for each action: registration, first bonus, loan, cash-out. Add a stop list and the number of errors before a block. No development needed.
Anti-fraud at registration and onboarding
Anti-fraud for customer registration: NeuroVision checks the phone, the document and registry data exactly as far as the action is risky. A fraudster never reaches the bonus, the loan or a cash-out, while an honest user signs up without extra steps.
- Phone: owner, activity, number age
- 40+ anti-fraud document checks
- Data stays in Russia
Fraud at registration: what it is and why it is cheaper to stop it at the door
Anti-fraud at onboarding answers one question: should this person be let in. The answer is needed before the account gets money, a bonus or access to buyers.
-
What a fraudulent registration is
An account created not to use the service but to extract a gain from it or to hide someone else's money. Behind it stand someone else's or made-up data, a fresh phone number and, sometimes, not a person but a script.
-
Why a fraudster needs a new account
To get a welcome bonus or a promo code once again, to take out a loan on someone else's passport, to open a wallet for transit of money, to post fake listings and reviews. Registration is the first step of each of these schemes.
-
How this differs from account takeover
In a takeover the fraudster seizes a real account of an honest customer — that is a job for login and transaction monitoring, handled by the KYT. Here we are talking about new accounts that the fraudster creates himself.
-
Why it is cheaper to stop it at the door
At registration the fraudster has no history yet, no money in the account and no buyer complaints. Refusing a new account is easier than later recovering bonuses, collecting a loan and handling complaints.
Detecting fraudulent registrations: five types
Each type leaves its own trace in the data. The trace decides which check to choose — not necessarily the most expensive one.
Money mules
A real person, someone else's money
A real person registers the account, but others will use it — to pass money through or to take a loan. The data and the passport are genuine, so a mule is given away by a number registered to someone else, a fresh number, wanted-persons lists and watchlists. Since 05.07.2025, handing over a card or access to it for unlawful transactions is a criminal offence (Art. 187, parts 3–6, of the Russian Criminal Code, Federal Law 176‑FZ).
Multi-accounting for bonuses
One person — dozens of accounts
Bonus hunting: a welcome bonus, cashback or a promo code is claimed again and again on new numbers and emails. The signals: a short number age, a number that does not belong to the person in the application, a passport already on your stop list.
Stolen data from leaks
A real passport, a different person
A scan or the data of someone else's passport from a leak is put into the application. The passport is valid, but the phone number is registered to someone else, and the document was photographed from a screen or a printout — the document anti-fraud checks show it.
Synthetic identities
Data assembled from different people
A full name from one person, a passport number from another, a purchased phone. The passport validity check shows whether it was issued to this person, and the logical document checks catch mismatched fields.
Bots and account farms
Serial registrations from a template
Scripts create accounts by the hundred, farms do it by hand, but on the same numbers and documents. The first line is your own system (limits, captcha, device); NeuroVision adds number age and activity and blocks the session after a series of failed photos.
5
types of fraudulent registration
Signs of a fraudulent registration and where to get them
Some signals come from NeuroVision, others are already in your system. Good anti-fraud at registration collects both halves.
- The number belongs to the person in the application: a “number — full name” match, a yes / no answer
- The number is currently served by an operator
- Number age: from “under three months” to “over five years”
- The number owner is of legal age — without a passport scan
- The number is confirmed by an SMS code or a call
- Traces of a graphics editor, pasted-in elements, AI generation
- A screenshot, a printout or a photocopy instead of a live document
- MRZ, logical mismatches between fields, the issuing-authority code
- A date of birth in the document outside the allowed age
- The validity of a Russian passport and whether it was issued to this person
- Wanted-persons lists of the Ministry of Internal Affairs, the Federal Penitentiary Service and the Bailiffs Service
- The list of terrorists and extremists, sanctions lists
- A match of the passport and phone with your stop list
- A series of failed photos in one session — protection against brute force
- The account has already been blocked for fraud
- Device, browser, IP address, VPN
- Form-filling speed, mass registrations from one address
- Disposable email addresses
- NeuroVision — the signal arrives in the API response: the result, the source and the time for every check.
- Your system — the signal is already in your backend or bot protection; NeuroVision does not collect it.
- Mobile operator / Ministry of Internal Affairs / Rosfinmonitoring / Your stop list — where the data comes from.
- All registry checks are in the catalogue of AML checks.
NeuroVision checks for the registration form
Each check is connected separately and costs money only when it is run. Start with the phone — it is the cheapest signal and the least visible to the user.
-
Phone number check
Three checks on mobile-operator data: whether the number belongs to the person in the application, whether it is in service and how long it has been in use. The user does nothing — the check runs on the number they have already entered. These checks cannot, and should not, establish a person's identity from a number.
Learn moreMost often enabled:
-
Document anti-fraud
40+ checks of a photo or a scan: security features, logical mismatches, pasted-in elements, traces of a graphics editor, AI generation, capture from a screen and printouts. A document is not requested from everyone — only before an action with money or at high risk.
Learn moreMost often enabled:
-
Passport validity
A Russian passport — through the system of interagency interaction: an expired, replaced, lost or invalid document, as well as a passport issued to another person. The main signal against synthetic identities.
Learn moreMost often enabled:
-
Age confirmation
Two ways: from mobile-operator data — without a passport scan, or from the date of birth in the document — the scenario rejects those outside the set age range. For 18+ services and programmes with age restrictions.
Learn moreMost often enabled:
-
Repeat and serial registrations
The passport and phone are matched against your stop list: a blocked user will not come back with a new number. The scenario blocks the session after a set number of failed photos — so brute-forcing fraudulent images does not work.
Learn moreMost often enabled:
-
Wanted-persons lists, watchlists and sanctions
Wanted-persons lists of the Ministry of Internal Affairs, the Federal Penitentiary Service and the Bailiffs Service, the list of terrorists and extremists, sanctions lists — by passport or by full name and date of birth. Needed wherever money passes through the account.
Learn moreMost often enabled:
Face-to-document matching and Liveness. If at the door you need to be sure that the document is presented by its owner and that a live person is in front of the camera, these checks are described on the pages Anti-fraud platform and Liveness. Face checks involve biometric data; connect them at registration only after consulting a lawyer.
How to prevent fraud at registration: the order of checks
Best practice for onboarding anti-fraud comes down to one rule: cheap and invisible checks for everyone, heavy ones only for those who put your money at risk. This is how you cut onboarding fraud without losing honest users. How to set thresholds and step-up checks — in the article “Risk-based anti-fraud”.
Step 2
Check the phone on the form
While the user fills in the application, the number is checked against operator data: owner, activity, number age. An honest user does not notice it, while a fresh number without an owner goes to the next step.
Step 3
Ask for a document before money
A document and registry data — when the account asks for a loan, a cash-out, a bonus or a trust badge. A document photo in the Web SDK, anti-fraud checks, the passport against the Ministry of Internal Affairs database and watchlists — in one API call.
Step 4
Make the decision
Approve, restrict features or send to manual review — through the API and in the dashboard. The result, the source and the time are saved for every check: the operator can see why a session reached them.
Low, medium, high risk — three sets of checks
-
Low risk
Free registration with no money or bonuses: email, a subscription, an account area. A phone check is enough — number age and activity. The user sees no extra steps at all.
-
Medium risk
A welcome bonus, a promo code, cashback, publishing listings, reviews. Add the number owner, the stop list and age confirmation to the phone if the service is 18+. A document only when signals coincide.
-
High risk
A loan, an instalment plan, a cash-out, a wallet, payouts to a seller. A document with anti-fraud checks, passport validity, wanted-persons lists, watchlists and sanctions. For financial institutions the set is defined by the internal control rules.
The action sets the risk, not the user.
You set the set of checks for each action.
Registration anti-fraud metrics: FAR, FRR and conversion
Three metrics on one dashboard
Registration anti-fraud balances two errors: letting a fraudster through or refusing an honest user. Both must be counted — on the same sample and over the same period; there are no universal “normal” values. More in the article “Fraud metrics”.
- 01
False acceptance rate (FAR)
How many fraudulent registrations the system approved out of all fraudulent ones. It is calculated after the fact — from accounts that later turned out to be fraud: bonus refunds, unrepaid loans, complaints.
- 02
False rejection rate (FRR)
How many honest users were refused or given an extra step. It does not show in fraud reports but turns into lost revenue. It is estimated from support requests and from a sample of refusals checked by hand.
- 03
Registration conversion
The share of those who started registering and reached an active account. Each new check at the door must pay for itself: if conversion drops by more than fraud does, move the check one step later.
- 04
Manual review and time to decision
What share of registrations goes to an operator and how long they wait for a decision. If the queue grows, review the threshold: only disputed cases should reach manual review.
- FAR the false acceptance rate
- FRR the false rejection rate
- CR registration conversion
Fraudulent registrations across industries
The schemes are similar, but the cost of a mistake differs: in one place it is a lost bonus, in another an unrepaid loan.
-
Microfinance
- A loan application on someone else's or a synthetic passport
- Repeat applications after a refusal — with a new number
- Borrower checks for microfinance organisations
-
BNPL and instalments
- A first purchase on instalments with a fresh number
- Mules who take instalments in their own name for others
- BNPL buyer checks
-
Marketplaces
- Re-registration of a blocked seller
- Buyers' multiple accounts for promo codes
- Marketplace seller checks
-
Classifieds sites
- An account on a disposable SIM card for fake listings
- Someone else's passport for a “Verified seller” badge
- Classifieds protection
-
Fintech and payment services
- A wallet for passing someone else's money through
- A number registered to another person
- Payment services and wallets
-
Loyalty programmes
- Bonus hunting: the same people on new numbers
- Cashing out points and cashback through dummy accounts
- Solutions for e-commerce
How much registration checks cost
No subscription fee: you pay only for checks that were run. Cheap checks go to everyone, expensive ones — only to those who got as far as money.
Phone check at registration
from 5 ₽
for each of the checks: owner, activity, number age, age
Document anti-fraud
from 16 ₽. Each next document in a session — from +8 ₽.
16 passport checks — 50 ₽
Passport validity, wanted-persons lists, watchlists, sanctions and 12 more checks — as a package instead of 80 ₽. As volume grows, the price of a document check falls.
Modules are enabled individually
take only what you need
- Phone
- Age
- Document
- Passport via the Ministry of Internal Affairs
- Stop list
- Wanted-persons lists and watchlists
Connecting to the registration form
The checks are built into your registration form: the phone and the data by an API request, the document through a ready widget.
Terms
A 1-month trial on a real flow, a personal manager, ticket-based technical support, payment only for checks that were run.
A response fragment: document anti-fraud checks
JSON"checks": [
{
"caption": "fraud",
"items": [
{ "status": "success", "caption": "isPrinted" },
{ "status": "success", "caption": "isEdited" },
{ "status": "success", "caption": "isDisplay" }
]
}
]A glossary of fraudulent registrations
Terms that come up in anti-fraud reports and in talks with vendors.
- Money mule (dropper)
- A person who registers a card, an account, a wallet or a user account in their own name and hands access to others — most often to pass stolen money through.
- Multiple accounts
- Several accounts of one person in a service whose rules allow only one.
- Bonus hunting
- Registering new accounts for welcome bonuses, promo codes and cashback that are meant only for new customers.
- Synthetic identity
- A set of data assembled from several real people or partly made up: one person's full name, another's passport, a third's phone.
- Account farm
- Mass creation of accounts by hand or with scripts for sale, review padding or repeat bonuses.
- The number's age
- How long a phone number has been used by its current subscriber. A freshly bought number at registration is a risk factor.
- Stop list
- A client's list with the data of those who must not be registered again: people blocked for fraud, debtors, rule-breakers.
- Step-up check
- An additional verification step that is switched on only at high risk or before a risky action.
- FAR
- False Acceptance Rate — the share of fraudsters the system let through by mistake.
- FRR
- False Rejection Rate — the share of honest users the system refused by mistake or gave an extra step.
Read also
Anti-fraud at the door: signals, thresholds and metrics — on our blog.
388 19
Anti-Fraud, Liveness and Deepfake Protection
Fraud Metrics: How to Measure the Effectiveness of an Anti-Fraud Architecture
408 22
Anti-Fraud, Liveness and Deepfake Protection
Anti-Fraud in Document Verification: How to Detect Forgeries and Traces of Editing
367 24
KYC Document Verification
Document verification in KYC: how automatic checking increases the approval rate and reduces the risk of fraud
121 28
Anti-Fraud, Liveness and Deepfake Protection
What Is a Deepfake: How It Works, Why It’s Dangerous for Business, and How to Protect Yourself (2026)
Frequently asked questions about anti-fraud at registration
A short guide to checks at the door: types of fraud, the order of checks, metrics, prices and connection.
It is creating an account with someone else's, forged or made-up data for gain: a bonus, a loan, passing money through or fake listings. The main types are money mules, multiple accounts, stolen data from leaks, synthetic identities and bots. What they share is that the account is created not to use the service honestly.
Distribute the checks by risk. Invisible phone checks — for everyone on the registration form, a document and registry checks — only before a loan, a cash-out or a bonus. That way most users see no extra steps, while a fraudster runs into a check exactly where they want to get money.
Phone number ownership, activity and age, age confirmation, 40+ document anti-fraud checks, Russian passport validity, wanted-persons lists, watchlists, sanctions lists and a match against your stop list. Each is connected separately and paid for only when it is run.
By signals that a multi-account cannot fake cheaply: a fresh number, a number registered to someone else, a passport from your stop list. The check scenario also blocks the session after a set number of failed photos — brute-forcing documents does not work. A 1:N face search is described on the Anti-fraud platform page.
Yes. The mobile-operator checks run on the number and the full name from the application: whether the number belongs to this person, whether it is in service and how long it has been in use. These checks cannot establish identity from a number. The SMS confirmation code stays on your system's side.
Two ways. Without a document — from mobile-operator data: the check confirms the number owner is of legal age. With a document — from the date of birth: the scenario sets the allowed age range, and a document outside the range does not pass.
Registration anti-fraud is the part of the anti-fraud platform that works at the door: the phone, the document, registries and stop lists before the first action with money. The platform adds the face, Liveness and scoring to this. KYT watches the transactions of customers who are already registered. For what anti-fraud is in general, see the article “Anti-fraud: what it is”.
Not always: for free registration and bonuses a phone, a document and a stop list are usually enough. Face-to-document matching and Liveness are needed when it matters that the document is presented by its owner — they are described on the pages Anti-fraud platform and Liveness. Face checks involve biometric data, so connecting them should be agreed with a lawyer.
By four metrics: the false acceptance rate (FAR), the false rejection rate (FRR), registration conversion and the share of manual review. Count them on one sample and over one period, and FAR after the fact, from accounts that later turned out to be fraud. More in the article “Fraud metrics”.
There is no subscription fee. Each phone, age or registry check — from 5 ₽, document anti-fraud — from 16 ₽, each next document in the same session — from +8 ₽, a package of 16 passport checks — 50 ₽. The trial period is 1 month on a real flow.
The phone and registry data — by a REST API request, the document — through the Web SDK, which works on the site, in a mobile browser and, in an app, through a WebView. The result arrives in the API response or as a notification to your address. Scenarios, stop lists and thresholds are set in your account.
In Russia: in the NeuroVision cloud or on your servers when installed in your perimeter. The retention period for session data is set in the scenario.
We will pick the checks for your registration form
Tell us what a new user gets — a bonus, a loan, a wallet or access to buyers. We will propose a set of checks and an order in which honest customers do not wait. We reply within one business day.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
