Fraud solutions that combine identity data, device signals and biometrics for ecommerce fraud prevention

No single fraud check can give you the full picture of a customer. Someone might pass an identity check but still be a fraudster. Equally, suspicious online activity doesn't necessarily mean someone is committing fraud.

That's why it's important to look at different signals together. Combining identity data, device intelligence and biometrics can help you identify suspicious activity more accurately while avoiding unnecessary friction for genuine customers.

Solutions like GBG bring these capabilities together to help ecommerce businesses detect and prevent fraud.

What each fraud prevention layer tells you

When fraud signals tell different stories

Each evidence layer answers a different question, so it’s normal for them to point in different directions. Here’s how to read three of the most common conflicts:

The identity details match, but digital connections look suspicious

A new customer’s name, address and date of birth line up with official databases, but digital signals link the submission to several other accounts tied to high-velocity registrations.

A database match proves the identity exists. It doesn’t prove the applicant hasn’t stolen those credentials.

Connected accounts deserve a closer look, but shared identifiers need careful reading, since shared home networks and family households can link genuine shoppers. Document checks, facial matching, and liveness testing help show whether the applicant actually owns the identity. And even if ownership checks out, you still have a separate question to answer: is the account set up for promotion abuse or another kind of policy misuse?

Read more: Understanding synthetic identity fraud

Digital activity looks ordinary, but the document or selfie has been manipulated

An account might use an established email address and show no obvious red flags online, but the submitted ID or selfie can still be fake.

Forensic document analysis catches altered details, swapped portraits and physical tampering. Facial matching measures how closely the captured face resembles the document portrait, but it can’t tell you whether either image is authentic on its own. 

Presentation attack detection catches attempts to fool the camera, like holding up a printed photo or replaying a video on a screen. Injection attack protection goes a step further, stopping software from bypassing the camera altogether and feeding manipulated video straight into the system.

A clean digital record shouldn’t outweigh direct evidence that a document or selfie capture was altered.

One digital signal looks unusual, but everything else is consistent

Imagine a customer making a purchase from an unfamiliar location or using an IP address shared by lots of other people. At first, that might seem suspicious. But their identity details check out, and there’s nothing else linking them to suspicious activity.

There could be a perfectly reasonable explanation. They might be travelling, using public Wi-Fi, or connecting from a shared workplace or household.

The point is that unusual activity doesn't always mean fraud. Before flagging a customer, look at how concerning the signal actually is and whether other checks support it. If you need more information, focus on what you don't already know rather than repeating checks that have already passed.

What makes combined fraud evidence useful

• Findings have to belong to the same customer and activity: Your risk team needs to know that the identity match, digital assessment, document check, and biometric capture all belong to the same applicant. Timing and context matter too: evidence collected at account creation says little about an account recovery attempt months later. And when results sit in separate tools, spotting contradictions or missing information gets much harder.
• Results need detail behind them: A summary risk score helps you decide which accounts to inspect first, but your team also needs to see what’s driving it. An address mismatch, a suspicious account link, a tampered ID and a failed liveness test are four distinct issues, and knowing which one you’re facing changes what evidence you need next. It also helps you tell deliberate fraud apart from customer error or a temporary technical glitch.

How GBG combines evidence in an ecommerce fraud investigation

Here’s a situation your fraud team could easily run into: several new account signups with different names but overlapping phone numbers and IP addresses. One applicant’s identity details match official records, but you still need to know whether they’re using stolen information or taking part in coordinated promotion abuse. 

GBG Go brings multiple verification layers together to resolve it. Here’s how: 

Identity data shows which details can be corroborated

Multi-source identity verification checks the applicant’s details against trusted global data, with GBG accessing records that cover 4.4 billion people across 195+ countries. If a primary source lacks sufficient records, the system cascades across alternative sources to verify the information.

In this example, the submitted name and address match underlying records. That corroborates the applicant’s details, but it leaves two questions: who owns the credentials, and why are the accounts connected?

Digital intelligence and GBG Trust add context on suspicious connections

Email, mobile and IP intelligence evaluate the applicant’s digital footprint. GBG Trust adds cross-industry identity intelligence from 28+ sectors, surfacing anomalies and high-velocity submissions you wouldn’t see in your own data.

Here, the digital signals give you good reason to inspect the connected registrations, so your team can weigh the database match against evidence of potential account farming.

Document analysis looks at what the applicant actually submitted

Document fraud detection runs 50+ forensic checks on submitted IDs to spot forgery, altered text, or photo substitution. 

A genuine-looking document still doesn’t prove ownership, since a fraudster could be holding someone else’s stolen ID. But you now have clear evidence on document authenticity. 

And because GBG Go workflows are configurable, you can reserve this step for cases where it’s more needed. As GBG’s KYC Specialist Darren Neil puts it, “You don’t have to use that every single time. That’s the beauty of it.”

Facial matching and capture protection address ownership and impersonation

FaceMatch compares the live capture to the document portrait using 68 facial landmarks, and passive liveness confirms a live person is present without asking them to turn their head or blink. Built-in injection-attack protection guards against software bypassing the camera and feeding manipulated media directly into the system.

As such, you get more evidence on if the applicant holds the ID and if the capture is intact.

Pulling findings together in GBG Go

GBG Go feeds each layer’s results into configurable workflows, so you can review the whole case in one place.

For example, if ownership checks out, you can focus on whether the account links point to promotion abuse. And when an unusual signal has a clear explanation and everything else is confirmed as low-risk, you can approve the customer with more confidence.

GBG unifies multiple layers inside GBG Go. To see how the platform can help fill the evidence gaps in your ecommerce fraud investigations, book a demo today. 

FAQs

What's the difference between identity verification and digital intelligence?

Identity verification checks whether a customer's submitted details match trusted public or private records. Digital intelligence analyzes signals from the user's device, IP address, email, and phone number to detect suspicious activity, bot behavior, or links to other accounts.

Why do you need both document checks and biometrics for fraud prevention?

Document checks confirm whether an ID is authentic and free from physical or digital tampering. Biometrics, including face matching and passive liveness detection, confirm that the live person submitting the application actually matches the portrait on the document.

What should you do when identity data matches but digital signals look suspicious?

Treat the match as proof that the identity exists, not that the applicant owns it. Review the connected accounts for innocent explanations like shared households or networks, then use document checks, facial matching, and liveness testing to confirm ownership before deciding.