Which risk signals actually strengthen remote IDV?

Most remote identity verification platforms offer a basic suite of security checks on the ID document, basic KYC checks, and selfie photo matching. Unfortunately, these basic checks can’t stop all fraud. Highly sophisticated fake IDs, injection attacks, deepfake video spoofing, and other methods allow bad actors to bypass traditional IDV tools. 

Ingesting and verifying additional risk signals enhances remote IDV fraud prevention. You can integrate these signals into third-party fraud prevention tools to augment the results you already receive on document validity, basic KYC pass/fail, and photo-match confidence. 

But which risk signals will help you catch the most fraud? And which checks flag so many transactions that they hamper the customer experience for your legitimate end users? IP intelligence, phone risk, email reputation, synthetic-identity detection, sanctions screening, digital footprint scores. Each promises to catch what your current flow misses. Each adds cost, latency, and, often, friction for good customers. We decided to do the math!

We tested 68 checks from five third-party data providers against roughly 2,000 real verification sessions – some legitimate identities, some known fraudsters. Of those 68 checks, 5 checks stood out as providing the greatest lift in fraud prevention results. 

How we tested

We took 2,000 remote verification sessions, each with the user’s name, date of birth, address, email, phone, and IP address. We pre-categorized these sessions based on customer feedback or our internal test cases and assigned each an internal fraud score (“IFS”). 

Every session had an existing IFS from our DIVE results. We used that score as the benchmark: 85 or above counted as a Pass, below 85 as a Fail. 131 sessions (6.6%) failed.

We then sent the same sessions to third-party providers and treated each individual check as its own yes/no test. We have described providers by category rather than by name, because the goal is to compare signal types, not to rank vendors.

For each check, we measured three things:

• Catch rate: of the sessions that failed IFS, the share the check also flagged.
• False-alarm rate: of the sessions that passed IFS, the share the check flagged anyway.
• Lift: catch rate divided by false-alarm rate. A lift of 1× means the check flags risky and good sessions equally often, which is no better than chance. A lift of 3× means a flagged session is three times more likely to come from the risky group.

A provider’s “Fail” was a HIGH-severity signal, a true risk flag, or a fraud score of 75 or more out of 100.

Why how often does it agree? is the wrong question

Our first instinct was to measure how often each check agreed with IFS. That number turned out to be almost useless. Because 93% of sessions passed, a check that never flags anyone agrees 93% of the time without doing any work.

Three checks from our test show the trap:

The first two agree equally often, but only one does anything useful. The third looks like a disaster on agreement, yet it catches 86% of risky sessions. The catch is that it also flags 77% of good customers, so in practice it tells you very little.

When you evaluate a risk signal, ask two questions instead: how many of the bad sessions does it catch, and how many good customers does it hit along the way? Lift combines both into one number.

The most valuable signals: narrow and specific

Seven checks flagged risky sessions at least three times as often as good ones, while flagging no more than 4% of good customers.

IDScan.net test, ~2,000 remote IDV sessions, 2025–2026 · checks that flagged 10+ sessions with lift ≥ 2×

Three patterns stand out:

• VoIP phone numbers. Two different providers’ VoIP checks landed at 4.2× and 3.1×. Real customers overwhelmingly verify with carrier mobile numbers. Internet phone numbers are cheap, quick to create, and easy to throw away. These are a risk signal that tools which identify VoIP phone numbers will help catch. 
• Out-of-market IP addresses. An IP outside the US was the strongest check in the study, flagging just 2.4% of good customers. For a US-focused business, that is a cheap, clean signal. 
• Identity details that conflict with records. When the state, country, or postal code the user enters conflicts with what data sources hold for that identity, lift was 3.3–3.6×. These go a step beyond light KYC: instead of asking whether an address exists, they ask whether it belongs to this person.

The trade-off is reach. Each of these checks alone catches only 3–17% of risky sessions. They are precise rather than broad, which is why they work best layered together.

The least valuable signals: broad scores and “leaked” flags

The weakest performers flagged a large share of good customers and barely favored the risky ones. If you add any of these, expect friction without much protection.

Breach flags describe almost everyone. Two-thirds of good customers’ phone numbers and half their email addresses have shown up in a breach. A signal that fits the majority of honest people cannot single out the dishonest ones.

Composite scores bundle noise with signal. The identity risk platform’s overall score and the IP fraud score both rolled useful sub-signals together with noisy ones. The result flagged good and risky sessions at nearly the same rate. The individual checks underneath were more useful than the score on top.

Generic proxy flags catch ordinary privacy tools. Many good customers now browse through mobile-carrier gateways or built-in privacy relays such as Apple’s iCloud Private Relay. A blanket proxy flag treats them as suspects.

Name-only sanctions matches are a compliance tool, not a fraud signal. One in 13 good customers matched an OFAC entry on name or name plus location. Screening is often required, but these hits should go to a compliance review queue with date of birth matching, not into a fraud score.

Other weak checks: the synthetic-identity “age mismatch” signal (0.1×), email deliverability (0.6×), and the Canadian, EU, and UN sanctions lists (0.4–0.8×).

Signal families: checks over categories

Identity-consistency and IP checks were the most dependable families. Email and sanctions checks rarely beat chance. But every family had a wide spread, so the specific check matters more than the category it belongs to.

IDScan.net test, ~2,000 remote IDV sessions · 55 checks that flagged 10+ sessions · hover a dot for the check

• Identity and address consistency (median 1.7×). The strongest family. These checks compare what the user entered against what records hold for that identity. Age mismatch was the exception, at 0.1×.
• IP address (median 1.5×). Almost every IP check beat chance, but most only modestly. VPN, proxy, and bot checks flagged 10–37% of good customers, so they work better as tie-breakers than as decline reasons.
• Phone (median 1.0×). A split family. VoIP, risky-line, and phone fraud-score checks were strong (2.7–4.2×). Breach, “first seen” and mismatch checks were noise and pulled the median down.
• Email (median 0.9×). The weakest practical family. “Email never seen before” caught 53% of risky sessions but also flagged 29% of good customers.
• Composite scores (1.1×) and sanctions name matches (0.8×). Covered above: neither separated risky sessions from good ones.

Rare signals: too few hits to score, too serious to ignore

Thirteen checks flagged fewer than 10 sessions each. Statistics can’t judge them: one session moving would swing their lift. But several describe situations that are hard to explain innocently, so they belong in rules rather than in a score.

• Disposable email address. Flagged 3 sessions, one of which failed IFS. That is the highest lift in the study (8.1×), resting on a single session. Too small a sample size. 
• Phone number on a do-not-originate list. Flagged 6 sessions, one an IFS fail (2.7×). These numbers should never be used to make outbound calls or texts, so they rarely belong to a real customer.
• Newly breached identity. Flagged 7 sessions, all of which passed IFS. That is not proof the check is wrong. A stolen identity paired with a real, stolen document would pass document checks by design. Worth keeping an eye on, but we don’t have enough data to say whether this check has blockbuster value. 
• Deceased-person record. In the separate 500-license test, a KYC provider marked 3 identities as deceased, yet 2 of them still came back as a full identity match.

The last two point to something important: some of the fraud these signals catch is invisible to document authentication. A real license and a real person’s data, used by someone else, is exactly what a selfie match and these rare signals exist to stop. We recommend routing any of these flags to manual review or a step-up check, no matter how clean the rest of the session looks.

Before you add anything, check what you send

Some of the biggest swings in our results had nothing to do with fraud. They came from how data was formatted before it reached a provider. These fixes cost nothing and improve the checks you already run. Cleaner data means more accurate results and fewer blank results. 

1. Send ZIP codes the way providers expect them. Licenses often store a ZIP+4 padded with zeros (90280-0000). In the KYC test, 414 of 423 padded ZIPs failed the ZIP match. Plain five-digit ZIPs matched 74 of 76 times.
2. Send every field you have. One provider was first run with name, address, and date of birth only. 20 of its 45 signals, including every email, phone, and IP check, came back blank. You can’t judge a phone-risk product without a phone number. Sometimes phone and email capture happens before, or outside of, the traditional IDV flow – make sure your product is structured so that these fields can be stored with the IDV transaction and used with any third-party integrations you use. 
3. Plan for name changes. Of the 28 identities one KYC provider could not verify, 16 failed on last name. All 13 women among them failed on last name, most likely after marriage. Look for providers that match on previous names, or treat a last-name-only mismatch as a softer signal.
4. Validate dates before they leave your system. 155 of 500 birth dates in one export had the wrong century (2064 instead of 1964), a common spreadsheet parsing error. We caught it before sending; a production integration might not.

A practical playbook

If your flow already covers document authentication, address, light KYC, and selfie matching, here is how we would layer in additional signals.

Two principles sit behind the table. First, prefer specific checks over the vendor’s overall score: the specific checks were consistently more useful than the composites built on top of them. Second, measure on your own traffic before you switch a signal on, using catch rate and false-alarm rate rather than agreement.

What this test can and can’t tell you

These results are a strong starting point, not a final verdict. Keep four limits in mind.

• IFS is a benchmark, not ground truth. It measures whether a document looks authentic, not whether the person is who they claim to be. A provider that “disagrees” may be catching a different kind of fraud, such as a real document used by the wrong person.
• The risky group is small. 131 sessions failed IFS, and each provider saw 76–101 of them. A 10% catch rate means roughly 8–10 sessions, so treat lifts within about 0.5× of each other as a tie.
• Defaults were used. Each composite score was judged at a single cutoff. A provider tuned on your own confirmed-fraud outcomes may perform much better than its out-of-the-box score.
• Your traffic is not our traffic. An IP outside the US is a strong signal for a US-only business and meaningless for a global one. Measure on your own population before you set rules.

There is also a fair argument for broad scores: they are easy to integrate, and vendors update them as fraud patterns shift. If you have confirmed fraud labels to tune against, a composite can earn its place. Without them, the specific checks are easier to understand, explain, and trust.

The bottom line

More signals do not automatically mean more protection. In our test, a short list of specific checks did most of the useful work: 

• VoIP phones
• out-of-market IPs
• identity details that conflict with records 

A few rare red flags deserve hard rules. Broad composite scores and breach flags added friction for good customers without separating them from risky ones.

The best next step is to measure before you buy. Run candidate providers against your own sessions, judge each check on catch rate and false-alarm rate, and ensure your formatting is field-perfect.

IDScan.net helps businesses design remote identity verification flows that balance fraud prevention with a smooth experience for real customers. 

Want the full list of all 68 checks and their fraud protection uplift?