A first-account application can contain matching faces and a misleading document at the same time. The difficult decision is whether the evidence supports establishing the relationship. Bank and fintech account-opening teams need a clear view of false application types and what each control actually establishes, with a named owner for unresolved evidence.
What counts as new account fraud?
New account fraud is the establishment of an account under false pretenses for a dishonest purpose. Stolen identities and fabricated identities are common routes. The intended abuse may involve obtaining credit, receiving stolen funds or depositing fraudulent checks. The Federal Reserve describes these uses in its account-opening fraud overview.
The distinction from account takeover is the relationship being attacked. Takeover compromises an existing account; new account fraud targets the creation of one. The two can overlap when an attacker uses access to an existing customer profile to open another account without authorization.
The controls also need to distinguish identity fraud from a genuine person making false claims. An applicant can be the person named on an authentic ID and still submit an altered proof of address or misrepresent eligibility. Conversely, an unsuccessful identity check may reflect incomplete records or a capture problem rather than fraud.
At Trustable, we cover the file-authenticity part of this decision. We flag signs of editing or generation in IDs, supporting documents, selfies and video, with findings for the institution's fraud or compliance team to review. Our onboarding authenticity checks sit alongside identity verification. We do not perform liveness detection, biometric matching or database lookups.
Classify the unresolved claim before choosing another control
These categories describe different problems. They can coexist in one application, so an initial classification should remain provisional until the evidence supports it.
| Application pattern | What is being misrepresented? | The question that matters before opening |
|---|---|---|
| Stolen identity | A real person's identity is used without authorization. Some underlying records may be entirely accurate. | Is this applicant legitimately connected to the claimed identity and authorized to establish the relationship? |
| Fabricated or synthetic identity | The claimed person is invented, or assembled from identity information that does not belong together. | Do the attributes and evidence resolve to one real person, and is that person the applicant? |
| Genuine identity with false application claims | A real applicant misstates an address, income, eligibility or another material fact. | Is the particular claim supported independently of the applicant's own submissions? |
| Genuine identity with a concealed purpose | The applicant may be opening the account for another party's misuse, including money-mule activity. | Does the explanation of intended use fit the available evidence, and does it require specialist review? |
The Federal Reserve's synthetic identity definition centers on using identity information to fabricate a person or entity for dishonest gain. A generated face alone does not establish a synthetic identity. A real person may submit an edited photo, and a fabricated identity may be presented by a real person using genuine camera footage.
Automation is another dimension. It describes how applications arrive, rather than whether an identity is stolen, invented or genuine. A bot indicator does not settle that classification.
The pre-opening control map
A useful review records the question answered, the scope of the result and the team responsible for the next action. A generic “passed verification” label hides those distinctions.
| Control | Question it answers | What remains unresolved | Typical next-action owner |
|---|---|---|---|
| Document and media authenticity | Does the submitted file show signs of alteration, generation or other inconsistencies? | Whether its claims are true, who submitted it and why. An unflagged file is not proof of authenticity. | Document-fraud or identity-review team |
| Identity-source validation | Do the relevant attributes agree with authoritative or credible records? | Whether the applicant is the person in those records. A real person's stolen details may match. | Identity-verification team |
| Selfie-to-ID face comparison | How closely does the submitted face resemble the reference portrait? | Whether the reference ID is genuine or the incoming media has been manipulated. | Identity-verification team |
| Liveness and capture-integrity controls | Is there evidence of a presentation attack at the sensor or substituted media in the capture path? | The truth of the applicant's attributes, eligibility and intended account use. Results depend on which attacks the controls cover. | Identity-verification and security teams |
| External account checks | Is a proposed funding account open, who is recorded as its owner, or can the applicant access it, depending on the method? | These are separate questions. Access does not by itself establish ownership, authorization for every transaction or legitimate intent. | Payments or deposit-risk team |
| Device, network and application-link analysis | Does this application share technical characteristics or links with other applications or known risk? | Who is responsible for the pattern. Shared devices and networks require context. | Fraud-strategy team |
| Application behavior and intended-use review | Do the submission pattern and explanation of account use raise an unresolved concern? | Whether unusual behavior reflects fraud, assistance, accessibility needs or a technical problem. | Account-opening fraud team |
Face comparison, liveness and capture integrity deserve separate results. The remote proofing guidance from the National Institute of Standards and Technology (NIST) explains that a biometric comparison does not prevent injected media, and that live capture and presentation attack detection do not cover every such attack. Those are technical identity-proofing requirements within NIST's framework, rather than a universal bank compliance checklist. Our selfie and deepfake guide explains the selfie-specific boundaries in more detail.
External account checks have a similarly important naming problem. For US internet-authorized consumer debits on the Automated Clearing House (ACH) network, Nacha's account validation rules distinguish the minimum validation of an open account that accepts ACH entries from ownership validation. That rule concerns WEB debits. It does not establish that an applicant has passed a bank's first-account identity review.
Trustable supplies authenticity findings in the first row. The source, biometric, account, device, network and behavior controls remain separate capabilities supplied by the institution and its other providers.
Agreement between uploads is weaker than independent corroboration
An ID image, a proof-of-address PDF and a completed application may all display the same address. That agreement establishes consistency across the submissions. It does not establish that an issuer or utility holds the same address in its records.
A useful control map therefore includes the origin of the evidence. Documents supplied through the same applicant-controlled channel can repeat one unsupported claim. Results from several providers can also depend on the same underlying record. Counting them as independent confirmations overstates what the review has established.
An independent response needs a defined scope too. A utility's confirmation that an account exists at an address does not establish that the applicant lives there. A bank's confirmation of an account-holder name does not resolve whether a submitted statement was edited. Our proof-of-address review guide separates those address and account questions.
The practical goal is a new piece of evidence that addresses the open question. Another copy of the same upload rarely does that.
Move the case forward without turning a flag into a verdict
The review path should change according to the gap. A useful sequence keeps the evidence and decision separate throughout.
Preserve the application as received
The case record retains the original submissions, capture context, relevant service responses and the versions considered by the reviewer, under the institution's access and retention policies. Later uploads remain identifiable as later versions. Otherwise, a replacement file can erase the discrepancy that prompted the review.
Describe the narrow finding
“Possible alteration around the address field” is more useful than “fake applicant.” A failed face comparison is different from an unavailable comparison service. A source returning no record is different from a source returning conflicting information.
A detector score is not automatically a calibrated probability of fraud. A localized finding identifies a region or signal for review; it does not establish the applicant's intent. In its deepfake fraud alert, the Financial Crimes Enforcement Network (FinCEN) includes detection flags among possible indicators and cautions that a single red flag does not necessarily indicate illicit or suspicious activity.
Choose evidence that can resolve that finding
For an unclear capture, an accessible fresh-capture route may provide usable evidence. For a suspected field alteration, an institution-approved issuer response or separately obtained record may address the disputed field. For an uncertain applicant-to-identity link, the identity team needs a stronger binding method appropriate to its policy. For linked applications, the fraud team needs the relationship context rather than another selfie alone.
The named owner needs a clear reason for the step-up and a completion condition. Repeating the same failed process without changing the evidence leaves the original question open.
Keep technical failure and fraud suspicion on different paths
A timeout, unsupported document or low-quality image belongs in an exception path unless other evidence supports suspicion. Legitimate applicants need a way to supply suitable evidence or receive assisted review.
Equally, a successful retry should not silently remove contradictory evidence. The reviewer records what changed and whether the new evidence actually resolves the earlier concern.
Apply the institution's account-opening policy
The accountable bank or fintech team determines whether the evidence supports opening, requires further review or supports declining under its policy. The decision record should distinguish “identity remains unresolved” from a substantiated finding of fraud.
For US banks, the Federal Financial Institutions Examination Council's Customer Identification Program guidance describes risk-based documentary and non-documentary verification, plus procedures for circumstances where the bank cannot form a reasonable belief that it knows the customer's true identity. It includes conditions for not opening and for account use while verification continues. Pre-establishment fraud review is an operational decision point; it does not mean that every verification activity is legally required to finish before opening. Applicable duties differ by institution, product and jurisdiction.
A matching face can leave the decisive question open
Consider an illustrative application, not a customer case. The identity-source response agrees with the applicant's name and date of birth. The selfie-to-ID comparison passes. A file-authenticity check flags a possible edit around the address on the submitted ID, and a utility statement repeats that address.
None of those results cancels another. The source match supports the attributes returned by that source. The face comparison supports similarity to the portrait presented. Neither resolves the address field. The utility statement adds agreement between uploads, but its origin and underlying account record are still unresolved.
The identity reviewer keeps the original files and routes the address discrepancy for institution-approved corroboration. If a separately obtained record resolves the address and the suspected edit is explained, the reviewer records that resolution. If it returns a different address, the discrepancy remains open for the appropriate team. A contrary record still does not, by itself, prove intent.
A funding-account access result would not close this case either. It would answer a separate question about access to that account. The review remains focused on the disputed evidence instead of accumulating unrelated passes.
The decision record is the last control before opening
A compact case record should make the reasoning understandable to someone who did not handle the application:
- The material claim that was unresolved, with its supporting file or response.
- The exact finding, its limitations and whether the process completed successfully.
- The origin of corroborating evidence and any dependence on other records.
- The discrepancy's resolution, or the reason it remains unresolved.
- The policy decision, accountable owner and any conditions or exception approval.
An approved application also needs a clear handoff to downstream risk teams where policy requires one. A resolved identity discrepancy, an accepted limitation and a confirmed fraud finding are different outcomes and should remain different in the record. Account monitoring continues after establishment, but it cannot retroactively supply evidence for the opening decision.
Questions from account-opening teams
Does “new account” mean the person's first bank account?
No. It refers to the new relationship being established, even when the applicant already holds accounts elsewhere. An absence of previous banking records is an evidence limitation, rather than a finding of fraud.
How does the control map change for a business account?
The business's existence, the identity of the person applying and that person's authority to act are separate claims. An authentic registration document does not establish all of them. The review record needs to identify which claim each response supports, alongside the institution's applicable business-customer procedures.
Put authenticity evidence where the decision happens
We help account-opening teams examine the IDs, proof-of-address documents, selfies and video already in their flow. Trustable provides file-authenticity findings for your institution to review. Your team retains the identity review and account-opening decision.
Book a demo to walk through a sample application file and see how authenticity findings fit your existing review process.