Opening a bank account on your phone takes a few minutes. You type your details, photograph your driver’s license, and take a selfie. Behind those steps, the bank runs several security layers. Each one targets a different way someone could open an account in a name that is not theirs.
For the wider picture of how these layers connect to customer identity systems, see our complete guide to CIAM.
Layer 1: Identity resolution, catching fabricated and duplicate identities
What it does. It decides whether the details you entered describe a person the bank already knows, a new person, or someone the bank cannot confirm. NIST lists this as one of the outcomes of identity proofing, next to evidence validation and verification.
Example. You apply for a second account, and your name and birth date are almost identical to an existing customer’s. The bank has to decide whether the application is yours, a relative with a similar name, or a fabricated record.
Risk. Synthetic identities. NIST names synthetic identities as one of the attacks that the lowest assurance level is designed to limit.
Mitigation. At that level, core details are validated against authoritative or credible sources, and the applicant is linked to those details.
Layer 2: Evidence validation, stopping forged and stolen documents
What it does. It checks that the identity document is genuine and unexpired. Under federal rules, an unexpired government-issued photo ID is one of the documentary options a bank can use.
Example. A driver’s license photo with an expiry date in the past fails this check, even if the card itself is real.
Risk. Forged documents and stolen documents. NIST’s middle assurance level is designed to limit basic evidence falsification and evidence theft.
Mitigation. The middle level requires more evidence, more rigorous validation, and steps to confirm the applicant owns the evidence.
Layer 3: Liveness and face matching, stopping photo and video spoofs
What it does. It compares the selfie with the photo on the ID and checks that a live person is in front of the camera.
Example. Someone holds a printed photo of the account holder up to the camera.
How it works. Liveness checks look for signs of a real face. ISO/IEC 30107-3 is the standard for testing presentation attack detection, which covers photos, screen replays, and masks. A related read on how liveness works in login systems is in our post on how biometric authentication login systems can improve security and reduce fraud.
Risk. Presentation attacks, along with injection attacks. An injection attack feeds a pre-recorded or synthetic video into the capture process instead of showing it to the camera. ISO/IEC 30107-3 does not cover injection attacks.
Mitigation. Liveness testing against ISO/IEC 30107-3, plus injection attack detection that checks where the video came from.
Layer 4: Non-documentary checks, stopping identity theft without a document
What it does. When documents are not enough, or the applicant does not appear in person, the bank can check details against other sources. The federal rule lists contacting the applicant, comparing details with consumer reporting data or public records, checking references with other financial institutions, and reviewing a financial statement.
Example. An online application asks about previous addresses. The answers are checked against consumer reporting data, so a fabricated history is harder to sustain.
Risk. Applicants who cannot present an acceptable document, or who never appear in person. The rule requires procedures for these situations.
Mitigation. Several sources rather than one, and a documented procedure for each case.
Layer 5: Risk-based decisions, matching controls to fraud risk
What it does. It sets how much verification an application needs, based on a risk assessment. The FFIEC’s 2021 authentication guidance asks institutions to base their approach on that assessment, use layered security, and recognize that multi-factor authentication or controls of equivalent strength can reduce unauthorized access.
Example. Several applications arriving from one device may warrant more checks than a single application from a familiar device. How a bank weighs those signals is its own decision.
Risk. Applications that pass each check on their own but look wrong as a set.
Mitigation. Layered controls chosen from the risk assessment, rather than one pass-or-fail check for everyone.
Layer 6: Sanctions screening, keeping listed persons out
What it does. It checks applicants against federal lists of known or suspected terrorists. The rule requires this check within a reasonable period after opening, or sooner if another law or directive requires it.
Example. A name that closely matches a listed person triggers a review before the bank decides anything.
Risk. Opening accounts for listed persons.
Mitigation. Screening before approval, screening again after opening, and documented review of each match.
Layer 7: Login factor setup, stopping account takeover after opening
What it does. It binds the authenticators you will use to sign in later, such as a passkey, a one-time code, or an app approval.
Example. You create a passkey on your phone during account opening, so the next login uses your device rather than a password.
How it works. A passkey is tied to the website it was created for. Trail of Bits explains that the browser passes the site’s origin to the authenticator, so a passkey created for one site will not be used on a lookalike site.
Risk. Factors attached without a check, and factors that can be intercepted. NIST classifies SMS one-time codes as a restricted authenticator. Restricted means they are allowed only after the organization documents its risk acceptance.
Mitigation. Offer phishing-resistant factors first. Our post on phishing-proof MFA versus standard MFA explains which factors resist real-time phishing, and types of MFA used in online banking compares their strength.
Where OmniDefend fits. OmniDefend’s customer identity offering lists multi-factor identification for customer transactions, online or on-premise. The factors enrolled here are the ones that offering manages.
Where a gap in one layer lets fraud through
No single layer decides the outcome. A duplicate can pass a document check. A genuine document can fail a liveness check. A clean applicant can still be restricted by risk scoring. What matters is whether each layer’s result is recorded clearly enough to explain the decision later.
OmniDefend’s customer identity offering also lists large-scale identification and user management APIs, which are the parts of the stack that keep identity records consistent across a large customer base. For how those records are maintained after onboarding, see our tips to improve your customer identity verification process.
Testing the layers against fraudulent applications
Reading about each layer is useful. Testing them on your own cases is better. Run these five through your onboarding flow:
- A near-duplicate of an existing customer.
- An applicant with an expired ID.
- A genuine ID with a selfie that does not match.
- A second application from a device already used by others.
- A name that triggers a screening match.
For each case, check which layer caught it and whether the record explains the outcome well enough to defend later. OmniDefend’s 30-day free trial comes with setup handled by our sales team, so your month goes on your cases, not on configuration. Start the free trial. If you want to see the platform run those five cases first, request a demo and we will walk through them live.
Frequently asked questions
Why does the bank check whether I already have an account?
The bank needs to decide whether your details describe you or a person it already knows. Matching them correctly is the first step in identity resolution.
Can I open an account without a photo ID?
Federal rules allow non-documentary verification. The bank can use other sources, such as consumer reporting data, and it must have procedures for applicants who cannot present an acceptable document.
Why do I need a selfie?
The selfie checks that the face matches the ID photo and that a live person is present, rather than a printed photo or a replayed video.
Why does my new account have limits?
The rule requires verification within a reasonable time after opening, and the bank must set the terms of use for the period before verification is complete.
What does the bank keep from my ID?
The rule requires a record of the document used, including its type, identification number, place of issuance, and any dates shown.
Are text codes safe for opening an account?
NIST treats SMS one-time codes as a restricted authenticator. They are permitted only after the organization documents its risk acceptance, and phishing-resistant options are preferred where available.
Resources
- 31 CFR 1020.220, Customer identification program requirements for banks (eCFR)
- FFIEC Authentication and Access to Financial Institution Services and Systems (2021), via FDIC FIL-55-2021
- NIST Special Publication 800-63A, Digital Identity Guidelines: Enrollment and Identity Proofing, Introduction
- NIST SP 800-63B-4 restricted authenticator wording, as quoted in a secondary analysis (MojoAuth)
- Trail of Bits, The cryptography behind passkeys (origin binding)
- Facephi, Presentation attack vs. injection attack (ISO/IEC 30107-3 scope, secondary)
- OmniDefend, product listing for customer identity capabilities
Ayush Bhansali is a seasoned writer with a passion for unraveling the intricacies of cyber security, workforce protection, and the cutting-edge realm of SAML 2.0, FIDO, OpenID Connect and FIDO 2.0. With three years of dedicated experience, Ayush has honed his expertise in dissecting the ever-evolving landscape of technology and its impact on our digital lives. His insightful articles not only demystify complex concepts but also provide practical insights for individuals and organizations looking to fortify their digital defenses. Ayush’s writing style is characterized by its clarity and accessibility, making even the most intricate topics comprehensible to a wide audience. Through his work, Ayush strives to empower readers with the knowledge they need to navigate the rapidly advancing world of technology securely.
