Fraud Prevention · Playbook
How to Stop Fake Signups Without ID Uploads (2026)
Short answer: stop fake signups by screening the signals users already give you — email, phone, device, network, payment — and acting on a combined risk score, instead of forcing an ID upload. A multi-signal API returns approve/challenge/deny in under 500ms, approves ~95% of real users instantly with no friction, and reserves document + liveness verification as a step-up for the high-risk minority. This playbook walks through the layered defense.
"Just make everyone verify their ID" feels like the obvious fix for fake accounts. It isn't. ID-upload walls trade away conversion from your legitimate majority to stop a fraudulent minority — and most products can't afford that trade at the top of the funnel. The better approach is layered: screen everyone silently from data signals, escalate only when risk rises, and verify documents by exception. Here's the framework.
Approval and false-positive figures are typical targets; results vary by implementation, geography, and risk policy.
Table of Contents
The Real Cost of Fake Signups
Fake accounts cost more than a polluted user count:
- •Skewed metrics — fake signups distort activation, retention, and conversion, leading to bad product and marketing decisions.
- •Abuse and chargebacks — stolen-card transactions, promo farming, and disputes that hit revenue directly.
- •Wasted spend and compute — paid-acquisition budget and infrastructure consumed by accounts that will never convert.
- •Trust and safety load — spam, scams, and ban-evasion that degrade the experience for real users.
Why ID-Upload Walls Are the Wrong First Move
A document upload is the most demanding thing you can ask a new user to do: find an ID, photograph it, take a selfie, and wait. Impose it on everyone and you stop fraud — and a meaningful chunk of legitimate signups who abandon at the wall. You've paid for the fraud reduction in lost real users, the overwhelming majority of whom were never a threat.
Document verification belongs in your toolkit — but as a targeted step-up for high-risk cases, not as the gate every user hits. Reserve the friction for where it earns its keep.
The Five Signals That Catch Fakes
Before any ID upload, these signal families catch the overwhelming majority of fake accounts (from SwitchID's signals):
Disposable detection, account age, deliverability, domain reputation, breach exposure.
Phone
VoIP/burner detection, line type, name-to-phone match, port history (SIM-swap).
Device
Fingerprinting, emulator detection, headless-browser and bot signatures.
Network / IP
Proxy/VPN/Tor and datacenter detection, IP reputation, geo consistency.
Payment
Cardholder-name match, BIN analysis (prepaid/high-risk), cross-border consistency — for flows that take a card.
The multiplier is correlation. A fake account often passes each check on its own — but a brand-new email, a VoIP number, and a VPN IP together are a clear pattern. The Identity Consistency Engine scores those relationships, not just the individual signals.
Progressive Verification (the L1→L4 Waterfall)
Start cheap and step up only when warranted:
The economics are the point: the expensive, high-friction checks run only for the minority of sessions that justify them.
Where Document + Liveness Fits
Document and liveness verification is a step-up integration, not a native part of the screen. When the risk score crosses your threshold — or a dispute or regulation requires it — SwitchID can orchestrate a document + liveness check through whichever provider you trust (Veriff, Persona, Sumsub, Onfido, Jumio, or Stripe Identity) and unify the result. You keep document checks for the cases that earn the friction. See our step-up integration guide for the implementation pattern.
Implementing It
In practice this is one API call and a branch. Send the signals you already collect, read back a risk_score, a decision (approve / challenge / deny), and a reasons array, and act on it: approve clean signups, deny obvious fakes, and challenge or step up the ambiguous middle. You can test deterministically with sandbox credentials before going live, and a free Developer tier lets you validate against real traffic.
Stop fake signups — keep real ones
Screen every signup from data signals, no ID upload. Start on the free Developer tier.
Stop fake signups — start freeFrequently Asked Questions
How do you stop fake signups without an ID upload?
Screen the signals a user already provides at signup — email, phone, device, network, and (when relevant) payment — and act on a combined risk score instead of forcing a document upload. A multi-signal API like SwitchID returns an approve/challenge/deny decision in under 500ms. Around 95% of real users are approved instantly with no friction, and you reserve document + liveness verification as a step-up for the small high-risk minority.
Why are ID-upload walls the wrong first move?
Forcing every new user to upload a government ID and take a selfie is the highest-friction verification you can impose. It blocks fraud, but it also blocks a large share of legitimate signups — the majority of whom were never risky. Conversion drops across the board to stop a small percentage of fraud. The better pattern is a silent data-signal screen for everyone, with document verification reserved for the cases that actually justify the friction.
What signals catch fake accounts before an ID upload?
Five families: email (disposable detection, account age, breach exposure), phone (VoIP/burner detection, name-to-phone match, SIM-swap signals), device (fingerprinting, emulator and bot detection), network/IP (proxy/VPN/datacenter detection, reputation), and payment (cardholder-name match, BIN analysis). Crucially, a cross-signal identity engine correlates them — fake accounts often pass each check individually but fail when the signals are compared against each other.
What is progressive verification?
Progressive (or step-up) verification matches the strength of the check to the risk and value at stake. Start cheap and low-friction — an Email + IP screen — and escalate only when warranted: add phone at signup, the full bundle at first transaction, and a document + liveness step-up for high-risk sessions. Most users never see anything beyond the first, invisible tier.
Where does document and liveness verification fit?
As a step-up integration, not the front door. When a session is genuinely high-risk (a high risk score, a dispute, a regulatory threshold), SwitchID can trigger a document + liveness check through a provider you bring — Veriff, Persona, Sumsub, Onfido, Jumio, or Stripe Identity. You verify documents by exception, which keeps friction and cost down while still giving you a path to high-assurance verification when you need it.