Modus operandi
A mule account is opened with genuine documents by a real person, recruited for ₹5,000 to ₹30,000 to lend their identity. It clears every KYC check, stays dormant, then activates as a pass-through for stolen funds.
Application APP-4471Scoring
Aadhaar — document validityValid
Face match against KYC98.4%
Liveness checkPassed
Name, PAN & address matchConsistent
Bureau historyNo record
Sign3 Intent Conviction
Every credential is genuine. Device, footprint, behaviour and location say the intent is not.
The fraud evolvedThe infrastructure didn't
Fraud in Indian BFSI has moved from forged documents to genuine credentials used with fraudulent intent. Sign3 reads the device, behaviour, network, footprint and image signals your current stack was never designed to carry — and surfaces intent before a single rupee is committed.
A structural problem running on legacy infrastructure
Indian financial fraud has undergone a structural shift. The era of forged documents and impersonated identities is being replaced by a more sophisticated pattern: fraud committed with genuine credentials. Synthetic identities are assembled from valid fragments. Mule accounts are opened with fully compliant KYC. Account takeovers are executed with legitimate login credentials. In each case, the verification infrastructure confirms the identity. What it does not confirm, and was never built to confirm, is the intent behind it.
- Synthetic identitiesAssembled from valid fragments.
- Mule accountsOpened with fully compliant KYC.
- Account takeoversExecuted with legitimate logins.
- Intent, unverifiedIdentity confirmed. Intent never was.
The result is a category of loss that traditional fraud systems are architecturally unable to prevent. Not because they are poorly configured, but because they answer a question that no longer separates legitimate customers from fraudulent ones.
Five patterns that clear verification and still cost you money
For each: how it works, why current systems miss it, how Sign3 catches it — and what it measured in production.
Why current systems miss it
KYC confirms the identity is authentic, not why the account is being opened. Bureau returns no negative history, so detection happens only after the money has moved.
How Sign3 catches it
Sign3 reads the digital and behavioural profile at account opening — recently activated phone, minimal footprint, shared device, coached session. Individually flags; together, a conviction.
73%
of money mules flagged at onboarding — 3× better than the legacy system it replaced.
Banking client, production deployment
Fraudsters live in the white space between systems
Fraud evolves faster than the controls built to stop it, and it exploits the gaps between them. Each check below is necessary. None of them is sufficient.
Sign3 lives in that white space too.
- KYCChecks the document
- BureauChecks credit history
- LivenessChecks the face
Five dimensions, evaluated at once
Device, behaviour, network and digital-footprint signals resolved into one applicant profile — the inputs a credit file never captures.
Digital Footprint
- WhatsApp age
- Lending apps
- Commerce history
- Governance records
Device Intelligence
- Root status
- Fingerprint matches
- Emulator detection
Behavioural Biometrics
- Form completion
- Navigation patterns
- Session duration
Location Intelligence
- IP reputation
- Address consistency
- Telecom circle
Image Intelligence
- Selfie context
- Device match
- Face Vault
Measured across fraud types. Proven in production
Cumulative outcomes from live deployments across banking, lending, and credit card portfolios.
73%of money mules flagged at onboarding
Banking client.
78%of fraudsters in the riskiest 5% of applicants
Personal loan provider.
503distinct fraud rings surfaced
From 69,646 numbers in one analysis window.
84%reduction in fraud approvals at onboarding
Leading fintech.
₹25 Crsaved in fraudulent disbursements
Single quarter, leading NBFC.
150accounts on a single device detected
Preventing layering of ₹2.3 Cr in fraudulent funds.
A structural problem running on legacy infrastructure
Indian financial fraud has undergone a structural shift. The era of forged documents and impersonated identities is being replaced by a more sophisticated pattern: fraud committed with genuine credentials. Synthetic identities are assembled from valid fragments. Mule accounts are opened with fully compliant KYC. Account takeovers are executed with legitimate login credentials. In each case, the verification infrastructure confirms the identity. What it does not confirm, and was never built to confirm, is the intent behind it.
The result is a category of loss that traditional fraud systems are architecturally unable to prevent. Not because they are poorly configured, but because they answer a question that no longer separates legitimate customers from fraudulent ones.
- Synthetic identitiesAssembled from valid fragments.
- Mule accountsOpened with fully compliant KYC.
- Account takeoversExecuted with legitimate logins.
- Intent, unverifiedIdentity confirmed. Intent never was.
Five patterns that clear verification and still cost you money
For each: how it works, why current systems miss it, how Sign3 catches it — and what it measured in production.
Modus operandi
A mule account is opened with genuine documents by a real person, recruited for ₹5,000 to ₹30,000 to lend their identity. It clears every KYC check, stays dormant, then activates as a pass-through for stolen funds.
Why current systems miss it
KYC confirms the identity is authentic, not why the account is being opened. Bureau returns no negative history, so detection happens only after the money has moved.
How Sign3 catches it
Sign3 reads the digital and behavioural profile at account opening — recently activated phone, minimal footprint, shared device, coached session. Individually flags; together, a conviction.
Proof
73%
of money mules flagged at onboarding — 3× better than the legacy system it replaced.
Banking client, production deployment
Modus operandi
A fabricated persona assembled from real fragments: valid Aadhaar, fresh phone, new email, clean selfie. No negative history, because the person never existed. Sophisticated variants warm up with small transactions first.
Why current systems miss it
Each document is individually valid. Bureau returns nothing, and absence of history reads as absence of risk. The identity passes because there is nothing to fail against.
How Sign3 catches it
Digital Footprint tests whether the identifiers belong to a person with an established presence. A genuine identity leaves years of traces across 100+ platforms. A synthetic one does not.
Proof
78%
of fraudsters concentrated in the riskiest 5% of applicants scored.
Personal loan provider
Modus operandi
An unauthorised party takes control of a legitimate account using valid credentials from phishing, social engineering, or a SIM swap. The login succeeds. The session behaviour changes.
Why current systems miss it
Authentication verifies credentials, not the person using them. Once the login succeeds, the session is treated as legitimate for its full duration.
How Sign3 catches it
Behavioural Biometrics baselines how each holder interacts with their device and scores deviation in real time — inside the session, not after the transfer clears.
Proof
<30s
from session deviation to block on takeover attempts in production.
Live deployment, retail banking
Modus operandi
A coordinated network of accounts run by a handful of people or devices. Every account passes individual verification; the coordination shows only across the network — shared devices, clustered IPs, linked funding.
Why current systems miss it
Per-account scoring treats each application as independent. One account inside a 200-account ring looks ordinary. The ring is invisible to any system evaluating one at a time.
How Sign3 catches it
Sign3 maps relationships across accounts, devices, numbers and funding paths continuously. The ring surfaces not because one account is suspicious, but because the connections are.
Proof
503
distinct fraud rings surfaced from 69,646 numbers; one device operating 150 accounts.
Single analysis window
Modus operandi
In Tier 2/3 markets, agents fill forms, operate devices and take selfies for applicants. The KYC documents are genuine. The person completing the application is not the applicant.
Why current systems miss it
Face match confirms the selfie matches the Aadhaar and liveness confirms a real person. Neither confirms the person holding the device is the applicant.
How Sign3 catches it
Image Intelligence reads background scene, device metadata and Face Vault history; Behavioural Biometrics detects coached capture. Right documents, wrong behavioural signature.
Proof
7.1%
of approved selfies flagged as assisted captures; 1,400+ duplicate identity clusters found.
19,986 KYC selfies reviewed
Fraudsters live in the white space between systems
Fraud evolves faster than the controls built to stop it, and it exploits the gaps between them. Each check below is necessary. None of them is sufficient.
Sign3 lives in that white space too.
- KYCChecks the document
- BureauChecks credit history
- LivenessChecks the face
Five dimensions, evaluated at once
Device, behaviour, network and digital-footprint signals resolved into one applicant profile — the inputs a credit file never captures.
Digital Footprint
- WhatsApp age
- Lending apps
- Commerce history
- Governance records
Device Intelligence
- Root status
- Fingerprint matches
- Emulator detection
Behavioural Biometrics
- Form completion
- Navigation patterns
- Session duration
Location Intelligence
- IP reputation
- Address consistency
- Telecom circle
Image Intelligence
- Selfie context
- Device match
- Face Vault
Measured across fraud types. Proven in production
Cumulative outcomes from live deployments across banking, lending, and credit card portfolios.
73%of money mules flagged at onboarding
Banking client.
78%of fraudsters in the riskiest 5% of applicants
Personal loan provider.
503distinct fraud rings surfaced
From 69,646 numbers in one analysis window.
84%reduction in fraud approvals at onboarding
Leading fintech.
₹25 Crsaved in fraudulent disbursements
Single quarter, leading NBFC.
150accounts on a single device detected
Preventing layering of ₹2.3 Cr in fraudulent funds.