KYC & Financial Services
Onboarding is a document exercise: an ID photo, a bank statement, a pay stub, a proof of address. A synthetic applicant now arrives with all four, each one internally consistent and structurally valid. TruthScan asks the question your verification stack cannot: were these artifacts real?
THE THREAT
Synthetic identities are not new. What is new is that the supporting evidence no longer has to be stolen — it can be authored. An AI-generated face that passes liveness, a bank statement rendered rather than exported, a pay stub with a real employer's letterhead and an invented salary, a utility bill for an address that exists. Each artifact is individually plausible and mutually consistent, because they were generated together.
In seconds
End-to-end verdict, fast enough to run inside a real-time onboarding decision rather than a nightly batch.
2 APIs
Image detection for the ID and selfie; PDF detection for statements, stubs and proof of address.
Audit trail
Model version, timestamp and evidence retained on the application record for examiner review.
ATTACK PATTERNS
Four artifacts, generated as a coherent set. Any one of them alone might look odd. Together they corroborate each other — which is the point.
A unique face, created at passport quality, with a matching selfie for verification. Vendors check the template, MRZ, and security features, ensuring the selfie matches the ID from the same model.
THE GAP IN THE STACK
Face-match confirms the two images are of the same person. It does not confirm the person is a person.
A statement that was never exported by a banking system — authored directly, with a coherent transaction ledger, a plausible running balance and correct institutional branding. It is not an altered statement. There is no alteration to detect.
WHY PARSING DOES NOT HELP
Statement parsers extract data. They validate the format, not the origin. A synthetic statement parses perfectly.
Proof of income built on a genuine company's letterhead with an invented salary, invented tax withholdings that compute correctly, and an invented employee ID. Used in lending, credit decisioning and tenant screening, and increasingly hard to verify because the employer is real and will not confirm or deny.
DOWNSTREAM
See also: mortgage lending, alternative lending and credit union fraud detection.
A utility bill or bank letter, generated for an address that genuinely exists — often a vacant unit or a mail-forwarding address. Address-validation services confirm the address is real, which is not the same as confirming the applicant lives there or that the document is genuine.
THE PATTERN
Every individual validation passes. The composite is fabricated.
THE ENGINES
Photos and documents are different forensic problems, so we solve them with different models behind two dedicated APIs. You call the one that matches the artifact — and you review both in one dashboard, under one contract, through one vendor review.
IMAGE DETECTION API
Detects generated faces and manipulated identity documents — the layer beneath template and biometric checks.
PDF DETECTION API
Bank statements, pay stubs, proof of address, incorporation documents and source-of-funds evidence.
WHERE IT SITS
Detection runs as an evidence-authenticity step alongside your existing IDV, sanctions and device-intelligence checks.
STEP 01
Applicant uploads an ID, a selfie and supporting documents.
STEP 02
Image API on the ID and selfie, PDF API on the documents. One to two seconds, end to end.
STEP 03
Verdicts join your IDV, sanctions, device and behavioral signals in your own decisioning layer.
STEP 04
Evidence, model version and timestamp attach to the application record.
DEFENSIBILITY
In financial services, the ability to explain a decision is not a nice-to-have — it is the regulatory precondition for being allowed to make it.
Explainable, not oracular. The report names the signals that drove the verdict, so an adverse-action explanation is possible.
Uniform application. The same model at the same threshold for every applicant — the substance of a fair-lending and non-discrimination posture.
Retained provenance. Model version and timestamp are stored with the verdict, so a decision is reproducible during an examination.
A signal, not a decision. TruthScan does not decline applicants. It gives your decisioning layer a fact it currently does not have.
COMPLIANCE & DEPLOYMENT
SOC 2 Type II
Independently audited security, availability, and confidentiality controls, renewed annually.
ISO 27001
Certified information security management across the full platform and API surface.
GDPR
DPA available. Enterprise customers can pin processing to the EU.
Global Infrastructure
UK, EU and on-premise deployments for Enterprise.
TECHNOLOGY FEATURED IN
Get full forensic reports - heat maps, key indicators, and detailed descriptions.
Free
Try the full engine
Starter
$0.03 / result - $290/yr
For individuals and small teams
Professional
$0.02 / result - $990/yr
For teams in production
Business
$0.01 / result - $3,990/yr
For high-volume operations
No hard quota walls — usage is simply metered at your plan's rate. Custom contracts, SLAs, DPAs, and hosting environments are available exclusively on Enterprise. All plans include SOC 2 Type II compliance.
FAQ
Send us a sample of onboarding packets that cleared your existing stack. We will score every artifact and show you what came through rendered.
NO CARD REQUIRED · UNLIMITED SEATS ON EVERY PLAN · SOC 2 TYPE II · ISO 27001 · GDPR
