You approved a fraudster and every KYC check said yes. Here is how it happens, and how to stop it.

Picture an onboarding that passes every check. The passport is genuine. The government record matches. The selfie matches the passport photo and the liveness check is clean.

Now picture how it was done. Someone else scanned the passport. The account holder only showed up for the selfie, thirty seconds later, because that is the one step that needs their face.

Nothing in a standard verification catches that. The document step looks at the document. The selfie step looks at the face. The gap between them is a person-shaped hole, and it is exactly where an agent onboarding accounts in bulk, or a recruiter walking a money mule through sign-up, does their work.

Every check you paid for said yes. The file says approved, and the approval is yours. When that account starts moving stolen money, the question you will be asked is the one your verification never answered: who was actually there?

What that approval costs you

A fraud that fails verification costs you nothing. A fraud that passes it costs you three times.

• The money. A verified account gets real limits. Loans are disbursed to it, stolen funds move through it, and by the time anyone looks, the balance is gone.

• The file. Your record says a genuine ID, a matching face and a live person. It reads like a clean customer, so nobody reviews it until the losses point back at it.

• The answer you do not have. When your bank partner, your auditor or your regulator asks who opened the account, you can show them a document and a selfie. You cannot show them who was holding the document.

That last one is the worst of the three, because it is not a failure of your team. Your process was followed. The process had a hole in it.

Silent capture is how Toden closes that hole.

What silent capture is

During the document step, Toden takes up to three photos of the person holding the ID. No prompt, no countdown, no instruction to look at the camera. They are unposed on purpose: a posed selfie shows you who the applicant wanted you to see, and an unposed frame shows you who was actually there.

The photos are stored with the verification, next to the document they were taken beside. A reviewer opening the result sees the ID and, one tab over, the person who presented it.

How it works on each platform

• React Native and Flutter SDKs. The rear camera scans the document. On the review screen it closes, the front camera opens for a single frame, with the flash and shutter sound off, and closes again. One frame per document side.

• Web on a laptop or desktop. The webcam that scans the document is already facing the person, so a frame is kept from it.

• Web on a phone. Nothing is taken. A phone browser scans with the rear camera and cannot open the front one alongside it. We would rather return no photo than pretend.

It runs during document capture only. It never runs on the liveness step, which already records the face, and it does not run on flows that capture no document, such as a face re-authentication.

Where to find it

1. Open a passed document verification that was completed in one of the mobile SDKs or on a laptop: a passport, a voter's card or a driver's licence.

2. Go to Captured media and find the ID card.

3. Open the Silent capture tab beside it. The unposed photos are there, labelled with the moment they were taken.

If your backend consumes results, each photo arrives as a media link on the verification webhook, as media.silentCapture1 to media.silentCapture3, and is fetched with your secret key like every other capture. If you have switched silent capture off in the returned-data settings, the links are left out.

What a reviewer can do with it

Four things turn up in these frames that turn up nowhere else.

• A different person. The face holding the ID is not the face in the selfie. That is the case from the top of this article, and it is the one worth escalating.

• The same person, again and again. One face presenting ID after ID across unrelated accounts is an agent, a family member helping, or a farm. Put it beside a face search across your customers and the picture gets clearer.

• Nobody at all. A frame of a ceiling, a desk or a second screen. On its own that proves nothing. Beside a failed liveness recording, it starts to mean something.

• A coached applicant. Two people in frame, one of them pointing at the phone. Worth a question before you approve a loan.

It also helps with disputes. When a customer says an account was opened without them, you can look at who was holding their ID at the time.

What it does not do

This is where we would rather be exact than impressive.

• It does not decide anything. Silent capture never passes, fails or sends a verification to review. It adds no risk signal and it does not change a score.

• It is not compared with the selfie or the document photo automatically. Today a person does that comparison. The face match that decides a verification is still the live selfie against the government record, the passport chip, or the photo on the document.

• It is not proof. An unposed frame can be dark, blurred or empty, and a stranger in the background is not fraud.

• It is not available from a phone browser, on business verification, or on flows with no document step.

So treat it the way you would treat CCTV at a branch counter. It never approved a transaction. It is what you look at when something about the transaction does not sit right.

The privacy part, plainly

An unprompted photo of someone's face is personal data, and many countries give face images extra protection. The capture is quiet, which is the reason to be open about it. Three things are yours to decide.

• Tell people. Say in your privacy notice that photos may be taken during the identity check to prevent fraud. The capture is unprompted, so the notice is where your customer learns of it.

• Limit who receives it. The Presence Intelligence returned-data settings let you keep the photos out of your webhooks, so they stay in Toden and never reach systems that do not need them.

• Switch it off where it does not fit. It is one switch per workflow, under the capture method on the ID Verification step. In a config it is silentCapture: false. When it is off, frames an older app still sends are dropped and never stored.

The rules on face images differ by country, and this is not legal advice for yours. Our guide to biometric data under African data protection law is a reasonable place to start the conversation with whoever owns privacy at your company.

If you are already on Toden

You have it. Silent capture is on for every workflow unless you turned it off, it costs nothing extra, and it needs no code. Open a recent document verification and look for the tab. If your app is on a current mobile SDK, the photos are already there.

If you are comparing providers

Ask each one a simple question: during the document scan, can you show me who was holding the ID? Then ask the follow-ups.

• Is it on by default, or a separate product with a separate price?

• Can I turn it off for one flow and keep it for another?

• Can I keep the photos out of my webhooks?

• What happens on a device that cannot take the photo? Do you say so, or return something that looks like evidence?

On Toden the answers are: on by default and included, yes, yes, and we return nothing rather than something misleading. You can check all four yourself in a sandbox workspace before you speak to anyone.

Want to see who is holding the ID in your own flow? Open a Toden workspace (opens in a new tab) or read how identity verification works.