Skip to content
toden

Use case · Account takeover protection

Account takeover protection

A stolen passwordshould not beenough.

Passwords leak, SIM cards are swapped and one-time codes are read out to a caller. When a login comes from a phone you have never seen, or a country the customer was not in an hour ago, Toden asks for a live selfie and compares it with the customer's own verified photo.

The workflow

Score each login as it happens, and step up to a face check only when the risk is real. This is a starting point: add, remove or reorder any step in the workflow builder.

Step 01

Account activity assessment

Scores the login: new device, sudden country change

Per check

Step 02

Biometric re-authentication

A live selfie against the verified photo on file

Per check

Step 03

Decision rules

Continue the session, or lock it and alert your team

Included

Then your rules decide

A starting rule set

  • The login looks like every other loginApprove
  • A device the customer has never usedAsk for more
  • A country change too fast to be travelAsk for more
  • The face check failsDecline

Every rule is yours to change on a visual canvas, and each result records which rule decided it. Publishing a new version needs no release.

Try the workflow builder

How it works

1

Send the logins you already see

Each login or session event goes to one endpoint with the device and country. Toden scores it against the customer's own history and answers at once.

2

Step up when a rule fires

A new device or an impossible journey can raise an alert, and can automatically issue a re-verification link for that customer.

3

The customer proves it is them

A live selfie is compared with the photo on their verified record. Your backend redeems a one-time proof before it lets the session continue.

What powers it

  1. A device never seen before and a country hop within hours are scored out of the box, and you can write your own rules over any field you send.

Integrate

Mount the SDK with the workflow you published, or send a hosted link and write no code. The result arrives by signed webhook, and changing the workflow never needs a release.

Verify.tsxTypeScript · React
import { TodenVerification } from "@todenhq/sdk-react";
 
export function Verify({ userId }) {
  return (
    <TodenVerification
      apiKey="pk_test_..."
      workflowId="wf_AbC123dEf456"
      userId={userId}
      onSubmit={(s) => save(s.verificationId)}
    />
  );
}
verification.completedWebhook · JSON
{
  "event": "verification.completed",
  "data": {
    "verificationId": "ver_8fk2...",
    "status": "verified",
    "assuranceLevel": "gov_db",
    "idType": "bvn",
    "country": "NG",
    "dataMatch": true,
    "facialMatch": true,
    "facialConfidence": 91
  }
}

Products involved

This solution combines products you can use on their own too.

Beta

Risk Intelligence

Monitor transactions and account activity against your own rules, then investigate what they flag.

Learn more
KYC

Identity Verification

Verify a person from their ID, a live selfie and, in five African markets, the government record. One SDK, one signed result.

Learn more
No-code builder

Workflows

Build and version verification flows and decision rules visually, then publish without a redeploy.

Learn more

Related use cases

Account recovery

Recovery that depends on the person, for the moment their phone, SIM or email is not theirs.

Learn more

High-value payment approval

A decision on every payment, and a face check on the few that deserve one.

Learn more

Fraud Prevention

Layered fraud defence across the lifecycle: identity, liveness, face search, device signals, blocklists and monitoring rules.

Learn more

Frequently asked

  • They need a face on file. Anyone who completed a Toden verification is enrolled automatically, and you can also start a check against a reference photo you supply.

Account takeover protection,in one workflow.

The sandbox opens when you sign up. Usage-based pricing, no sales call.

Start freeTalk to us