T-0
Number takeover
An attacker SIM-swaps or ports the taxpayer's line. From this moment every SMS code the program sends lands on the attacker's device.
VeraVault · For card issuers & program managers
The card ships to the fraudster.
Stop it before issuance.
In prepaid, payroll, and tax-refund card programs, an attacker who controls a phone number can pass every check the program runs. VeraVault sits in front of card issuance and refuses to treat a delivered passcode as proof of a person.
Attack timeline
Every control reports success while the fraud completes.
T+2m
Enrollment
They enroll in the card program with real, stolen PII. Name, SSN, and DOB all check out against the bureaus, because the data is genuine.
T+5m
OTP passes
The one-time passcode is delivered and entered correctly. Every automated control the program runs reports success.
T+1d
Card ships
Funds load to a card in the victim's name, controlled by someone else. The first signal anyone gets is the dispute.
What VeraVault does
Identity proven at issuance, not inferred from a passcode.
Carrier attestation
Direct network operator signals on SIM swap recency, port history, line tenure, and subscriber-name match — not a delivery receipt.
Possession vs. presence
Possession of a number is treated as a weak signal. Presence is proven with a live capture bound to an authentic document.
Document authenticity
Security-feature, MRZ, and tamper analysis on the government ID presented at enrollment.
Bound identity record
Device, line, document, and biometric are bound into one sealed record at issuance time and re-checked on high-risk events.
Issuance decision API
A single call returns approve, step-up, or refuse with the underlying signals, so your issuing flow keeps its own policy control.
Evidence trail
Every decision is written immutably for dispute defense, network audits, and regulator inquiry.
Integration
One call before issuance.
VeraVault returns a decision and the signals behind it. Your program keeps policy control: approve outright, step up to presence proof, or refuse issuance. Integration is API-first and does not require replacing your KYC vendor.
See Verafile for tax preparersIssuance decision · illustrative
POST /v1/issuance/decision
{
"decision": "refuse",
"reasons": ["sim_swap_recent", "no_presence_proof"],
"signals": {
"carrier.sim_swap_days": 1,
"carrier.line_tenure_days": 1462,
"carrier.name_match": "mismatch",
"document.authentic": null,
"biometric.liveness": null
}
}Request the API contract
Talk to us about your issuance flow.
Send your details and we'll share the issuance decision contract — endpoints, signal definitions, and response codes — plus where VeraVault fits in your program.