How Instant Identification works when you pay

When you click "Pay," a chain of checks is launched in the background, which for 300-1500 ms decides: to trust the transaction "in one click" or ask for additional confirmation (SMS/push, biometrics, selfie, document). This chain is called an instant identification system (often called real-time KYC/ID + SCA). Its goal is to simultaneously reduce fraud and not spoil the conversion.

Terms without confusion

Identification - to establish "who you are" by attributes (full name, phone, email, device).

Identity verification (proofing) - confirm that the attributes belong to you (document, selfie comparison, NFC chip). Done at the first major payment/withdrawal or at risk.

Authentication - prove that you are making a payment now (password-one-time code, push/biometrics, hardware key).

SCA/3-DS 2 - "strong client authentication" for two factors (knowledge/ownership/presence).

What does instant identification consist of?

1. Invisible signal collection (before clicking "Pay"):

Device-fingerprint: model, OS, browser, time, fonts, sensors.
Network data: IP/ASN, proxy/VPN, geo, latency.
Behavioral-Typing speed, scrolling, mouse path, error patterns.
Account signals: account age, 2FA, history of payment methods, name matches.

2. Transaction context: amount, currency, merchant/MCC, frequency and "speed" of attempts, card BIN/wallet type.

3. Quick reputation references: email/phone leaks, IP risk ranges, black/gray device lists, sanction/POP flags according to account data (if applicable).

4. Real-time risk engine: model (ML + rules) produces speed and solution:

Frictionless (green): skip without additional steps.
Step-up (yellow): ask for 3-DS/push, biometrics or a selfie match with a document.
Block (red): reject/ask for an alternative.

5. Step-up methods (by escalating complexity):

Frictionless SCA: push to banking app/device biometrics.
OTP/TOTP: one-time code (worse for safety, but fast).
Document + selfie (liveness): OCR/MRZ reading, anti-spoofing, sometimes NFC-chip ID/passport in the application.
Reusable ID (BankID/ecosystem eID): "pull up" an already confirmed identity from a trusted provider.
Hardware key (FIDO2/passkey): for wallets/banks/high limits.

How it looks step by step (typical flow)

1. The user fills out the payment form → the frontend collects device/behavioral signals.

2. Data + payment context fly to PSP/bank risk orchestrator.

3. If the risk is low → authorization is quiet, the user sees a successful payment.

4. If the risk is medium → caused by SCA (3-DS 2/push/biometrics).

5. If the risk is high → a request for a document/selfie or block, offer a different method/limit.

6. The total and result codes are returned to the merchant; the system stores the "good" device/pattern.

Time budget: most solutions fit into 0.3-1.5 seconds. Biometrics/documents add 10-60 seconds, but are used only at real risk.

Why it works fast

Pre-trained ML models (gradient boosting/neural networks) on millions of transactions.

Caching the reputation of devices/mail/phones.

Asymmetric logic: first cheap signals, then expensive checks.

Idempotence and webhooks: repeated responses do not create duplicate payments.

Where UX "breaks" most often and how to avoid it

Problem	Why	How to fix
Selfie request "out of the blue"	Sudden VPN/new device/night hour + large amount	Disable VPN, confirm device, split the amount in limits
3-DS doesn't come	SIM-swap/roaming/no communication	Use push confirmation/bank application instead of SMS
"Document not readable"	Highlights, fields trimmed, old document	Shot without glare, 300 dpi, entire spread; when possible - NFC in the application
"Suspicious email/phone"	Featured in leaks/spam	Enable 2FA, change password/mail, confirm number with provider
Long first payment	Orchestrator 'learns' from new profile	Start a payment method and go through soft KYC in advance

Security against phishing and deepfakes

Liveness detectors (micro-movements/mirror light) and active tasks reduce the risk of substitutions.

Face-match with admission and checking "photo vs live face."

Anti-tamper NFC (for ID with chip) confirms the authenticity of the document.

On-device verification (Secure Enclave/TEE) minimizes factor interception.

Retention policies: store biometrics and documents only as long as required by law/license.

Confidentiality and compliance

Data minimization: take only the necessary attributes, mask PAN, tokenize cards.

Role separation: the merchant does not see "raw" biometric data - they are stored by a certified provider.

User rights: access/deletion/restriction of processing on request (within the framework of local laws).

Logs and audits: only technical events are recorded, without unnecessary personal data.

What matters to business (merchant/casino)

Risk orchestration: different flow for new/old clients, for small/large amounts, for "night" operations.

Friction A/B tests: Minimize calling 3-DS/selfies where it does not increase approvability.

Catalog of factors: support for push/biometrics, TOTP, document biometrics, NFC reading, BankID.

Data quality: correct descriptor, valid MCC, correct webhooks.

SLA for checks: target - ≤1,0 seconds per solution, ≤60 seconds per step-up.

Frequently Asked Questions (FAQ)

Why two checks - both the bank and the merchant?

Merchant/PSP assesses the risk before authorization, the bank - at the write-off itself. The dual filter improves accuracy and reduces fraud.

Can you always do without 3-DS?

No, it isn't. For medium/high risk and regulatory requirements, SCA is mandatory.

Documents are asked once?

Usually yes, until the risk profile changes (geo, amounts, methods) or the PoA expires.

Is biometrics safe?

If implemented correctly, yes: templates are stored with a certified provider, channels are encrypted, access is strictly limited.

Mini checklist for user

Included 2FA in bank/wallet and merchant site.
Payment from a familiar device and without a VPN.
The profile is filled in Latin letters as in the document; KYC passed.
With step-up, I will calmly go through push/biometrics/selfies according to the instructions.
I do not share codes/scans in chats, I upload documents only in my personal account.

Mini checklist for business

Risk orchestration with flow gradation (green/amber/red) is enabled.
Several factors are supported: push/bio/TOTP/documents/NFC.
Webhooks/idempotency and correct descriptor/MCC are established.
Configured SLAs and logging; there is a degradation plan (fallback).
Data/interpretation policies and transparent consent texts for users.

The instant identification system is not one "magic test," but a smart combination of invisible signals, risk model and on-demand point checks. In a good design, 90% of payments are frictionless, and for the rest, the system quickly selects an adequate step-up: push, biometrics or document. The result is less fraud, fewer deviations and fast, secure payments without unnecessary nerves.