Classic KYC checks a document and a selfie. Synthetic identities and mules pass both: the document is real or well made, the person on the selfie is alive. What they usually lack is history. A real person leaves a trail for years: an old social account, a work profile, a username carried from school. A synthetic identity has nowhere to get that from.
Signals, not a score
Oracul returns facts and leaves the decision to your rules. A bank, a marketplace and an HR team have different risk appetites: a young footprint is normal for a student and worth a second look for a large loan applicant.
Six flags
- no_footprint: no confirmed or probable account. Rare for an adult with an email and a phone.
- young_footprint: the oldest account is under 180 days. Typical of an identity made for the application.
- name_mismatch: names in the found profiles differ from the stated one.
- voip_phone: a virtual number, cheap and disposable.
- invalid_phone: the number fails format and numbering checks.
- breached_credentials: the email is in breaches with passwords; the account may be taken over.
Numbers next to the flags
Besides flags the API returns the raw values: footprint age in days and the oldest account date, confirmed and probable accounts, the share of profiles with a matching name, namesakes, linked identities and breaches. Build your own thresholds from them, for example "footprint under a year and a VoIP number: manual review".
Where it fits
- Onboarding: scan the application email and phone in the background, decide on the webhook.
- KYC: the document name against public profiles, plus footprint age.
- AML / EDD: context on high-risk clients — work, links, publications.
- Payouts and mules: fresh identities with VoIP numbers and no history.
Getting started
One POST /v1/scans with an email or phone, and a few minutes later the response holds the profile and a signals block. The webhook is signed with HMAC-SHA256. The free plan gives 5 scans a month to test the signals on your own cases.