Fraud-prevention API integrations for a large financial institution

The challenge

Application fraud, including synthetic and manipulated identities, is best stopped at the point a credit application is made. Doing that depends on checking applicants against trusted source data and combining several independent signals into one defensible decision, quickly and without hurting legitimate customers.

Integration 1: Federal identity verification

A RESTful microservice that communicates over a secure channel with a federal consent-based identity-verification service and turns large volumes of returned data into a structured format. Responses from this source and from other identity-risk data sources are consolidated and run through fuzzy-logic and rules-engine components to produce a risk score for the applicant.

• Automated data-validation to confirm the accuracy of the data harvested.
• DevOps practices from first commit to deployment to speed up how data is fetched.
• Token-based security with OIDC, JWE and JWT, and caching to keep calls efficient.

Integration 2: Third-party identity-risk attributes

A RESTful integration with a commercial identity-fraud service that retrieves risk attributes over a secure channel and passes them to machine-learning model components, which produce a risk score used to flag possible synthetic-identity fraud on a new card program. The work covered the whole path from receiving and processing API requests to returning a successful response.

Engineering approach

• Test-first: acceptance- and test-driven development with Cucumber, JUnit, Mockito and WireMock, plus performance testing with JMeter.
• Delivery: Jenkins CI/CD pipelines and observability with Splunk, Kibana and New Relic.
• Documentation: Swagger-defined APIs.

Results

• Trusted identity data and third-party risk signals available at application time.
• A clear, tested path from API request to risk score.
• Faster identity verification with minimal impact on legitimate customers.