Daniel Isaacs, Chief Commercial Officer at Comcorp.
Two South African fraud reports describe the same problem from different ends. The SABRIC Annual Crime Statistics Report recorded a 41% rise in reported fraudulent vehicle asset finance applications, and warned that mule accounts, synthetic identities and AI-assisted document manipulation remain major risks. According to the SAFPS 2025 Annual Report, its fraud prevention efforts helped members avoid more than R7.44 billion in potential fraud losses during 2025, a 47% increase from the previous year. The report also identified document fabrication, including fraudulent payslips and altered bank statements, as one of the most significant enablers of fraudulent applications.
“We have implementations across numerous touch points where identity and income are verified; this gives us a broad view of how these risks intersect," says Daniel Isaacs, Chief Commercial Officer at Comcorp.
"Strengthening one control does not remove the need for others. If identity verification is robust, for example, attention may shift to the supporting financial information. That is why a layered approach to verification is so important."
The biometric threat is no longer someone holding a printed photograph up to a camera. It has moved to synthetic videos being injected directly into the verification stream, bypassing the device camera, an attack that can potentially bypass controls designed primarily to establish human presence.
Curata, Comcorp's facial biometric authentication software, was engineered in response to this evolving threat environment.
“Liveness detection alone is no longer sufficient,” says Isaacs. “Injection attacks can occur at the software layer, where browser-based flows may be exposed. To address this, we introduced additional security controls within the Software Development Kit (SDK), supported by presentation attack detection and dedicated deepfake detection as further layers of protection. These capabilities have also been independently tested against recognised international benchmarks.”
As organisations strengthen identity verification, fraudsters can look for weaker points elsewhere in the application process, including the financial information supporting an application.
Generative AI has made it easier for fraudsters to create increasingly convincing documents and supporting financial information.
"Unlike identity documents and bank statements, there is no standard format for payslips; this makes verifying income complex for institutions,” says Isaacs. "Employers issue payslips in different formats, with varying information and security features. This creates a fraud entry point as it is difficult to determine the authenticity of a document."
“Teams may check calculations or contact an employer to confirm information, but these processes still depend on information the fraudster may have supplied. In some cases, the person being contacted to confirm employment may themselves be part of the syndicate,” says Isaacs.
Comcorp's Secure Payslip Exchange (SPX), delivered in partnership with payroll system providers, removes the need for customers to submit payslips as part of the process. With the customer's consent, payroll data is retrieved directly from the payroll system in real-time, providing structured data and an auditable record.
Comcorp sees organisations using biometric identity verification and income verification as separate controls, often managed across different systems or teams.
“You can establish that an individual is who they claim to be, but there can still be uncertainty around the income information used in the decision,” says Isaacs. “Identity and affordability are different questions, but both contribute to the risk assessment. Bringing those controls closer together can provide a more complete view.”
Verification also extends beyond initial onboarding. Account recovery, changes to contact or banking details and the approval of higher-risk transactions may all require organisations to reconfirm identity, authority or supporting information.
“From a practical point of view, a mobile journey may require very different controls to a bank assessing a home loan application,” says Isaacs. “The important question is which controls are appropriate at each stage of the journey. That becomes an engineering and risk-design conversation rather than simply a product-selection exercise.”
“Identity verification, income verification and transaction controls all address different parts of the risk environment,” concludes Isaacs. “The opportunity is for institutions to connect those signals more effectively and, wherever possible, verify critical information directly from trusted sources.”