AI-Powered Identity Verification and Fraud Detection for Online Lending

sun_finance · Finance · 2026 · source Agentic: no · promotional bias: med · source-backed · extracted with prompt 0.5.4 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Online lending identity verification and fraud detection

Sun Finance needed to reduce manual review in a high-volume microloan identity-verification pipeline where OCR errors, multilingual documents, fraud rings, cost, and processing latency blocked expansion into lower-value lending markets.

Constraints:

• identity documents contain sensitive PII
• documents appear in English and local languages underrepresented in traditional OCR datasets
• seven ID types with different layouts and formats must be supported
• false positives create customer friction in lending workflows
• manual review can take up to 20 hours outside business hours
• the architecture must support expansion across nine countries and new document types without retraining

Architecture

Sun Finance and the AWS Generative AI Innovation Center built a serverless AWS pipeline with two API routes. The /extract-id route sends ID images through Amazon Textract for primary OCR, falls back to Amazon Rekognition when confidence is low, then sends extracted text to Claude Sonnet 4 on Amazon Bedrock to structure seven standardized fields and applies validation rules. The /detect-fraud route triggers AWS Step Functions to run visual fraud detection and background similarity in parallel. Claude analyzes selfie images for screen-photo and manipulation artifacts, while Rekognition masks faces, Titan Multimodal Embeddings vectorizes backgrounds, S3 Vectors searches known fraud patterns, and a Lambda risk function combines both scores. A separate ingestion path adds confirmed fraud backgrounds to the vector reference set.

Diagram confidence: explicit (topology described by the source).

flowchart LR
  api-gateway["api-gateway"] --> id-extraction-lambda["id-extraction-lambda"]
  api-gateway --> fraud-detection-lambda["fraud-detection-lambda"]
  cognito-auth["cognito-auth"] --> api-gateway
  aws-waf["aws-waf"] --> api-gateway
  application-s3-storage["application-s3-storage"] --> id-extraction-lambda
  application-s3-storage --> fraud-detection-lambda
  id-extraction-lambda --> textract-ocr["textract-ocr"]
  textract-ocr --> rekognition-fallback-ocr["rekognition-fallback-ocr"]
  rekognition-fallback-ocr --> claude-structurer["claude-structurer"]
  textract-ocr --> claude-structurer
  claude-structurer --> validation-rules["validation-rules"]
  validation-rules --> id-extraction-lambda
  fraud-detection-lambda --> fraud-step-functions["fraud-step-functions"]
  fraud-step-functions --> visual-pattern-detector["visual-pattern-detector"]
  fraud-step-functions --> background-similarity-pipeline["background-similarity-pipeline"]
  background-similarity-pipeline --> face-masking-rekognition["face-masking-rekognition"]
  face-masking-rekognition --> titan-background-embeddings["titan-background-embeddings"]
  titan-background-embeddings --> s3-vectors-index["s3-vectors-index"]
  visual-pattern-detector --> risk-assessment-lambda["risk-assessment-lambda"]
  background-similarity-pipeline --> risk-assessment-lambda
  application-s3-storage --> fraud-ingestion-lambda["fraud-ingestion-lambda"]
  fraud-ingestion-lambda --> face-masking-rekognition
  fraud-ingestion-lambda --> titan-background-embeddings
  fraud-ingestion-lambda --> s3-vectors-index
  terraform-cicd["terraform-cicd"] --> id-extraction-lambda
  terraform-cicd --> fraud-step-functions
  terraform-cicd --> api-gateway

Components

Data flow

A loan application stores ID and selfie images in S3 and calls API Gateway. For ID extraction, Lambda sends the ID image to Textract, uses Rekognition as fallback OCR when Textract confidence is low, passes extracted text to Claude Sonnet 4 for JSON structuring, and validates field formats such as ID number length and date standardization. For fraud detection, Lambda starts a Step Functions workflow that runs two branches in parallel: Claude visual analysis for screen-photo/digital-manipulation artifacts and background similarity that masks faces, creates a Titan 1024-dimensional background vector, and searches S3 Vectors. Lambda combines visual and similarity scores into fraud risk. Confirmed fraud images later flow through a Lambda/Rekognition/Titan/S3 Vectors ingestion pipeline to grow the fraud reference database.

Why this architecture

The architecture separates precise OCR, LLM structuring, validation, fraud vision, vector similarity, and risk scoring because each task fails differently. Claude alone triggered PII safeguards and underperformed on character-level ID extraction; Textract and Rekognition handle OCR better, Claude structures and analyzes context, validation catches formatting issues, Step Functions reduce latency through parallel checks, and confirmed fraud ingestion turns fraud review into a growing reference database.

Prerequisites

To implement a similar solution, you need the following:

• An AWS account with permissions to create and manage AWS Lambda, [AWS Step Functions](https://aws.amazon.com"

— article, implied

Models used: Anthropic Claude Sonnet 4 · Amazon Titan Multimodal Embeddings · Amazon Textract · Amazon Rekognition

Scale

• Sun Finance operates across nine countries.
  “operates as a technology-first online lending marketplace across nine countries.”article, stated
• The company processes a new loan request every 0.63 seconds and more than 4 million evaluations monthly.
  “The company processes a new loan request every 0.63 seconds and delivers more than 4 million evaluations monthly.”article, stated
• The target industry handled 80,000 monthly microloan applications.
  “In one of their highest-volume industries, with 80,000 monthly applications for microloans, approximately 60% of applications required manual operator review.”article, stated
• The project reached production in 107 business days, including a 32-day engagement, 26-day handover, and 35 business days to production.
  “The project moved through four milestones over 107 business days. The AWS Generative AI Innovation Center engagement ran 32 days”article, stated

  “followed by 26 days for technical handover (November 14, 2025). Sun Finance then took 35 business days to move the solution into production”article, stated
• The final ID extraction system was evaluated against 585 ID images.
  “The system was evaluated against 585 ID images:”article, stated
• Final ID extraction accuracy improved from 79.7% to 90.8%.
  “The solution improved extraction accuracy from 79.7% to 90.8%, cut per-document costs by 91%, and reduced processing time from up to 20 hours to under 5 seconds.”article, stated
• Fraud detection achieved 81% accuracy, 59% recall, and 83% specificity.
  “The combined end-to-end fraud detection pipeline (visual pattern detection plus background similarity) achieved 81% accuracy with 59% recall and 83% specificity.”article, stated
• Manual intervention is projected to drop from 60% to 30%, with staffing from about 3 FTEs to about 1 FTE.
  “* Manual intervention projected to drop from 60% to 30% of applications, cutting the review workload in half.”article, stated

  “* Staffing projected to decrease from approximately 3 FTEs to approximately 1 FTE for this industry.”article, stated
• Parallel fraud checks cut latency to 3-5 seconds from 6-8 seconds sequentially.
  “The parallel execution architecture processes images in 3–5 seconds, down from 6–8 seconds when run sequentially.”article, stated

Alternatives considered (roads not taken)

Claude Sonnet 4 directly extracting fields from ID images

Rejected because: Direct extraction triggered PII safeguards and achieved only 61.8% overall accuracy, with ID number accuracy at 43%.

Single OCR or model path for document extraction

Rejected because: No one service handled every edge case, so the final design cascaded Textract primary OCR, Rekognition fallback, Claude structuring, and validation rules.

Text embeddings for background fraud similarity

Rejected because: Text embeddings had poor precision and recall compared with visual embeddings.

Sequential fraud detection checks

Rejected because: Step Functions parallel execution reduced fraud-detection latency from 6-8 seconds to 3-5 seconds.

Retrain specialized models for every new document type or language

Rejected because: The team uses prompt engineering, validation rules, configuration updates, and CI/CD redeployment to expand without model retraining.

Patterns

tool-use-orchestration (architecture)

The solution coordinates API Gateway, Lambda, Textract, Rekognition, Bedrock Claude, Titan embeddings, S3 Vectors, Step Functions, Cognito, WAF, and Terraform into two production routes.

structured-output-contract (data)

Claude structures OCR output into seven standardized ID fields, followed by validation rules for field formatting and normalization.

fallback-degradation (resilience)

The ID extraction route uses Rekognition as fallback OCR when Textract confidence is low, avoiding complete failure on difficult ID images.

eval-driven-development (evaluation)

The team iterated through Claude-only, Textract-plus-Claude, and multi-tier OCR designs, using weekly accuracy measurements over 585 images to decide the next architecture.

latency-optimization (operations)

Step Functions runs fraud-detection branches in parallel, reducing latency from 6-8 seconds to 3-5 seconds.

cost-aware-routing (operations)

The final design reserves expensive model use for structuring and visual analysis, uses Textract as primary OCR, calls AnalyzeID only when needed, and caches embeddings.

data-quality-loop (data)

Confirmed fraud images are continuously ingested, masked, embedded, and stored to grow the fraud-pattern reference database over time.

privacy-preserving-processing (safety)

The production stack uses Cognito/SigV4, WAF, KMS encryption, TLS, and face masking to protect sensitive loan and identity data.

Tradeoffs

Separate OCR from LLM structuring

Chose Textract/Rekognition OCR followed by Claude structuring over Claude reading raw ID images directly.

Rationale: OCR services reliably extract sensitive text, while Claude is better used for normalization and structuring after PII-triggering image extraction is avoided.

Use two complementary fraud checks

Chose visual pattern detection plus background similarity over one fraud method.

Rationale: Screen-photo artifacts and fraud-ring background reuse catch different failure modes, and neither method alone is sufficient.

Weight visual pattern and background similarity equally

Chose 50/50 score weighting over favoring one fraud signal.

Rationale: The article describes equal weighting as the production scoring algorithm for high/medium/legitimate classification.

Use serverless infrastructure for weekly iteration

Chose Lambda, Step Functions, API Gateway, Terraform, and CI/CD over a heavier fixed service architecture.

Rationale: The approach changed weekly during the engagement, so modifying individual functions and deploying without downtime mattered.

Gotchas (what bit them)

The most obvious LLM-only approach failed because the model protected PII.

Root cause: Claude Sonnet 4's built-in privacy safeguards limited extraction from real identity documents, hurting sensitive-field accuracy.

Resolution: The team moved raw OCR to Textract/Rekognition and used Claude only after text extraction for structuring and contextual normalization.

Traditional OCR struggled with local-language and layout diversity.

Root cause: Documents included English and a local language underrepresented in OCR training data, plus seven ID layouts.

Resolution: The final pipeline combined OCR tools with Claude structuring, document-specific extraction rules, and validation rules.

A high fraud-accuracy number hid weak precision/recall for the text-embedding approach.

Root cause: Claude text descriptions of backgrounds preserved enough commonality for accuracy but failed to capture discriminative visual details for fraud-ring matching.

Resolution: The team switched to visual background embeddings, which improved precision and recall substantially.

Fraud recall remained imperfect by design.

Root cause: Lowering thresholds would catch more fraud but create customer-friction false positives in a lending application.

Resolution: The system uses conservative thresholds, other fraud controls, and a growing confirmed-fraud database to improve recall over time.

Evaluation

The project used staged experiments for ID extraction, weekly accuracy tracking on 585 ID images, field-level ID metrics, fraud precision/recall/specificity comparisons, text-versus-visual embedding tests, latency measurements, cost comparison, security audit findings, and projected operational impact.

Metrics: overall ID extraction accuracy · field-level name/date/document-type/ID-number accuracy · fraud accuracy · fraud recall · fraud specificity · visual embedding precision and recall · processing latency · cost reduction · manual intervention rate · FTE reduction · security audit findings

Outcomes

• ID extraction accuracy improved from 79.7% to 90.8%.
• Per-document ID extraction cost fell by 91%.
• Processing time dropped from up to 20 hours to under 5 seconds for the overall solution.
• Fraud detection reached 81% accuracy with 59% recall and 83% specificity.
• Manual intervention is projected to fall from 60% to 30% and staffing from about 3 FTEs to about 1 FTE.
• The solution reached production on January 22, 2026.

Sun Finance operates in nine countries, processes one loan request every 0.63 seconds, delivers more than 4 million evaluations monthly, and targeted an 80,000-application-per-month microloan workflow. The project took 107 business days end-to-end and used 585 ID images for evaluation.