Zombie identities expose gaps in embedded lending, highlighting the need for continuous identity verification and cross-platform fraud detection beyond onboarding.
Most embedded finance platforms verify their customers, so the problem is not missing checks. The problem is that those checks answer just one question at one moment: is this person who they claim to be, right now, at onboarding?
Fraud does not work in moments. It works over time. The person or business that passes onboarding today is not always the one drawing down credit six months later. The document is genuine, the face matches, and the business registration checks out. In many cases, the real owner even completes the liveness check themselves. Nothing is forged. Every check answers the question it was asked. Each platform keeps seeing a clean picture, but none sees the whole one.
For payment facilitators, PSPs, and vertical SaaS providers building lending into their stacks, this is becoming one of the most expensive risks they carry, and one of the least measured. When a zombie identity draws down and disappears, they usually book the loss as a credit default, not fraud. It shows up in impairments rather than fraud reports, so it rarely gets the controls it needs.
When a real identity stops belonging to its owner
One useful way to think about this is as a “zombie identity”: a real, verified identity that keeps passing verification after the person or business behind it has lost control of it. The term comes from cybersecurity, where a zombie is a compromised machine that keeps running under someone else’s control.
Control can be lost in three ways, and only one of them is theft:
- Taken: credentials stolen through data breaches, phishing, or physical theft, without the owner knowing
- Pressured: credentials handed over under coercion or financial strain, where duress and participation start to blur
- Given: credentials sold, rented, or lent to someone else for money. For businesses, this can mean the whole entity: aged companies with a clean filing history are openly traded for exactly this purpose
In all three cases, the identity keeps working. It moves from one account to the next, across platforms and across years. A stolen identity is a single event. A zombie identity has a lifecycle: control is lost, the identity often goes quiet, then it resurfaces, gets used, and gets used again. The quiet period is the part lenders should worry about most. An account that has been dormant and clean for a year looks like a better borrower, not a worse one.
Why embedded lending is exposed
A traditional bank underwrites a borrower with a broad view: bureau data, account history, sometimes years of relationship. An embedded lender underwrites the same borrower using only its share of that merchant’s activity, which may be small, recent, and nowhere near enough to show what is really going on. That platform data is the embedded lender’s biggest advantage, and also its blind spot.
Embedded platforms also tend to serve large, mixed merchant bases: sole traders, micro-businesses, and marketplace sellers, many of them working with several acquirers at once. A zombie identity does not have to beat any single platform’s controls. It only needs each platform to keep seeing its own clean slice.
That is not a failure of any single check or any single team. It is how point-in-time verification is designed. A session that passes every check is a valid session on its own terms. The fraud signal sits between sessions, between platforms, and across time, so no single business can see it from inside its own onboarding flow.
A familiar problem in an unfamiliar place
Payments professionals have dealt with this before. The industry built network-level fraud detection because transaction fraud could not be seen from a single terminal or gateway. Identity fraud in lending works similarly. The signal that matters usually is not in any one platform’s data. It shows up in the recurrence: the same face, document, or device appearing again in services that have nothing to do with each other.
That is why ownership belongs with payments teams. They already think in networks, sit where money moves, and run the controls these identities may eventually try to exploit: settlement, chargebacks, and payouts.
Where verification needs to move
Three shifts would make a real difference:
- From point-in-time to lifecycle. Onboarding sets a baseline; it does not close the file. In embedded lending, the riskier moments usually come later: the first drawdown, a limit increase, or a change to payout details. Those are the moments to confirm that the person moving the money is still the person you onboarded. A change of directors or beneficial owners, a new device on a dormant account, or a payout account swap close to a drawdown should all trigger the same question.
- From siloed to corroborated. Checking a business identity on its own, without verifying who controls it, leaves too much hidden. Linking document verification to biometric, behavioural, device, and network signals makes the target much harder. Combining signals can give a fuller picture. The signals are not equal, either. A device match on its own is noisy; device identifiers collide and get shared far more often than most teams assume. The same face behind different names, or the same document behind different faces, says much more. Another potentially useful signal is the same identity recurring across unrelated services.
- From compliance to architecture. In embedded finance, responsibility for identity is often split between the software platform, the payment provider, the sponsor bank, and the capital partner. Each can reasonably assume another has done the work. When compliance is bolted on after the product is built, just to satisfy a payment partner or regulator, it usually covers the minimum. When it is designed in from the start, it is more likely to work: the verification result isn’t a pass-or-fail filed away at onboarding, but a record the platform returns to every time money moves.
None of this is easy. Payments professionals know better than most that friction in financial flows has real costs, and that merchants will work around controls that get in their way. The goal is verification that makes things more expensive for fraudsters without making them harder for legitimate users.
Trust is the next competitive edge
Getting this right is also a commercial advantage. Embedded finance is getting crowded, and the next point of competition will be trust, not just pricing or integration speed: which platforms can show their merchants, capital partners, and regulators that they know who is actually on their network?
Platforms that have treated identity verification as a cost centre may find that changing. Regulators are moving the same way. The EU’s new AML Regulation, which applies from July 2027, raises the bar on ongoing due diligence rather than onboarding alone, and oversight of sponsor banks and their fintech partners has tightened on both sides of the Atlantic. Those that have treated it as infrastructure will be better placed to handle tighter regulation and win merchants who choose based on the quality of the lending product, not just whether it exists.
Zombie identities are not a future threat. They are already moving through embedded finance and exploiting the gaps distributed platforms leave open. Across Veriff’s network, one in 26 identities verified by a credit provider is verified by another credit provider within 90 days, and three in four of those move within a month.
For payments professionals, that puts identity next to settlement risk, chargeback management, and data security on the list of things they own. Most verification today has amnesia. Fraud remembers. Embedded finance needs verification that remembers too.
