Example Scenario: How POY Verify Is Designed to Help a Fintech Company Stop Bot Signups

This example scenario follows a hypothetical mid-size digital payments company whose signup flow is being flooded by bot-created accounts. It shows how POY Verify is designed to replace CAPTCHA with a single on-device liveness check, so only real, living people can open accounts, without the company storing any biometric data.

This is an illustrative example scenario, not a customer case study. POY Verify is in private beta, so the company described here is hypothetical and no results are reported. It shows how the product is designed to work for this kind of platform.

The Scenario

Imagine a digital payments company serving small businesses. Signups are climbing, but transaction volume is not keeping pace. Accounts are created in bulk, used for a few fraudulent transactions, and abandoned. The fraud team suspects automated scripts rather than human fraud rings, and every new defense it adds is bypassed within weeks.

The Problem in Detail

In this scenario the fraud shows up in three patterns:

• Bulk Account Creation - Scripts create accounts with disposable email addresses and virtual phone numbers, passing CAPTCHA, email checks, and phone checks without raising an alert.
• Synthetic Identity Fraud - Bots combine real and fabricated personal details into identities that look legitimate on paper but have no real person behind them.
• Account Takeover Preparation - Some bot accounts are used to test stolen credentials, building a foothold for larger account takeover attacks against legitimate users.

CAPTCHA, device fingerprinting, and IP rate limiting each slow the attackers briefly, then get worked around with AI solvers, rotating browser profiles, and residential proxies.

The Solution

In this scenario the company adds POY Verify's liveness check to account creation in place of CAPTCHA. When someone signs up, the platform calls POY Verify, and the person's own smartphone uses its depth camera, infrared emitter, and motion sensors to confirm a living human is present. The check runs inside the phone's Secure Enclave and is designed to take about 30 seconds. The platform receives a signed verified or not-verified result, never biometric data.

Integration Sketch

The sketch below shows the shape of the integration. It is illustrative: POY Verify's SDK is available to waitlist members and is not yet published on public package registries.

// POY Verify - Account Creation Integration
// Replace CAPTCHA with biometric liveness verification

import { POYVerify } from '@poy-verify/sdk';

const poy = new POYVerify({
  appId: process.env.POY_APP_ID,
  environment: 'production'
});

// Triggered when user submits registration form
async function verifyNewUser(registrationData) {
  try {
    // Initiate on-device liveness check
    const verification = await poy.verify({
      purpose: 'account-creation',
      timeout: 30000 // 30 second max
    });

    if (verification.status === 'verified') {
      // Human confirmed - proceed with registration
      return await createAccount({
        ...registrationData,
        poyProof: verification.proof,
        verifiedAt: verification.timestamp
      });
    }

    // Verification failed - block registration
    return {
      success: false,
      reason: 'verification-failed',
      message: 'Unable to verify. Please try again.'
    };

  } catch (error) {
    console.error('POY verification error:', error.code);
    // Graceful fallback - queue for manual review
    return await queueForReview(registrationData);
  }
}

The platform asks one question - is this a real human? - and gets back a signed answer. There is no server-side biometric processing and no identity documents to store.

Implementation Timeline

A rollout like this would typically be staged so the team can compare results at each step:

Before and After

What to Measure

Because this is a scenario rather than a deployment, there are no results to report. A team piloting POY Verify would track the share of new signups flagged as bots before and after, verification completion compared with the old CAPTCHA flow, fraud losses and manual review hours per month, and support tickets about signup friction.

Why Traditional Defenses Fall Short

CAPTCHA, device fingerprinting, IP analysis, and behavioral heuristics all infer humanity from digital signals, and each of those signals can be generated by software. POY Verify instead uses physical sensors to confirm a living person is at the device: the depth camera maps facial geometry a flat image cannot reproduce, and the infrared emitter responds to living skin. There is no software-only path through that check.

Privacy and Compliance

Traditional identity verification usually means collecting government IDs, selfies, or biometric templates, which creates a regulated data store to secure and audit. Because POY Verify processes biometrics on the user's device, the platform never receives biometric data, which is designed to shrink its data protection surface. Teams should still confirm their own obligations with counsel.

Key Takeaways

• Behavior-based bot detection keeps losing ground - Bots that imitate human behavior defeat CAPTCHA, fingerprinting, and heuristics. Physical presence is a harder signal to fake.
• Hardware liveness is designed to resist software attacks - Depth cameras, infrared emitters, and the Secure Enclave are physical components that scripts cannot simulate.
• Zero-data architecture reduces compliance surface - No biometric data reaches the platform, so there is no biometric store to secure or breach.
• Rollout can be staged and measured - Start with a small share of signups, compare against CAPTCHA, then expand.