Banned users stay banned.
Banned users stay out
Signup protection
Emails are free.Faces are not.
A sign-up only needs an email and a password. The ones that look automated or repeat also get a 3 second, anonymous face check, no ID.
The problem
A form sees an email. It never sees a face.
An email and a password don't stop any of these three.
- r1•••@gmail.comr2•••@outlook.comr3•••@proton.meSame face
The serial sign-up
One person opens account after account with a fresh free email each time and claims the welcome offer every time.
- ScriptNo faceNew accountsLast 60 seconds47Elevated
The scripted sign-up
A script opens hundreds of accounts in minutes, each with its own email, and every device looks new.
- Same faceNew sign-upBanned Mar 3
The banned account, back again
Someone you blocked returns under a new email and a new device, and your signals see a first-time visitor.
How it works
One face, one account, whatever they sign up with
01
Passive signals score every sign-up
Device, network and behavior signals run in the background on every new account and flag what looks automated: an emulator, a residential proxy, typing that's too steady to be a person.
02
Risky sign-ups take an anonymous face check
When the signals flag risk, a 3 second selfie confirms a live, unique human before the account opens. Most sign-ups never see it.
03
The account opens, or it doesn't
A face that matches one already on file is refused or flagged, your choice, whatever email, phone or device it used.
New account
Sign-ups today312
Flagged automated41
DeviceEmulator
The platform
Passive defenses first, proof of human when it counts.
A solution for every scenario
Let's talk trust
Start with a free pilot: see what the check catches on your own users, with no dev work to begin.
With tools like VerifyYou, AI becomes a force for good. It helps prevent AI-driven fraud and can be done with much lower friction than what we built over the years.
Built by humans from
- Quora
- Square
- Gusto
- Cohere Health
- Accenture
Security
Privacy and security in every decision
We keep a face code, not the photo, and hold it under SOC 2 Type II and ISO 27001:2022 compliant controls.
No images stored. VerifyYou does not store images.
No ID or documents. HumanCheck anonymously confirms there is a real, live, unique person, with no name or ID.
A face code, not a photo. We treat it as sensitive biometric data.
SOC 2 Type II
ISO 27001:2022
ISO/IEC 30107-3 PAD Level 1 & 2
GDPR compliant
Common questions
Does a new device or a fresh browser get past it?
No. Recognition is on the face, not the device. A new phone, a new browser or a VPN still matches the face code already on file, so a new free email doesn't open a second account.
What happens to the account that gets caught?
You decide. Block refuses the new sign-up and tells them an account already exists. Allow and flag lets it open and puts it in front of your team instead.
Can someone falsely blocked get back in?
Yes. Turn on sign-in as owner, and the person who signed up first can prove it with a code sent to the email already on file.
Does it slow down the sign-up flow?
Most sign-ups never see a check. Passive signals run on everyone in the background, and only the ones that look automated or repeat get the 3 second selfie.
Can it catch a sign-up bot, not just a repeat person?
Yes. A script that opens accounts in bulk fails the passive signals (no typing pattern, an emulator, a data center IP) before it reaches the face check, and any one that does still needs a different live face each time.
Do you store photos of our users?
No. We keep a face code, not your users' images.
How much work is it to add?
It's two API calls: one to start the check and one to read the result.
Do we have to replace our KYC or bot tools?
No. It sits on top of your stack, so you keep your KYC and bot tools.
What does it cost?
It's 50 to 100 times cheaper than KYC. You pay per check, and nobody uploads an ID document.
Resources
Keep learning
Blog
Why CAPTCHA Is Broken (And What Comes After It)
The test designed to stop bots has become the one thing bots reliably pass. Here's how we got here, and what actually comes next.
Read the post
Blog
The Bots Inside the Front Door: E-Commerce
Carding attacks, phantom customer signups, and the moment the Shopify fraud calendar quietly broke
Read the post
Case study
AI data labeling
$150,000 in fraud loss, stopped within 3 weeks of starting.
Read how it was caught
Ready to get started?
VerifyYou scales trust: passive signals on every session, a face check only when risk calls for it.
