In a flow of Well-designed KYC, orange account It shouldn't be discovered only after the money has started circulating. The registration may contain a valid CPF (Brazilian tax identification number) and a working phone number, and yet both pieces of information could belong to different people. Therefore, the most efficient decision is not to ask everyone for ten pieces of evidence. It's to validate early on whether the main attributes tell the same story and increase the requirements only when the risk justifies it.
This reasoning improves two things at once: it reduces the chance of an inconsistent identity getting through onboarding and avoids turning security into a collection of steps that discredit legitimate users. In other words, fraud prevention doesn't have to mean cumbersome registration processes. identity validation It works best when each check answers an objective question and produces a clear operational consequence.
Summary
- A valid CPF (Brazilian taxpayer ID) and an active phone number, in isolation, do not prove that both belong to the same person.
- The link between attributes should feed into a risk assessment scale, not a blind rule of approval or rejection.
- Divergent cases may receive additional verification, while consistent registrations proceed with less friction.
- Fraud detection, conversion, abandonment, and review rates need to be tracked together.
Why does the orange account require CPF and phone number verification?
The problem isn't just knowing if the CPF (Brazilian taxpayer ID) exists or if the cell phone number receives messages. The problem is the connection. A person can register real data that doesn't belong to the same identity and create an apparently legitimate transaction. This type of inconsistency deserves attention because accounts used for transferring funds help to disperse values and make tracking more difficult. Civil Police of the Federal District In 2025, it was reported that there was a fraud case involving R$ 206 million, in which R$ 1.110.960,83 was transferred in several transactions to dummy accounts.
This also explains why a counter-strategy digital fraud You need to look at relationships between attributes, not just isolated fields. A CPF (Brazilian individual taxpayer registration number) might undergo a syntax check. A phone number might be active. If the link between them doesn't make sense, the company has received a risk signal before approving an account, a credit limit, a sensitive signature, or a transaction.
How do I validate my CPF (Brazilian tax identification number) and phone number before approving my registration?
A good workflow starts small. Collect the necessary data, make the purpose of the treatment clear, and only then perform the validation. The very ZapSign ID infrastructure It presents the CPF (Brazilian taxpayer ID) and phone number lookup as a direct question about ownership and requires consent in the example call. This choice is consistent with a product design where verification is part of the decision-making process, not a step disconnected from risk.
1. Collect only what will be used in the decision.
CPF (Brazilian taxpayer ID) and phone number must have a defined function in the workflow. If a company collects an attribute and doesn't know what decision will be made with it, there's a design problem even before a fraud problem exists. The same applies to document numbers, addresses, selfies, or biometrics. KYC documentation This helps to organize that logic: the evidence must respond to a concrete need for identification, verification, or monitoring.
A General Law of Data Protection It expressly provides for fraud prevention and the security of the data subject in electronic identification and authentication processes. This does not eliminate the need to define the purpose, legal basis, minimization, and governance of the processing. The point is different: fraud prevention and data protection are not opposing objectives. The workflow needs to accommodate both.
2. Validate the match, not just the isolated data points.
After data collection, the operational question is simple: does the phone number provided match the CPF holder? This check transforms two common registration fields into relational evidence. The page of ZapSign ID This describes exactly that logic: the service receives a CPF (Brazilian individual taxpayer registration number) and phone number and informs whether they belong to the same person. The value lies in the objective response, which can be incorporated into the decision engine without requiring manual analysis of all registrations.
The concept also engages with a broader technical framework. According to the NISTProof of identity involves resolution, validation, and verification, and the collected attributes must be checked against authoritative or reliable sources. For telephone bills, the document itself acknowledges that attributes associated with the number can be validated by an issuing or credible source. It is not enough for the data to appear plausible. It is necessary to verify its connection to a real identity.
| Result | Operational reading | Possible action |
|---|---|---|
| Match | CPF and phone number match. | Follow the flow, considering other warning signs. |
| No match | There is a discrepancy between the attributes. | Trigger additional verification or review as needed, depending on criticality. |
| Inconclusive | The available evidence does not allow for a safe decision. | Apply fallback, retry, or other identity factor. |
No match should not turn into an automatic block.
A discrepancy is a signal, not a sentence. Corporate lines, recently transferred numbers, family registrations, and registration changes can produce legitimate exceptions. Blocking everything reduces fraud, but it can also reduce revenue, conversion, and trust. The most mature approach combines discrepancy with context: transaction value, account history, registration age, behavior, device, and other evidence. In higher-risk scenarios, features such as... facial biometrics ou background check.
The rule should be proportional: the higher the cost of being wrong, the stronger the evidence required. It's the same logic used in... liveness and KYCIn this system, an additional layer can be triggered when the context calls for more trust. This way, the legitimate, low-risk user doesn't pay the operational bill created by the high-risk fraudster.
Layered validation reduces fraud without destroying conversion.
Poorly calibrated security also leads to losses. Serasa Experian Digital Identity and Fraud Report 2025 The report states that 48% of consumers surveyed have already abandoned a purchase due to a lack of trust in the website or app, and that 76% would pay more for a brand perceived as more secure. Security and experience are not on opposite sides of the table. When control is intelligible and proportionate, it can increase trust without creating an authentication marathon.
In digital journeys, the phone can also carry additional signals. ZapSign's content on this topic. Open Gateway This demonstrates how telecom APIs can support number verification and line-associated signals. This allows us to move beyond the binary model where a received SMS is treated as sufficient proof of identity. Number control, linking to a CPF (Brazilian tax ID), and line history are different issues.
When should verification be increased?
The best time to request more evidence is when the risk has changed. A registration with a match between CPF (Brazilian taxpayer ID) and phone number, usual device, and low-impact transaction can follow a simple path. If there is a discrepancy, a recent SIM card change, an attempt to change registration information, or a sensitive transaction, the company can increase the level of authentication. The point is to preserve a decision architecture. ZapSign API And the use of webhooks helps to integrate automated responses into existing workflows, without turning onboarding into a separate process.
Good evidence is evidence that can be audited.
Preventing fraud without recording the decision creates another problem: no one can explain afterwards why a user was approved, reviewed, or blocked. Therefore, the workflow must record the query result, date, context, applied rule, any additional checks, and final decision, respecting the retention and security policy. digital traceability It connects these events to the process and allows for reconstructing the journey when legal, risk, audit, or customer service need to understand what happened.
The concern also applies to one's own identity data. ANPD explains Leaks can lead to fraud, scams, and misuse of information, and it is recommended to document the incident assessment and the measures taken. It makes no sense to reduce fraud in registration while the prevention process creates a poorly protected database.
| KPI | What it reveals | A decision that can guide |
|---|---|---|
| Match rate | Percentage of registrations with a match between CPF (Brazilian individual taxpayer registration number) and telephone number. | Quality of the database and audience behavior |
| Fraud detected | Cases blocked or confirmed after review. | Effectiveness of the risk scale |
| Conversion | Registrations completed after validation. | Impact of controls on acquisition |
| Abandonment | Users who leave during the flow. | Excessive friction or lack of experience. |
| Manual review | Volume sent for human analysis | Operational cost and quality of rules |
Check out these related articles as well:
- Understand how identity verification works and what evidence can be used.
- See how liveness and KYC combine layers of authentication in digital journeys.
- Learn about LGPD (Brazilian General Data Protection Law) best practices applied to digital authentication and signature processes.
Approving better is worth more than simply blocking more.
The goal of a good strategy against orange account It's not about turning every user into a suspect. It's about preventing a relevant inconsistency from going unnoticed while keeping the path simple for those who show consistent signs. CPF (Brazilian taxpayer ID) and phone number form an efficient first layer because they are already part of many user journeys and can guide decisions before the account receives sensitive access.
When the workflow combines attribute matching, risk-based escalation, additional evidence, and traceability, fraud prevention ceases to be a static barrier and becomes a product decision. For operations that need to incorporate this type of API-based checking, it's worthwhile. Get to know the ZapSign ID. and evaluate how validation can be incorporated into registration, login, or sensitive actions without adding unnecessary steps.
Frequently Asked Questions (FAQ)
A "dummy account" is a legitimate account used to receive, move, or disperse funds linked to fraud or other illicit activity. In the context of onboarding, inconsistencies between identity data may signal risk, but do not, on their own, prove that the user is participating in a scheme.
No. Matching a CPF (Brazilian taxpayer ID) with a phone number is useful evidence, but it must be interpreted within the context of the operation's risk. In higher-impact scenarios, the company may combine document verification, biometrics, liveness, device verification, behavioral verification, or other checks before authorizing the transaction.
The discrepancy should trigger a rule proportional to the risk. Instead of automatically blocking, the company may request new evidence, confirm contact through another means, or refer the case for review. The decision should consider the cost of a false positive and the cost of approving fraud.
Use silent or low-interaction checks first and increase the requirement only when a relevant signal appears. This design keeps the journey short for consistent users and focuses biometrics, document verification, or manual review on cases where additional evidence truly changes the decision.
Track at least match rate, fraud detected, conversion, abandonment, manual review volume, and false positives. None of these metrics should be analyzed in isolation. A rule that reduces fraud but decreases conversion from legitimate users may be providing poor protection and proving costly.
Getúlio Santos is the CEO of ZapSign, a lawyer, technology enthusiast, and entrepreneur.
