What Heka checks behind an identity.
Heka checks digital history, contact details, social activity and darknet exposure, and connects findings across sources to identify inconsistencies.
What each category checks, and what it can reveal.
Not every signal is available for every identity.
Digital footprint
How active, recent and long-standing the online presence associated with an applicant’s identity, email and phone is.
- Email presence across web applications
- Phone presence across web applications
- Oldest observed identity history
Adds history beyond the details in an application and shows how established an identity appears across sources. Limited history is context, not proof that an identity is fabricated.
Identity consistency
Heka cross-checks details across multiple independent live sources to see whether they point to the same person.
- Connections between email and phone
- Carrier-name match
Reveals connections and contradictions between details that may appear valid when checked separately.
Contact integrity
Characteristics of the supplied contact details.
- Disposable email
- Unusual or nonsensical username patterns
- Phone type
Flags contact characteristics worth a closer look alongside other findings. A disposable email or VoIP number alone does not establish fraud.
Phone intelligence
Information associated with the supplied number.
- Caller-ID name match
- Most recently observed messaging activity
- Phone-location match
Adds context about the number’s association, activity and alignment with the application. An active number does not by itself establish who controls it.
Social media intelligence
Observed social-account history and activity.
- Account age
- Connection count
- Most recent activity
Helps assess whether the observed online presence supports the claimed identity. A limited social presence alone does not indicate fraud.
Darknet intelligence
Exposure and risk indicators for the supplied identifiers across leaks and compromised-data sources.
- Data-leak count
- Exposed identity bundlesSets of personal details packaged together.
- Stealer-log countStealer logs are records captured by information-stealing malware.
Identifies exposure that may help explain how someone’s identity information was compromised. Exposure may indicate that someone is a victim – it does not establish that they committed fraud.
How active, recent and long-standing the online presence associated with an applicant’s identity, email and phone is.
Signal examples- Email presence across web applications
- Phone presence across web applications
- Oldest observed identity history
Adds history beyond the details in an application and shows how established an identity appears across sources. Limited history is context, not proof that an identity is fabricated.
Heka cross-checks details across multiple independent live sources to see whether they point to the same person.
Signal examples- Connections between email and phone
- Carrier-name match
Reveals connections and contradictions between details that may appear valid when checked separately.
Characteristics of the supplied contact details.
Signal examples- Disposable email
- Unusual or nonsensical username patterns
- Phone type
Flags contact characteristics worth a closer look alongside other findings. A disposable email or VoIP number alone does not establish fraud.
Information associated with the supplied number.
Signal examples- Caller-ID name match
- Most recently observed messaging activity
- Phone-location match
Adds context about the number’s association, activity and alignment with the application. An active number does not by itself establish who controls it.
Observed social-account history and activity.
Signal examples- Account age
- Connection count
- Most recent activity
Helps assess whether the observed online presence supports the claimed identity. A limited social presence alone does not indicate fraud.
Exposure and risk indicators for the supplied identifiers across leaks and compromised-data sources.
Signal examples- Data-leak count
- Exposed identity bundlesSets of personal details packaged together.
- Stealer-log countStealer logs are records captured by information-stealing malware.
Identifies exposure that may help explain how someone’s identity information was compromised. Exposure may indicate that someone is a victim – it does not establish that they committed fraud.
Valid details can still tell an inconsistent story.
An actual charge-off, reviewed retrospectively. The $860K is a loss the lender incurred, not a saving attributed to Heka.
Checking whether a person, business, phone or email exists is one step. Checking whether those details connect to each other can reveal a different picture.
What existing checks established
- A real person
- A real business
- A repeat borrowing relationship over 18 months
- Existing checks passed three times
What Heka found
- The supplied VoIP line was registered to two unrelated people.
- The email domain was registered to a third person.
- Neither contact detail connected to the applicant or to each other.
A score, with the signals behind it.
A Heka risk score and supporting signals help teams identify findings that need attention and investigate inconsistencies alongside their existing controls.
- Connections between email and phoneIdentity consistency
- Phone typeContact integrity
- Data-leak countDarknet intelligence
Heka can assess identity risk without requiring a Social Security number.Your institution’s identification obligations still apply.