Account Ownership Validation
Existing methods of account ownership validation rely on basic username and password authentication. Usernames and passwords are one of the most vulnerable areas in consumer security and subject to phishing and direct hacking attempts. Compromised credentials are the most common avenue to account takeover and fraudulent representation of account ownership.
Akoya’s Customers product offers a higher level of account ownership validation. You use Akoya’s API to retrieve consumer permissioned information directly from the financial institution. You can use data elements such as first name, last name, mailing address, e-mail address, or phone number as part of a validation process. You can compare this user information retrieved from the linked external account with what you have captured directly from the consumer.
The comparison process can data elements as part of a scoring algorithm comparing user-provided information with the information on file at the financial institutions. This allows data recipients to identify and flag fraud attempts during know your customer processes or whenever fraud is suspected.
For more information, see the blog post The Expansion of Account Ownership Validation Methods.
Prerequisites
The API calls require you to have the account holder’s consent. Each data call requires the consumer’s associated id token.
See Get Authorization Code for the user authorization process
See Token to obtain the bearer token for the API calls
1. Retrieve customer info
The Customer Info endpoint (/customers) response returns information about the consumer that you can use as data points to validate account ownership. The id_token used for the Akoya API call identifies the specific consumer. When the user consents to sharing their data, the Token API generates the id_token using the authorization code.
Make the GET request customers/{version}/{providerId}/current
The {version} parameter is the Akoya major version number. Use v2.
The {providerId} parameter is the shortened version of the bank data provider name, example, mikomo for Mikomo, Akoya's fictional data provider. You can find the providerId for each bank listed under the Data providers tab of the Data Recipient Hub.
Retrieve customer info curl example
BASH
2. Find data elements for the validation process
The API response contains data elements for the consumer, such as first name, last name, mailing address, e-mail address, and phone number. Compare these data elements from the Akoya endpoint against the data elements submitted by the consumer. Developers often implement a scoring algorithm to facilitate the comparison and flag possible fraud.
Customer info results example
JSON
Alternative retrieval of customer information
Some data providers do not support the default customer info endpoint. Use the following procedure and the account holder information endpoint for these providers.
Retrieve account information
The Account Information endpoint is a standalone endpoint that supplies useful account information. You need to retrieve a list of available accounts permissioned by the account holder from this endpoint.
Make the GET request /accounts-info/{version}/{providerId}
The {version} parameter is the Akoya major version number. Use v3.
The {providerId} parameter is the shortened version of the bank data provider name, example, mikomo for Mikomo. You can find the providerId for each bank listed under the Data providers tab of the Data Recipient Hub.
Retrieve account information curl example
BASH
Find the accountId
From the results of the retrieve account information call, find the the accountId of the selected account. This is the key for retrieving the customer information data elements.
Account information results example
BASH
Request account holder information
The Account Holder Information endpoint (/contacts) response returns information about the consumer that you can use as data points to validate account ownership. This API call uses the accountId to designate the consumer. It is based on FDX 5.2.1.
Make the GET request contacts/{version}/{providerId}/{accountId}
The {version} parameter is the Akoya major version number. Use v3.
The {providerId} parameter is the shortened version of the bank data provider name, example, mikomo for Mikomo, our fictional data provider. You can find the providerId for each bank listed under the Data providers tab of the Data Recipient Hub.
You retrieved the {accountId} with the retrieve account information call.
Retrieve account holder information example
BASH
Find data elements for the validation process
The API response contains data elements for the consumer, such as first name, last name, mailing address, e-mail address, and phone number. Compare these data elements from the Akoya endpoint against the data elements submitted by the consumer. Developers often implement a scoring algorithm to facilitate the comparison and flag possible fraud.