Twelve weeks to a contractor identity and fraud program for a gig-economy platform

• Identity verification moved from a thirty-day compliance window to a gate before the first paid task, for every new contractor.
• The incumbent identity vendor kept, reconfigured, and priced well below the self-serve rate per check, with government database verification included.
• Account linking, database verification and re-verification added, so repeat accounts and fake documents stop passing on a photo of the front of an ID.
• Written policies on location, hand-offs and removal, with warnings before removal and a two-step offboarding process.
• An operations team trained on the tool, with a channel to the vendor’s engineer, and a gate-by-gate design document to keep building from.

The client is an AI data labelling platform. In the terms that matter here, it is a gig-economy platform: it recruits remote 1099 contractors, interviews them, pays them for work done online, and has to know that the person being paid is the person who applied. Swap the labelling work for deliveries, rides, freelance projects or staffed shifts and the funnel, the fraud and the fixes are the same. When we arrived it was new and still weeks from its public launch, with its first few hundred contractors already working in its first market, payouts going out several times a week, and signed customer work waiting on the other side.

Its onboarding funnel was the one most platforms start with. An application with an email, a phone number and a résumé. A manual review. A live video interview with an operator. Then an identity check, and a bank account for payouts. On paper that is five gates. In practice the interview was the only one that decided anything. The identity check was there for compliance, contributors had thirty days after starting to complete it, and nobody had ever been turned away on its result. People were working and being paid before anyone had confirmed who they were.

The symptoms were the ones every platform that pays contractors gets. Hours logged on the timer while the contractor worked somewhere else. Accounts operated from countries the platform didn’t hire in, behind VPNs. One person behind several accounts. A fake document passing the scan. And a payout account that nobody compared with the identity on the ID.

Brendan wrote the audit in the first week, before he had access to the systems, from conversations with the founders, the operators and the engineer who had integrated the vendors. It listed every way the platform was being attacked, ranked by what each one cost, and it was blunt about what existed. There was no fraud program. There was a compliance checkbox.

• The interview was the only real gate, and it didn’t scale. The first person caught running several accounts was caught because an interviewer recognised a returning face.
• The identity vendor was integrated but not configured. It ran the default template: the front of the ID and a selfie, with no barcode, no government database check, and no linking of accounts that share an ID, a face or a device.
• Nothing was automated. A dozen accounts operating from a country the platform didn’t hire in had been found by hand. All of them were fraud.
• Time was being bought, not work. One contractor had logged eight hours on the timer while working on another site, and a spot check suggested the timer abuse was material.
• Nobody compared the identity on the ID with the identity on the bank account being paid, though the payout provider held both.
• There was no deduplication on anything: not the tax number, not the bank account, not the email, the phone or the face.
• A behavioural signals vendor was running on a free trial with no agreed success condition, so the trial drifted for months.

A fraud program is a funnel with a decision at every gate, and the audit’s ranked list said which gates mattered most. Brendan designed the whole flow from application to offboarding, and for each gate wrote down three things: what gets checked, which tool checks it, and what the result is allowed to do to the contractor. That last part matters most. A check that can’t block or route anybody is a report. A check that blocks good people is a leak in the funnel you paid to build.

The gates below are this client’s, but every contractor platform has a version of each: an application, some kind of screening, an identity check, a payout account, the work itself, and the day someone is removed. The principle throughout was to catch obvious abuse with hard rules first (the wrong country, a fake document, a repeat account) and to leave the judgement calls to a scored review, so good contractors move through in minutes and the operations team spends its time on the cases that need a person.

• At the application, VPN, data-centre and burner detection on the IP address, the email and the phone; a résumé check; and phone two-factor sign-in, with a fresh identity check whenever the number changes.
• At the interview, the operator screens for the role and for language, and a frame from the recording is matched against the selfie from the identity check, so the person who sat the interview is the person who gets the account.
• At the identity gate, the document, the selfie and a government database check, with the back of the ID captured, before any paid work; and the account compared against every other account by ID number, name, face, device and IP address.
• At the bank step, the identity on the payout account is compared with the identity on the ID. A mismatch goes to a person.
• During live work, timer signals and a behavioural signal, to catch hand-offs and shared operators; team leads can ask to disable an account with a standard reason.
• At offboarding, warnings before removal for minor behaviour, and a two-step disable with standard reasons, so bans are consistent and can be explained.

The client had an identity verification vendor on a self-serve plan, and was unhappy with it. The obvious consultant move is to recommend a new one. We did a real review instead: nine vendors compared on what they check, what each check costs, whether they cover the countries the expansion plan needed, and the contract terms that matter once you are paying per contractor.

The recommendation was to keep the vendor they had. It had the best government database coverage for the countries the expansion plan needed, and its problem was configuration, not capability. Then we negotiated the contract: a per-check price well below the self-serve rate, with government database verification included; written prices for the expansion countries, for face duplicates and for account linking; no charge when an applicant abandons the check; and no twelve-month lock-in until the fraud baseline was known. The vendor got a larger account that used more of the product. The client got the product it had been paying for.

We’re paid by the client and by nobody else for this work. When a recommendation involves a vendor we also advise, we say so before making it, give the client the alternatives and the prices, and pause our work for that vendor while the client decides.

Choosing the vendor is the small part. The configuration is where the fraud is stopped, and it was done with the vendor’s own engineer in the room. Brendan brought the decisions; their engineer configured the product. Someone who has run this program at scale, on the buying side, knows which modules match which fraud. The vendor knows the product. Both were needed, and the account grew.

This is the kind of work a vendor’s solutions engineer is glad to do and most accounts never ask for, because nobody on the customer’s side owns the program. The vendor’s bill went up and the price per check went down, which is what a correctly used product looks like.

• The back of the ID and its barcode are captured, so the data on the front is cross-checked instead of read once by OCR.
• Government database verification in the first two of the plan’s countries, so a convincing fake with a real-looking face stops passing on the scan alone.
• Account linking on ID number, name, face, device and IP address, with thresholds that decline the obvious repeat automatically and send the ambiguous one to a person.
• A selfie re-match from the interview recording, and a re-check when a contractor changes their phone number.
• The identity check moved from thirty days after starting to before the first paid task.

A tool is only as good as the people deciding what a result means. The last third of the engagement was policy and training, so the program would survive the consultant leaving.

• Written policies the company runs on: which countries contractors may work from, what counts as a hand-off, and how someone is removed, with warnings before removal.
• Hardened guidance for multi-account cases, which had been handled from memory.
• Operator training on the identity tool: a questions channel, training materials and a recorded walkthrough, a recurring Q&A with the vendor’s engineer invited, and the platform experience team brought into it.
• A two-step offboarding process with standard reasons, started by the team lead, so a ban is consistent and can be explained to the contractor.
• A closing design document: the full funnel, gate by gate, with the tool and the decision at each one, and a recommendation for the next step, one engine that reads every signal and answers whether a contractor is bad and why, trained on the structured interview and offboarding data.

In twelve weeks the program went from an interviewer’s memory to a designed funnel with a decision at every gate. Identity verification moved before paid work. The incumbent vendor stayed, configured properly and priced lower per check. Database verification, account linking and re-verification were added, so repeat accounts and fake documents stopped passing on a photo of the front of an ID. The operations team runs the tool themselves and has a channel to ask the vendor questions. The design document is theirs, and they have kept building from it.

What didn’t happen matters too. We didn’t replace the vendor, build a custom model, or promise a fraud rate. The baseline wasn’t known when we started, which is why the contract has no twelve-month lock-in before it is.

About three months, part time, billed monthly at our published rates. Brendan sat in the client’s chat, joined the operators’ stand-ups, met the vendor’s engineer with the team, and wrote. The engineering ask on the client’s side was small: the engineer who had integrated the vendor, for the configuration and the payout comparison, and the operations team for training. The founders got a written recap and a decision list each week, and a closing recap when he rolled off.

Seven things, in the order we would say them on a call. None of them is specific to data labelling. They hold for any platform that onboards 1099 contractors at volume.

• Fraud is a funnel design problem before it is a vendor problem. The client’s vendor was fine. Nobody had decided what each check was for.
• Put identity before pay. A thirty-day compliance window is a thirty-day free trial for fraud.
• Join the identities you already hold. The payout provider, the identity vendor and the application each knew who the contractor was. Nobody had compared them.
• Hard rules for the obvious, a score for the rest. Decline the wrong country and the repeat account automatically; send the ambiguous case to a person. False positives are a cost too.
• Warn before you ban, and ban the same way every time. Consistency is what makes a program defensible to the contractors you keep.
• Negotiate the terms, not only the price. No charge on drop-off and no lock-in before the baseline saved more than the per-check discount.
• Train the operators and leave the design behind. The program has to outlast the consultant.

If you onboard and pay 1099 contractors at volume, whether they label data, deliver, drive, freelance or staff shifts, and your fraud program is an interview and a vendor on the default template, this is the engagement we run. It starts with a free thirty-minute call. Bring your onboarding funnel and the fraud story that worries you most, and we’ll tell you where the gates should be and what we would check first, whether or not you hire us. Book the free call below.