Fraud consent

The fraud module collects passive signals (device characteristics, behavioral patterns) to support fraud detection on your platform. By default, it does not start. Collection begins only after the applicant explicitly grants consent through a consent gate you control.

Host responsibility: you are responsible for presenting a meaningful consent disclosure to the applicant before calling onConsent. What you disclose and how must satisfy your applicable privacy regulations. The SDK does not render a consent UI.

What is collected

The fraud module collects browser and device signals that can help identify automated or anomalous behavior. No biometric data is collected by the fraud module. No personal identifiers beyond what your session already contains are sent.

The exact signal set is subject to change as the module evolves. For a complete list of data collected and the applicable privacy disclosures, see the data processing section of the console under Settings -> Data and privacy.

Wiring the consent gate

The fraud module is consent-gated by design. Without an onConsent hook, the module is a silent no-op: no agent starts, no error is emitted, and no signals are sent.

Via mountProvisioned (recommended):

client.mountProvisioned({
  target: document.getElementById('idv-container'),
  onConsent: async () => {
    // This callback is called when the declared session modules include
    // the consent-gated fraud module. You must present a disclosure to
    // the applicant and resolve only if they grant consent.
    const granted = await showConsentDialog();
    if (!granted) {
      throw new Error('consent_denied'); // fraud module stays off
    }
    // Resolve without throwing to start the fraud module.
  },
  onEvent: (event) => console.log(event),
});

Via explicit mount:

client.mount('fraud', {
  target: document.getElementById('fraud-container'),
  onConsent: async () => {
    const granted = await showConsentDialog();
    if (!granted) throw new Error('consent_denied');
  },
  onEvent: (event) => {
    if (event.type === 'checktiv.fraud.ready') {
      // Collection is active.
    }
  },
});

Default-deny behavior

If onConsent is absent or throws, the fraud module:

• Does not start any collection.
• Does not emit an error event.
• Does not affect the IDV module or the session outcome.

This is intentional: a missing or denied consent is not an error condition. Fraud signals are supplemental; the session proceeds normally without them.

Consent disclosure guidance

Your consent disclosure should cover:

• That passive behavioral and device signals are collected during the verification session.
• The purpose: fraud prevention and platform integrity.
• How long the data is retained.

Review the data processing addendum in your Checktiv agreement and your own privacy policy to ensure alignment.

Related pages

• Quickstart - see how fraud consent fits into the full integration
• React - pass onConsent through <ChecktivProvider> props