Fraud prevention for E-commerce
We look up the phone line type (mobile, landline or VoIP), the email footprint across platforms and the INE credential against the Lista Nominal. For high-ticket orders, biometrics with liveness through a 24-hour link.
Phone and email answer in the same call; biometrics run only above your threshold
The phone answers in the same request with carrier and line type. The email returns its footprint across platforms. Identity verification sends a link that lives 24 hours. Every result lands in the buyer's file.
Biometrics do not resolve inside checkout. The buyer completes them from their phone and the result arrives by webhook.
Where it fits in your operation
The products behind this solution
Phone lookup
Returns carrier and line type: mobile, landline or VoIP. Synchronous, in the same request.
Email lookup
Returns how many platforms that address exists on.
INE + Lista Nominal
OCR of front and back, then a query against the INE registry of active credentials.
Identity verification
Selfie with liveness, matched against the photo on the document. The verdict comes back verified, partial or rejected.
Sanctions screening
Nine grouped categories, all from public sources: sanctions, criminal, PEP, fiscal, adverse media and more.
Risk engine
Aggregates the signals you already ran into a 0-100 score and flags the gaps in the file.
How it works
From signup to the high-ticket order, in four calls.
Profile the contact
Phone and email at signup. The phone answers in the same request with carrier and line type; the email reports how many platforms it exists on.
Synchronous, same request
Read the credential
Front and back of the INE card. We OCR the fields and query the Lista Nominal, the INE registry of currently active credentials.
INE registry
Ask for biometrics
Only above your threshold. You send a tokenised link that lives 24 hours; the buyer uploads document and selfie with liveness from their phone.
24-hour link
Read the score, decide
The engine folds every signal you ran into a 0-100 score and flags the tools not yet run.
0-100 score
The rules that apply to an online store.
Selling online does not by itself place you under the CNBV or oblige you to run KYC. Three frames apply: consumer protection, personal data and, depending on what you sell, anti-money-laundering law.
Singula does not provide legal advice — not in this block and not anywhere else on this page: these references, the points in this block and the FAQ are a starting point, not an opinion. LFPIORPI scope depends on what you sell and on UMA thresholds, and the handling of biometric data deserves its own review. Validate the references with your legal team before designing the flow.
- 01
As a rule, e-commerce has no mandatory KYC
Unlike a financial institution, selling online does not by itself carry a duty to identify your buyers; the exceptions are the points below. Outside those cases, verifying is a business risk decision.
- 02
LFPIORPI: the exception depends on what you sell
Jewellery, precious metals and stones, watches, artwork and vehicles are listed as vulnerable activities. Above the UMA-denominated thresholds, identifying the client and filing notices is mandatory. A separate case: issuing your own wallet or stored balance can fall under article 17, section III and, on top of that, require authorisation as an electronic payment funds institution under the Fintech Law.
- 03
Consumer protection
Mexico's consumer protection law requires online sellers to give truthful information and safeguard buyer data; the December 2025 amendment to article 76 bis added rules on cancelling subscriptions and recurring charges. In a PROFECO complaint, the evidence kept about the purchase forms part of the case file.
- 04
Personal data: purpose, consent and retention
An ID card and a liveness selfie are personal data. You need a privacy notice, a stated purpose, the data subject's consent and a defined retention period; where sensitive personal data is involved, the LFPDPPP now in force requires express, written consent (article 8). The privacy notice and the consent are the store's responsibility: Singula does not collect them for you, although the flow does record what was queried, when, with what result and — on the identity link — from which device, IP and time.
- 05
On the merchant side, chargebacks run on brand rules
On the merchant side, the dispute is decided by the card brand rules and your acquirer, using the evidence you file inside their window. On the cardholder side there is a regulated path: Banxico's Circular 3/2012 governs unrecognised charges and CONDUSEF hears claims against the issuing bank. The verification record is available as evidence inside that window.
One call per signal. You set the threshold.
The phone lookup answers inside the same request. Email, credential and biometrics return a query reference and notify you by webhook. The risk engine later folds everything you ran into a single score.
# 1. Lookup de teléfono en el alta. Contesta en la misma llamada.
curl https://api.singula.mx/app/phone-lookup/customer/cus_lzk9m4ab3f \
-H "Authorization: Bearer sk_live_..."
→ { "phone": "+525512345678", "valid": true, "country": "MX",
"carrier": "Telcel", "line_type": "mobile" }
# 2. Pedido arriba de tu umbral: abre la verificación biométrica.
curl -X POST https://api.singula.mx/app/identity-verification/customer/cus_lzk9m4ab3f/create \
-H "Authorization: Bearer sk_live_..."
→ { "verification_url": "https://verify.singula.mx/v/tok_9f2ab8",
"expires_at": "2026-05-02T18:40:11Z" }
// Webhook cuando el comprador termina (documento + selfie + prueba de vida):
{
"event": "identity.completed",
"request_id": "req_lzk9m4ab3f",
"verification": {
"status": "verified",
"document_type": "INE",
"face_result": { "match_decision": "match", "liveness_decision": "live" },
"checks": [
{ "check_name": "mrz_check_digits", "passed": true },
{ "check_name": "document_expiry", "passed": true },
{ "check_name": "age_of_majority", "passed": true }
]
},
"device_info": { "ip": "187.190.x.x", "os": "iOS 17.4", "device": "mobile" }
}Frequently asked questions
As a rule, no: selling online does not by itself carry a duty to identify who buys. The exception is selling categories listed as a vulnerable activity under LFPIORPI — jewellery, precious metals, watches, artwork, vehicles — where above the UMA thresholds you must identify the client and file notices. A separate case: if you issue your own balance, wallet or any stored-value instrument, on top of LFPIORPI (art. 17, sec. III) you may need authorisation as an electronic payment funds institution under the Fintech Law; filing notices does not settle it. Outside that, verifying is a risk decision. None of this is legal advice: confirm the scope with your legal team.
Not on its own. On the merchant side, the dispute is settled by the card brand rules and your acquirer using the evidence you file inside their window; the cardholder, by contrast, does have a regulated path against the issuing bank. Verification leaves evidence you can file: the verdict with face match, liveness, IP, operating system and the timestamp of the device the buyer completed it from.
Yes. Each tool is an independent call. Phone and email run across all traffic; biometrics and credential checks run only above the threshold you define by amount, category or delivery zone.
The phone lookup is synchronous and answers in the same request. Email, INE and biometrics are asynchronous: they return a query reference and notify you by webhook. The buyer completes biometrics from their phone; the link lives 24 hours and the result arrives after purchase.
Yes. The lookup returns the line type — mobile, landline or VoIP — plus carrier and country. The risk engine folds that signal into the 0-100 score together with the rest of the file, such as the email footprint across platforms.
The Lista Nominal query returns the verdict — active, revoked, not found, duplicate or stolen, data mismatch — and, where it applies, the revocation cause from the INE catalogue: death, duplicate, forged documentation, expiry and others. The cause arrives named in the same response.
Other solutions
Run the first query on your checkout
Create the account and run the sandbox against your checkout: it returns sample data and never touches external providers. You set the biometrics threshold by amount, category or delivery zone.