The Security Operations Agent for ID Verification leverages the advanced reasoning capabilities of the Qwen large model to provide offline in-depth risk analysis and high-risk device handling for face attack defense scenarios. This feature improves your risk identification and security.
Group risk: Identifies potential fraud rings in ID Verification face authentication.
Device risk: Identifies high-risk devices used in ID Verification face authentication.
This feature is currently in public beta and is free to use until March 31, 2026. Any future adjustments will be announced in the product documentation.
Applicability
The Security Operations Agent applies to the following product solutions that involve face attack defense scenarios. The SDK must have the Device Assistant module fully integrated, and the feature is not compatible with integration methods that use only server-side APIs.
Product code
Description
Integration method
Supported regions
A complete eKYC product flow. It includes global ID document OCR, liveness collection, and face comparison to verify the true identity of end users.
NoteSupports ID document types from multiple countries and regions worldwide.
The Indonesia (Jakarta) region only supports Indonesian ID cards and global passports (document type codes IDN01001 and GLB03002) in the specified document recognition mode.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong), Singapore, Indonesia (Jakarta), Malaysia (Kuala Lumpur)
A complete eKYC product flow. It includes ID document OCR, liveness collection, and face comparison to verify the true identity of end users.
NoteSupports various document types from China, including Hong Kong (China), Macao (China), and Taiwan (China).
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)
For document types that can be verified against an authoritative data source, this eKYC product flow does not require capturing document images. Users only need to complete a face scan to verify the consistency between their identity information and their face.
NoteApplicable to users in the Chinese mainland.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)
Captures and detects the user's face and interactive actions in real time using a camera. It uses the Qwen-VL Large Language Model (LLM) to perform in-depth detection of forgery threats and determine if the user is a real person.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)、Singapore、Indonesia (Jakarta)、Malaysia (Kuala Lumpur)
Captures and detects the user's face and interactive actions in real time using a camera to verify if the user is a real person. It supports comparison with a stored face to verify if it is the same person or searches a stored face database to check for duplicates. After successful verification, it automatically registers the face to a specified face database.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)、Singapore、Indonesia (Jakarta)、Malaysia (Kuala Lumpur)
Analyzes a user's facial image to determine if the user is a real person.
Server-side only (API)
China (Hong Kong)
Detects if the current user is a real person. It supports comparison with a stored face to verify if it is the same person. This is suitable for secondary authentication scenarios.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)
Collects device features and reports them to the server for analysis to determine device threats.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)
Collects features of the face-scanning device and uses the Qwen text LLM for in-depth analysis to detect device threats.
App (SDK)+ Server-side
Web SDK (Mobile / PC)+ Server-side
China (Hong Kong)、Singapore、Indonesia (Jakarta)、US (Silicon Valley)、Germany (Frankfurt)、Malaysia (Kuala Lumpur)
The Security Operations Agent is only supported in the Singapore region. You can enable this feature by authorizing data synchronization to the Singapore region.
When the Security Operations Agent is enabled, it only displays authentication records that are identified as risky.
Procedure
Before you begin, ensure that you have activated the ID Verification service and have existing authentication records.
Go to the ID Verification Console and navigate to the Deep Analysis tab in the left-side navigation pane.
On the Fraud Ring Analysis and Device Analysis tabs, turn on the corresponding Feature Switch.
After the feature is enabled, you can view the identified risk records on the Detailed Records tab the next day. Evaluate these records against your business data to validate the risks. If a risk is confirmed, click Add to Blacklist in the Operating column for the corresponding record.