Mitek Systems: identity verification, biometrics and fraud controls

Mitek’s financial-services offering addresses three connected stages: establish identity during account opening, authenticate a returning customer and apply additional checks to sensitive activity. For a broker, those functions sit in onboarding, account security and fraud operations. The fintech product description combines document evidence, biometric presence and fraud detection; a favourable identity result is one input to the firm’s wider customer-acceptance process.[2]

Digital Fraud Defender runs only when enabled. Its flags and explanations accompany the verification result in the MiVIP console; configurations determine which checks an applicant encounters.[1]

The orchestration datasheet describes a single API covering document and face checks, database searches, sanctions/PEP screening, geolocation, digital footprints and fraud services. Businesses can also initiate requests in the portal or in batches. They set an identity-confidence threshold and can trigger reverification when KYC information ages, names or addresses change, or a payout requires additional evidence.[7]

The iOS guide separates in-app status callbacks from document-status server callbacks. The latter require HTTPS and a domain whitelisted at MiVIP. A local completion callback therefore should not be confused with the server’s document-processing notification.[10]

Identity Cloud API v2 uses OAuth 2.0 client credentials and JWT access tokens; production tokens expire five minutes after issue. Access is scoped separately for dossier creation, document processing, biometric enrolment/verification/deletion and face-blocklist operations. A valid token does not enable an unprovisioned feature. HTTP 200 can also accompany a failed quality assessment, so integrations must inspect the result body.[12]

For traceability, responses distinguish the customer’s supplied reference from Mitek’s request identifier. MiPass also returns an enrolment identifier for later verification, updates or deletion. Its outcomes include Authentic, Fraudulent and Undetermined; an inconclusive result should remain distinct from an authentication success.[12]

Mitek directs both plans to sales rather than publishing amounts, currency or a tax basis. The annual user fee remains part of Starter even when authentication use is intermittent. This plan comparison is for MiPass; it is not a MiVIP document-check tariff.[13]

The public website terms govern use of the site and refer downloaded software to its separate licence. They do not establish an enterprise subscription’s renewal, service credits or exit charges.[14]

The SDK licence gives an existing Mitek contract precedence. Without one, its grant is limited to internal evaluation and development of applications transferring data to Mitek; redistribution and third-party access are restricted. A public GitHub repository therefore does not itself grant unrestricted production use.[11]

MiVIP offers a hosted interface, prebuilt SDK components or direct API integration. Professional services can help design, test and optimise journeys. This lets the firm choose how much of the customer experience to build itself while retaining control over the verification logic and branding.[1]

The customer-journey datasheet describes a central checklist, saved progress and configurable SMS or email reminders for unfinished applications. Images receive quality feedback during capture rather than only after the entire journey. Blurred, undersized or glare-affected submissions can be retaken with specific guidance. These mechanisms matter when an interrupted mobile applicant returns to complete an account opening.[8]

MiPass enrolment captures biometric material used to create cloud-based templates. Subsequent authentication can use face, voice or their combination, including in mobile and web experiences. Its recovery use case offers a biometric route back into an account when normal credentials are unavailable; the broker still defines when recovery or a sensitive action requires additional controls.[3]

Mitek’s current company page states SOC 2 and ISO 27001 compliance. Those are supplier security statements; the page does not supply the underlying report, scope schedule or a service-availability commitment.[19]

Mitek separates business support from the applicant’s own service relationship. Contracted customers use its support portal to obtain configuration information and open or manage cases. An individual struggling to verify an identity is directed to the bank or app provider. The public support page does not publish severity definitions, response clocks or a universal 24-hour service commitment.[16]

The UK government’s MiVIP record names Mitek Systems inc., trading as Hooyu Ltd, certified by Kantara under trust-framework version 0.4 gamma for the Identity role. It records a certificate issued on 11 September 2026 and expiring on 6 October 2029, with specified identity profiles and supplementary Right to Work, Right to Rent and DBS codes. That certification concerns digital identity assurance; it is not permission to execute investments or operate a broker.[18]

Mitek’s privacy policy describes it primarily as a processor or service provider, with specific controller exceptions. In particular, it may retain images for its own facial-recognition improvements and fraud-prevention purposes. A blanket statement that customer material is never used to improve technology would conflict with that notice.[15]

Mitek Systems, Inc. is the Nasdaq-listed company trading as MITK. Its fiscal third-quarter 2026 release reports USD 54.0 million total revenue for the quarter ended 30 June, including USD 24.8 million of Fraud & Identity SaaS revenue. The wider group also sells check-deposit and check-fraud technology, so corporate scale is broader than identity verification alone. The same release identifies Ed West as chief executive.[21]

The company traces its origins to 1986 in image analytics and optical character recognition for financial institutions. Its later identity portfolio grew alongside, rather than replacing, its financial-document business.[19]

Mitek acquired HooYu in March 2022 for GBP 98 million, adding orchestration and data checks to its identity technology. HooYu remains relevant to legacy documentation and the current UK register’s trading-name field. The transaction amount describes that acquisition, not a current valuation.[20][18]

ID R&D joined Mitek in 2021. The current IDLive Doc FAQ says its offerings have moved under the Mitek brand while existing deployments remain supported. The published office directory lists San Diego, Amsterdam, London, Paris and Barcelona.[6][17]

Operator

Mitek Systems, Inc.

Service scope

Identity checks, configurable KYC journeys, biometric authentication and fraud signals for financial institutions and digital businesses.

Customer types

Banks and fintechs; Lenders; Regulated enterprises; Marketplaces

Delivery

Hosted; API

Pricing publication

Quote only

Platforms

MiVIP; MiPass; Digital Fraud Defender; IDLive Face; IDLive Doc

Pricing scope

MiPass publishes Starter and Unlimited charging structures but no numerical rates; both include per-user enrolment and annual fees.

Implementation

Hosted journeys, SDKs or APIs with configurable verification thresholds.

Support

Business customers use the support portal; individuals seek help from their bank or app provider.

Permissions and regulatory scope

MiVIP appears on the UK digital-verification register for the Identity role. This is identity-service certification, not a financial-services licence for a broker.

Provider metadata checked 21 Oct 2026Source 1Source 21Source 2Source 5Source 13Source 7Source 16Source 18Source 20Source 6Source 19

Other retention follows purpose, the service contract and applicable law. The notice also allows transfers to the US and other countries; it does not promise that every deployment keeps data in the applicant’s country. Clients remain responsible for required biometric consent.[15]

API deletion has a narrower, explicit technical meaning. Deleting a MiPass enrolment marks the record deleted and immediately removes its associated biometric data. Removing a Face Blocklist entry permanently deletes that face image and excludes it from later comparisons. Neither endpoint is described as an export of the full KYC case or deletion of every contractual record.[12]

IDLive Doc’s capture requirements include JPEG quality of 70–100 and a full-HD image, 1920 × 1080, in either orientation. Its printed-copy detector is unsuitable for documents originally issued on paper. That limitation matters when a customer journey accepts different national document types: document liveness is a check on how evidence was captured, not a substitute for defining acceptable evidence.[6]

IDLive Face supports SDK and Docker/REST delivery. Its page specifically labels the on-device FIDO mobile-SDK deployment as beta. A server-based integration and that mobile beta should therefore be treated as separate implementation choices, with no assumption that every deployment has the same maturity or data path.[5]

Digital Fraud Defender’s AI is directed at fraud evidence: camera injection, tampered streams, repeated portraits or identity templates, and synthetic faces. Its description concerns detection and risk signals. The broker’s surrounding workflow determines the consequence of those signals, such as retrying capture or sending a case for review; the product page does not confer independent account-opening or payment authority.[4]

The reusable-identity page describes a user-held wallet, selective presentation to a relying party and encrypted data on the individual’s mobile device. It frames this partly as Mitek’s digital-identity vision. That model is distinct from the cloud biometric templates used by MiPass, and the page does not establish that a credential will be accepted by every broker or unrelated identity provider.[22]