Onboarding wants to drop bank verification to lift signup conversion - what do you own in that call?

## Why this is a judgment call and not a technical one The verification step is doing exactly one thing in threat-model terms: it holds a column whose value the applicant cannot set by typing. It costs them real money to move — the funds have to be there — and that price is the only thing standing between the model and an input surface written entirely by its subject. Removing the step does not remove the column's job; it redistributes the score mass onto columns that cost a keystroke. But the step also costs conversion, and conversion is real revenue. The people asking to drop it are not being reckless; they are looking at an abandonment number at that stage of signup. The decision is a trade between two real quantities, and the reason it lands on a lead rather than on an engineer is that neither side owns both numbers. ## What you own **The dependence.** How much of the score currently comes from the verified column, and how the decision distribution changes without it. If it is a rounding error, say so and stop arguing — that is the honest outcome sometimes, and saying it buys you credibility for the cases where it is not. **The price delta.** The cheapest successful fraudulent application today, and afterwards, in currency and calendar time. This is the sentence the room remembers: today it costs holding real funds through a lookback window, afterwards it costs typing a different number. **The compensating-control assessment.** Which alternatives actually re-price the input surface, and which only look like they do. A rules layer reading the same self-declared columns adds nothing to the adversary's bill. An exposure limit on new accounts does something real: it caps loss while priced signals accrue. A review queue works only with funded hours attached and a stated sampling rate. **The claims you withdraw.** If the priced column goes, anything customer-facing, partner-facing or auditor-facing that describes the model as resistant to applicant misstatement has to change. Do not let a claim outlive the control it rested on. ## What you do not own The conversion target, the growth plan, and the organisation's risk appetite. Presenting a refusal in place of a priced option is how a security function makes itself something to route around. The strong move is a graded proposal with numbers on each rung. ## The graded middle, which usually wins - **Verify late.** Move the check after signup and before the first payout or before a limit increase. Most of the conversion is preserved because the applicant has already invested effort, and the priced signal still arrives before real exposure. - **Verify by exposure.** Require it above a stated declared volume or requested limit. The adversary can dodge it only by declaring less, which caps what the attack is worth. - **Verify a sample.** A stated fraction, chosen unpredictably. This is weaker than it sounds against a single determined applicant and stronger than it sounds against volume abuse, and it needs the sampling rate stated to mean anything. - **Verify on disagreement.** Trigger the check when a declared field conflicts with something cheap you already hold. This concentrates the cost on the applications where the free columns are doing something odd. Each rung has a conversion cost and an adversarial-cost benefit, and putting those side by side is the deliverable. ## Handling the 'it never catches anything' argument Somebody will produce data showing the verification step rarely rejects anyone. Ask whether it caught nothing or deterred everything. A control that prices a field shows up as absence: applicants who would have misstated the figure abandoned at that screen, or never applied. Ask for the abandonment population at that step and what they were declaring before it. If the abandoners were declaring systematically higher volumes than the completers, the step is working precisely as intended and the zero-catch figure is evidence for it, not against. ## Closing the decision properly Whichever way it goes, write down what was decided, on what numbers, and by whom, with a re-review date. If the step is dropped, insist on the exposure cap, on monitoring the distribution of the newly free column — a drift in declared volumes is the visible symptom of the attack becoming free — and on the claim withdrawal. That way the next incident is a review of a choice somebody made with the price in front of them, rather than an argument about who warned whom.