How do you detect a rented gig worker account?

We use a single identifier (such as the account's phone number) to build a profile of the real owner, then compare it against operational signals like device ID and location to surface the likely renter's separate identity.

What is the difference between continuous identity verification and KYC?

KYC is a one-time onboarding check. Continuous identity verification is the ongoing process of ensuring the person using the account is still the verified owner — on every session or transaction.

Can platforms like Uber or DoorDash see this themselves?

Platforms can detect suspicious internal signals like a new device or location, but they typically cannot see external data — breach records, dark web chatter — needed to confirm two different people are involved.

How does Sixtyfour trace the real person behind an account?

Our agents use an OSINT-based approach: take a known identifier, search across public records, social media, and breach databases, then resolve them into a single high-confidence identity graph.

How We Use Agents to Detect Rented Gig-Worker Accounts

The app said a woman was delivering her food. A man showed up. He had paid $65 for that account on a Facebook group. This is what a verification gap looks like in the real world.

The Problem

The February 2025 Wilbraham, MA Uber Eats assault was committed by a man using a rented account registered to a woman.
1 in 4 gig workers has rented or sold their verified account; this rises to nearly 1 in 3 for Millennial and Gen Z drivers.
Standard KYC and background checks at signup miss this completely. The problem is a failure of continuous identity verification, not onboarding.

The Gig Economy's Continuous Identity Problem

Every major gig platform runs background checks. The accounts are legitimate. The people who passed are real. The issue is what happens after verification.

These accounts are openly traded in private Facebook groups and Telegram channels for anywhere from $65 to over $400 a month. The platform recognizes a valid account ID, but the trust-and-safety team is unaware of the transaction that put an unvetted person behind the wheel.

How We Trace the Real Person

The Input: A Flagged Account

An investigation starts with a driver account for "Sarah L." Flagged for a sudden spike in negative reviews and trips running 18 hours a day. The only hard data point: her phone number.

The First Trace: Anchoring the Real Owner

Our agent cross-references the phone number against our identity graph, breach data, and public social profiles. Within seconds: LinkedIn, GitHub, forum usernames, and two breach records — all linking back to the same person.

The Second Trace: Surfacing the Renter

The device ID logging trips is an Android model Sarah has never used. Trip origins are 60 miles from her address. Active hours don't align with her social posts. Our agent finds the renter on a dark web forum using a password fragment from one of Sarah's old breaches.

How Identity Resolution Differs From Standard KYC

Traditional KYC answers one question: is this person who they say they are right now? Our agents answer a different one: who is this person, everywhere?

The Input — A single flagged identifier: email, phone, username, crypto wallet, or name.
The Search — Cross-referenced across Sixtyfour's proprietary databases, dark web sources, breach records, social profiles, and public records.
The Resolution — An LLM-driven inference layer weighs signal quality and maps resolved entities into a unified graph.
The Output — A graph of connected accounts with confidence scores. Not a single data point — a complete picture.
What We Don't Do — No IP-based ID, no device fingerprinting, no private platform data, no legal determinations.