Depends on the level of KYC. If you're just doing social and birthdate, its easy to bypass. You could add additional checks like check phone and email which are readily available from data brokers. You could send a physical mail to the address in the credit report with a PIN. It depends on level of the level friction you want your KYC program to go. When I built a KYC at a neobank, we focused more on verifying that you were in the US. We could detect proxies and if you make the signup in a mobile app, you can pin the cert which will stop automated attacks. We relied on fingerprinting devices but a lot of methods don't work due to mobile OS providers cracking down on them.