Proof of Address: Verifying Where Someone Lives Without Overcollecting

Most KYC programs treat proof of address as an afterthought — a utility bill uploaded, glanced at, and filed. Yet address is frequently the field fraudsters manipulate first, because it rarely faces the same scrutiny as identity documents. It also tends to be the point where onboarding collects far more than the obligation requires. This is general information, not legal advice, but the tension is worth examining: how do you confirm where someone lives without harvesting a document that reveals their consumption, income, and banking relationships?

Why Address Verification Exists At All

Address is a control input, not a formality. It anchors a customer to a jurisdiction, which determines applicable sanctions regimes, tax reporting, and licensing scope. It feeds geographic risk scoring. And it provides a physical nexus for legal process. Under most frameworks, residential address is part of the Customer Identification Program data set that must be collected and, in higher-risk cases, verified against an independent source.

The problem is that the standard evidence — a utility bill, bank statement, or tax notice — carries a payload of unrelated data. A single bank statement can expose account numbers, transaction history, balances, and salary. You asked for one field (the address line) and received a financial dossier. Once that document sits in your storage, it is in scope for every breach, subject access request, and retention obligation you carry.

Sources, Ranked by Independence

Not all address evidence is equal. The strongest sources are those the applicant cannot easily fabricate and that a third party maintains:

• Authoritative registries: Electoral rolls, population registers, and government address databases where available. These are queryable without a document ever changing hands.
• Credit bureau footprint: A match against a bureau's address history confirms residence over time, not just a single billing cycle.
• Bank-sourced data: Open banking APIs can return a verified address held by a regulated institution, without transmitting statement PDFs.
• Documentary evidence: Utility bills and statements — the fallback when nothing else reaches the address. Weakest, because they are the easiest to forge or reuse, and the heaviest in extraneous data.

Ranking sources lets you set a policy that prefers data-only checks and falls back to documents only when the applicant's jurisdiction or profile leaves no alternative. That ordering is a data-minimization decision as much as a fraud one.

Common Attack Patterns

Address fraud is quieter than document forgery but no less common. Watch for:

• Recycled documents: The same bill submitted across multiple applications, sometimes with a swapped name. Perceptual hashing of uploaded images catches exact and near-duplicate reuse.
• Template edits: A genuine bill with the address field altered. Inconsistent fonts, misaligned baselines, and metadata that postdates the stated billing period are signals.
• Mail-forwarding and CMRA addresses: Commercial mail receiving agencies presented as residences. Cross-reference against known forwarding-address lists.
• Cluster addresses: A single address appearing across many unrelated accounts, a marker of mule networks or synthetic rings.

None of these require you to retain the full document to detect. A hash, a normalized address string, and a match result are usually enough to preserve the audit trail while discarding the raw file.

Collecting Less, Proving More

The design goal is a verified result with a minimal residue. In a chat-based flow, you can ask for the address as structured input, run it against a registry or bureau in the background, and return a pass or fail without ever storing an image. Where a document is unavoidable, capture it, extract and normalize the address line, record the match outcome and a redaction-safe reference, then apply a short retention window to the original — deleting it once the verification decision is logged.

The record that survives an audit is the decision and its evidence, not the artifact itself. A verification event with a source, a timestamp, and a match score demonstrates you performed the check. Keeping the customer's bank statement for five years demonstrates only that you took on risk you did not need. Configure retention to match the obligation, and let the rest expire.