Why age verification is a conversion problem disguised as a fraud problem

Fraud attempts against age-restricted merchants usually arrive looking like everything else in the fraud catalogue. Counterfeit IDs printed well enough to fool a bouncer. Stolen credentials bought in bulk. Synthetic identities assembled from real fragments of a dozen different people, patiently aged until they look like credit history.

Occasionally one arrives with a marker.

Earlier this month, FUGU flagged a transaction at one of our age-restricted merchants: a twelve-year-old attempting to buy a vape, caught on an identity mismatch. Instead of abandoning the attempt, he escalated. First, an AI-generated selfie — rejected instantly. Then a second attempt, this time a real selfie taken live, with a mustache drawn on his upper lip in Sharpie.

It’s a funny story. It also points at something that should concern every operator running an age-gated storefront.

That attempt failed because it was obvious. The attempts worth worrying about are the ones that don’t need a mustache.

The obvious ones are not the population

Telemetry published by identity vendor Shufti suggests that close to one in four attempted sign-ups at age-gated sites come from suspected minors. That figure deserves a caveat — it reflects one vendor’s own traffic rather than an independent study, so it’s directional rather than definitive. But even discounted heavily, it describes a problem that is structural, not anecdotal.

More significantly, the tactics have professionalized. What a determined minor can access today, for free or for a few dollars:

Deepfake selfies that survive liveness checks. Consumer face-swap apps are now good enough to defeat passive liveness on a mid-tier verification stack. The blink test stopped being a test years ago.

Borrowed sessions from verified adults. This is the quietest vector and the hardest to catch. The parent’s account is real. The card is real. The verification passed legitimately, eighteen months ago. Nothing about the transaction looks synthetic because nothing about it is synthetic — the wrong human is simply holding the phone.

AI-generated identity documents. Template-accurate, correctly formatted, with plausible document numbers and consistent typography. Document forensics catches many of them. Not all of them.

VPNs and jurisdiction shopping. An age gate that depends on geography is a suggestion.

Meanwhile, a meaningful share of platforms selling age-restricted goods are still running the same control they ran in 2009: a date-of-birth dropdown. That is not verification. It’s a formality with a UI.

The regulatory clock is now the loudest signal

For most of the last decade, age assurance was a compliance checkbox merchants met at the lowest defensible cost. That window is closing.

The EU’s Digital Services Act and the UK’s Online Safety Act both moved age assurance from best practice toward legal obligation. Australia implemented a ban on under-16s accessing social media. In the United States, the FTC finalized amendments to its COPPA regulations in April 2025, a wave of state-level bills advanced, and in June 2025 the Supreme Court upheld a Texas law requiring age verification for sites hosting sexually explicit material — signalling that verification mandates can survive First Amendment challenge.

The details differ by jurisdiction, and the debate over the privacy costs of these regimes is real and unresolved. But the direction of travel isn’t ambiguous. “We asked for a birthdate” is becoming an indefensible answer.

The part that doesn’t make it into the compliance deck

Here is where age-restricted commerce diverges from ordinary fraud prevention, and where most merchants get it wrong.

In classic fraud, the adversary and the customer are different people. Tighten the screws and the collateral damage is measurable but bounded.

In age verification, the adversary is standing in the same queue as the merchant’s best customer, and every control deployed lands on both of them identically. Each step added to stop a fifteen-year-old also hits the forty-year-old reordering the same product she bought last month.

The cost isn’t theoretical. Baymard’s checkout research puts it in plain view: among shoppers who abandon for reasons other than idle browsing, 19% leave because they don’t trust the site with their card information, 18% because the site forces account creation, and 17% because checkout is too long or too complicated.

Read those three together. They describe a single failure mode — the store asked for more than the shopper was willing to give at that moment — and collectively they account for more abandonment than any cause except shipping costs.

So the real problem isn’t “how do we stop minors.” It’s “how do we stop minors without paying for it three times over in abandoned carts.”

Locking the door harder doesn’t solve that. It relocates the loss from one line of the P&L to another.

A smarter door, not a heavier one

The platforms handling this well have stopped treating age assurance as a single gate and started treating it as a risk decision. In practice, that means layering signals rather than stacking checkpoints:

• Liveness detection that tests for injection and replay attacks, not just for movement.
• Document forensics examining the artifacts of generation — compression inconsistencies, template drift, font substitution — rather than whether the layout looks correct.
• Biometric age estimation, which answers “is this face plausibly over 18” without demanding a government ID from every visitor.
• Behavioural risk scoring across the session: device history, navigation and input patterns, time of day, and the relationship between the registered account holder and whoever is currently operating the account.
• Step-up challenges triggered on suspicion only. This is the load-bearing element. A challenge every user sees is a tax. A challenge 3% of users see is a control.

The design principle underneath all of it: friction should be earned. Clean users should never encounter a wall they didn’t trigger.

Where post-checkout changes the math

There’s one further move available, and it’s the one FUGU was built around.

Most verification architectures are synchronous. The check sits inside the purchase path, the shopper waits, and every millisecond of that wait is charged against conversion. That framing forces a genuine trade-off: more certainty costs more customers.

Decoupling changes the shape of the problem. When verification runs alongside and after the transaction rather than blocking it, merchants are no longer choosing between certainty and conversion on a single axis. Clean orders complete at full speed. Suspicious ones get investigated with more signal than existed at the moment of checkout — post-purchase behaviour, device consistency, fulfilment patterns — and are held, stepped up, or reversed before goods move.

For age-restricted merchants this matters more than it does elsewhere, because the consequence of a false negative isn’t a chargeback. It’s a regulator, a licence, and a headline.

The point

The goal was never to catch the Sharpie mustache. That one caught itself.

The goal is a system where the attempt that doesn’t need a Sharpie — a working deepfake, a parent’s verified session, and patience — still doesn’t get through, while the adult behind it in the queue never notices anything happened at all.

Most platforms are still tuning the wrong dial. They’re asking how much friction to add. The better question is how precisely they can aim it.

Where’s the line between protecting the platform and protecting the conversion rate?