Using programmatic letters for physical KYC address verification.

The illusion of digital-only identity verification and the synthetic fraud crisis

The regulatory mandate: JMLSG Guidance and Regulation 28 Money Laundering Regulations 2017

The PDF utility bill crisis: Inspect Element, Photoshop, and deepfake document factories

The cryptographic physical token workflow: Challenge-response via the letterbox

The 3-step physical verification blueprint: From JSON payload to authenticated account

Code walkthrough: Dispatched KYC verification payload with hashed entropy PIN

src/services/kycAddressVerification.ts — typescript
import crypto from 'crypto';
​
interface KycRecipient {
  firstName: string;
  lastName: string;
  addressLine1: string;
  addressLine2?: string;
  city: string;
  postcode: string;
}
​
interface VerificationChallenge {
  token: string;
  hashedToken: string;
  expiresAt: Date;
}
​
export class KycPostalService {
  private apiKey: string;
  private baseUrl: string = 'https://api.letterapi.uk/v1';
​
  constructor(apiKey: string) {
    this.apiKey = apiKey;
  }
​
  public generateChallenge(): VerificationChallenge {
    // Generate 6-digit secure alphanumeric challenge (avoiding ambiguous chars: 0, O, 1, I)
    const alphabet = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';
    const bytes = crypto.randomBytes(6);
    let token = '';
    for (let i = 0; i < 6; i++) {
      token += alphabet[bytes[i] % alphabet.length];
    }
​
    const hashedToken = crypto.createHash('sha256').update(token).digest('hex');
    const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000); // 7-day TTL
​
    return { token, hashedToken, expiresAt };
  }
​
  public async dispatchKycLetter(userId: string, recipient: KycRecipient, challenge: VerificationChallenge) {
    const qrAuthUrl = `https://app.fintech.co.uk/verify-address?uid=${userId}&tok=${challenge.token}`;
    
    const payload = {
      recipient: {
        name: `${recipient.firstName} ${recipient.lastName}`,
        address_line_1: recipient.addressLine1,
        address_line_2: recipient.addressLine2 || '',
        city: recipient.city,
        postcode: recipient.postcode,
        country: 'GB'
      },
      template: 'kyc_address_pin_v2',
      variables: {
        first_name: recipient.firstName,
        verification_pin: challenge.token,
        qr_code_url: qrAuthUrl,
        expiry_date: challenge.expiresAt.toLocaleDateString('en-GB', {
          day: 'numeric',
          month: 'long',
          year: 'numeric'
        }),
        support_email: 'compliance@fintech.co.uk'
      },
      postage: 'first_class',
      metadata: {
        user_id: userId,
        verification_type: 'physical_kyc',
        compliance_regime: 'MLR_2017'
      }
    };
​
    const response = await fetch(`${this.baseUrl}/letters`, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${this.apiKey}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify(payload)
    });
​
    if (!response.ok) {
      const error = await response.json();
      throw new Error(`LetterAPI dispatch failed: ${error.message}`);
    }
​
    return await response.json();
  }
}

Royal Mail PAF validation and avoiding letterbox mule addresses

Time-to-live (TTL), rate-limiting, and brute-force defenses for physical PIN redemption

The economics of physical verification: £0.86 API cost vs £45,000 synthetic fraud chargebacks

Handling non-standard UK addresses: BFPO, HMOs, student halls, and rural holdings

The developer loop: Testing KYC letter generation in staging with mock Royal Mail webhooks

Transforming compliance from an onboarding roadblock to an impenetrable fraud shield

Ready to eliminate synthetic identity fraud from your onboarding pipeline?