Complying with GDPR

Yes, this purpose shall fall under the legitimate interest (Art. 6 par. 1 let. f GDPR) as an anti-fraud purpose. You need to explain it in the privacy notice but you do not need the consent of the data subject.

Here you can find more information about the legal basis for data processing:

• Is consent needed? Six legal bases to process data according to GDPR: https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/
• Four main questions for obtaining and managing data subjects’ consent under GDPR: https://advisera.com/eugdpracademy/knowledgebase/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/

If you need to understand how to implement EU GDPR in your project you may consider enrolling in our free EU GDPR Foundations Course: https://advisera.com/training/eu-gdpr-foundations-course/