Yes, this purpose shall fall under the legitimate interest (Art. 6 par. 1 let. f GDPR) as an anti-fraud purpose. You need to explain it in the privacy notice but you do not need the consent of the data subject.
Here you can find more information about the legal basis for data processing: