Transparency and Control in the Age of AI and Complex Fraud

Outperform: Enhancing Fraud and ATO Detection

Outperform: Enhancing Fraud and ATO Detection Across the Customer Journey with Improved Email, Phone, and Address RiskScores

web 8399661885 blog image for riskos launch 1 720 (1)

One Platform, Infinite Possibilities: The End of Fragmented Risk Management with RiskOS®

WEB_Email-Domains_2025-05_BlogGraphics_Thumbnail

The Shape-Shifting Domains of Digital Fraud Rings

We’re living through a perfect storm of AI innovation and exploitation.
In a global, digital-first economy, every business has become a target. Digital transformation has created vast attack surfaces that legacy systems weren’t built to protect. 
At the same time, <a href="https://www.socure.com/glossary/identity-fraud">fraud</a> itself has industrialized. Sophisticated schemes are now an on-demand service available to anyone, and Fraud-as-a-Service is making attacks faster, cheaper, and more effective, raising the stakes for enterprises across every sector.
Against this backdrop, enterprises need transparent, granular data to fuel their own models and combat complex threats with tailored strategies.
<h2>Introducing Socure Signals</h2>
For the first time, Socure is opening access to the feature store that powers our <a href="https://www.socure.com/products/sigma-identity-fraud">Sigma fraud models</a>, <a href="https://www.socure.com/blog/the-what-and-the-how-of-document-verification-in-the-tech-era">ID document verification</a>, and RiskScore solutions — the very engine that drives the industry’s most accurate identity and risk decisions.
With Socure Signals, enterprises can now tap into the same building blocks behind our best-in-class models, gaining transparency, flexibility, and intelligence at a scale never before available.
It’s a milestone in our journey to deliver an open, highly configurable <a href="https://www.socure.com/solutions/riskos">risk intelligence platform</a> — one that gives enterprises the flexibility to build, adapt, and fine-tune defenses to their unique needs.
<h2>A unique, multidimensional view of risk</h2>
Today, Socure Signals unlocks more than 250+ new features (with rapid expansion ahead) across three categories — each capturing a different dimension of risk.
<h3>1. Input-Derived Signals: Grounding Every Decision in Data</h3>
Input-derived signals are the most straightforward. They come directly from PII, documents, <a href="https://www.socure.com/glossary/biometric-verification">biometrics</a>, and behavioral interactions — the building blocks behind Socure’s models.
These include details like <a href="https://www.socure.com/products/sna-otp">phone carrier type</a>, whether a number is prepaid, or the age of an email domain. They extend into document barcode fields (e.g., Real ID or Veteran ID), <a href="https://www.socure.com/glossary/selfie-id-verification">biometric outputs from selfies</a> such as pose or liveness, and even behavioral metrics like click paths or copy-paste usage.
Why they matter: These signals allow enterprises to see the same foundational attributes that Socure uses to ground its risk decisions. Today, customers see a score along with reason codes that highlight contributing factors (e.g., “IP far from address” or “new email domain”). With Signals, they gain the underlying detail — not just that the email is new, but that it’s from an uncommon domain representing less than 0.1% of traffic, and one that has suddenly tripled in usage over the past few days — a pattern strongly correlated with an active fraud attack. 
Where you’ll find them: Input-derived signals are available as part of our <a href="https://www.socure.com/products/sigma-identity-fraud">Sigma Identity Fraud</a>, <a href="https://www.socure.com/products/sigma-synthetic-fraud">Sigma Synthetic Fraud</a>, <a href="https://www.socure.com/products/sigma-first-party-fraud">Sigma First-Party Fraud</a>, <a href="https://www.socure.com/products/document-verification">Predictive DocV</a>, and RiskScore (<a href="https://www.socure.com/products/phone-risk">Phone</a>, <a href="https://www.socure.com/products/address-risk">Address</a>, <a href="https://www.socure.com/products/email-risk">Email</a>) solutions.
<h3>2. Model-Derived Signals: Sophisticated Outputs from Socure’s AI</h3>
Model-derived signals capture the power of Socure’s proprietary internal models — advanced, probabilistic features that go beyond raw inputs to surface deeper patterns of risk.
These include perplexity scores that identify machine-generated or randomized identifiers, as well as computer vision variables that detect subtle document tampering, <a href="https://www.socure.com/blog/injection-attacks-identity-verification">injection attempts</a>, or presentation attacks. 
Why they matter: Model-derived signals transform raw inputs into advanced features that boost <a href="https://www.socure.com/glossary/fraud-prevention">fraud detection</a> and integrate smoothly with your models.
Where you’ll find them: Model-derived signals are available as part of our <a href="https://www.socure.com/products/sigma-identity-fraud">Sigma Identity Fraud</a>, <a href="https://www.socure.com/products/sigma-synthetic-fraud">Sigma Synthetic Fraud</a>, <a href="https://www.socure.com/products/sigma-first-party-fraud">Sigma First-Party Fraud</a>, <a href="https://www.socure.com/products/document-verification">Predictive DocV</a>, and RiskScore (<a href="https://www.socure.com/products/phone-risk">Phone</a>, <a href="https://www.socure.com/products/address-risk">Address</a>, <a href="https://www.socure.com/products/email-risk">Email</a>) solutions.
<h3>3. Graph-Derived Signals: Seeing the Bigger Picture</h3>
Graph-derived signals draw on Socure’s proprietary <a href="https://www.socure.com/products/graph-intelligence">Identity Graph</a>, which links billions of entities, devices, and behaviors across industries. This intelligence operates on two dimensions — a local view tuned to your own ecosystem, and a global view powered by SocureID and the network — together providing context that no single perspective could deliver on its own.
<ul>
<li style="font-weight: 400;" aria-level="1">Local Graph: Within your own ecosystem, the Local Graph connects identity attributes across lines of business and channels, detecting patterns like repeat abuse, shared devices, or velocity spikes unique to your customers. 
</li>
<li style="font-weight: 400;" aria-level="1">Global Graph (SocureID): Powered by the entire Socure network, the Global Graph aggregates corroborated signals across industries, surfacing cross-institution <a href="https://www.socure.com/blog/shape-shifting-domains-of-digital-fraud-rings">fraud rings</a>, abnormal velocities, anomalous volumes, and consortium-level <a href="https://www.socure.com/glossary/first-party-fraud">first-party fraud</a> patterns. It tracks the history of identities and identity elements across time — such as how a phone, email, or device has been used, repurposed, or linked to risky behavior — giving enterprises a longitudinal view no single institution could assemble alone. This perspective enables contextual inferences about identities — from device ownership and residential stability, to education footprint, and employment indicators.</li>
</ul>
Why they matter: Local Graph signals reveal hidden connections across your own ecosystem — linking identities, devices, and behaviors across channels and lines of business for faster, sharper investigations. Global Graph signals extend that visibility across the entire Socure network, surfacing cross-institution fraud rings, velocity anomalies, and emerging trends that no single enterprise could detect on its own. Together, they provide the complete context to stop fraud sooner and reduce friction for trusted customers.
Where you’ll find them: Local Graph-Derived Signals will be available in <a href="https://www.socure.com/solutions/riskos">RiskOS</a>, ready for integration in any decisioning workflows, and shown in individual entity profiles for investigation context. Global Graph-Derived Signals will be delivered as part of Socure’s <a href="https://www.socure.com/products/graph-intelligence">Graph Intelligence solution</a>.
<h3>What this means in the real world</h3>
If you’re already using Socure’s industry-leading model scores and reason codes, you have a powerful foundation. Signals give you the added power to:
<ul>
<li style="font-weight: 400;" aria-level="1">Tailor defenses to your unique populations and user journeys </li>
<li style="font-weight: 400;" aria-level="1">Target the fraud problems that matter most to your team </li>
<li style="font-weight: 400;" aria-level="1">Power your own models with rich, cross-network data </li>
</ul>
A top-tier <a href="https://www.socure.com/industries/fintechs">fintech</a> recently partnered with Socure to stop fake accounts from getting into their platform and develop deployable strategies to enhance the performance of their internal fraud models. 
Our team began by analyzing a large sample of booked and labeled accounts to identify which signals were most predictive for their population. 
One key finding included systemic fraud concentrated within a few specific phone carriers (input-derived signal) — each showing &gt;90% fraud rates. 
By introducing custom rules to step up verification for applicants using these carriers, the fintech could disrupt coordinated fraud ring activity and prevent additional losses before they scaled.
Additionally, by combining dozens of identified Signals with Socure’s predictive model scores from <a href="https://www.socure.com/products/sigma-identity-fraud">Sigma Identity Fraud</a>, <a href="https://www.socure.com/products/sigma-first-party-fraud">Sigma First-Party Fraud</a>, <a href="https://www.socure.com/products/sigma-synthetic-fraud">Sigma Synthetic Fraud</a>, and RiskScores, the fintech was able to capture 81% of fake accounts that had previously bypassed their defenses.
And that’s just the tip of the iceberg.
<h2>Getting started</h2>
Signals aren’t abstract data points — they’re practical tools that help enterprises solve real problems with precision. 
With more than 250 new signals available, Socure is giving customers direct access to the same features and insights that power the industry’s most accurate identity and fraud models.
Ready to see what’s possible? <a href="https://www.socure.com/talk-to-an-expert">Talk with a Socure expert today to get started.</a>

WEB_Signals launch blog_thumbnail_2025-09 (2) (1)

Transparency and Control in the Age of AI and Complex Fraud

Related Posts

Emma Griffin