November 2025 Summaries

Fast-growing fintechs and banks face their greatest onboarding challenge with applicants whose identity signals are plausible but inconclusive, requiring a balance between conversion and fraud prevention. Socure’s Verify and Verify+ can assess identity, device, network, and behavioral data first, then route ambiguous cases through a consent-based eCBSV check that compares submitted name, date of birth, and SSN details with government records, optionally followed by document verification for a small remaining group. Reported deployments across brokerages, digital banks, investing platforms, and gaming services have produced approval and verification lifts, particularly among younger or difficult-to-verify applicants, while maintaining loss rates and reducing manual reviews. A positive government-record match can support approval and a non-match can halt inconsistent applications, while Socure’s RiskOS orchestration platform enables firms to test and adjust these targeted workflows in real time.

Recycled phone numbers pose a growing identity-fraud risk for buy now, pay later providers and other digital services that treat SMS codes and phone possession as proof of identity, since roughly 35 million U.S. numbers are reassigned annually and may remain connected to former owners’ accounts. Attackers can obtain recently reassigned numbers, use them to receive password-reset or multi-factor authentication codes, and exploit other weaknesses such as SIM swaps, porting, or session replay before victims update their account details. The passage argues that conventional checks based on number tenure, carrier history, and active status cannot reliably detect changes in current ownership, while email-only alternatives may create added user friction. It presents Socure’s Dynamic Ownership Scoring and Five-Tier Framework as a real-time, data-driven approach that combines ownership, device, carrier, network, and behavioral signals to apply authentication measures according to risk, claiming this can preserve low-friction experiences for legitimate users while reducing recycled-number account takeovers across financial services, e-commerce, marketplaces, and digital payments.

A global remittance provider improved KYC approval rates by using its existing data more effectively rather than adding data sources or changing policies. In a proof of concept using identical rules, Socure’s adaptive identity-verification model applied broader data coverage, graph intelligence, and data normalization to standardize regional variations in addresses, postal codes, and date formats before decisions were made. The analysis found that formatting inconsistencies alone had caused rejections of 1.8% of addresses and 1.3% of dates of birth, while relaxing day-month date transpositions produced a further 5.3% approval increase without added risk. Across 60,000 labeled transactions, U.S. approvals rose from 60% to 70%, with similar global gains, fewer false positives and manual reviews, and stable fraud and loss rates, suggesting that adaptive interpretation of inconsistent identity data can recover legitimate customers previously blocked by rigid validation.

Account takeover fraud often exploits weak or fragmented verification processes across login, account recovery, profile updates, and contact centers, using methods such as stolen credentials, SIM swaps, spoofed caller IDs, and cloned voices. The text argues that adding authentication friction can inconvenience legitimate customers without reliably stopping attackers, particularly when separate teams and systems lack a unified view of risk. It illustrates call-center and digital-login attacks in which fraudsters use personal data, compromised phone numbers, proxies, and device emulation to gain access and change account details. As a proposed response, Socure promotes a risk-based authentication approach that combines phone and SIM-swap signals, device and behavioral intelligence, network authentication, one-time passcodes, and document-and-selfie verification, escalating checks only when suspicious activity is detected.