September 2026 Summaries

Socure’s Guardian Consent in RiskOS is designed to address the difficulty of verifying minors, who often lack the credit, financial, and public-record histories used in traditional identity checks and generally cannot independently provide legally binding consent for document and biometric verification. The platform combines guardian verification and consent with verification of the minor, document checks, device and identity intelligence, and fraud-risk assessment across both participants, aiming to preserve high assurance without forcing businesses to accept greater risk, reject younger users, or create manual exception workflows. Guardian Consent can adapt when a business knows a user is a minor from the outset, lacks guardian information, or only discovers the user’s age during verification. The approach reflects a broader shift from simple self-reported age gates toward integrated age assurance that considers identity, consent, privacy, fraud prevention, and age-appropriate online access.

Deepanker Saxena’s experience struggling to establish banking, credit, and housing after moving from India to the United States in 2021 shaped his approach as Socure’s first product hire and later Head of Product. Having encountered the limitations faced by legitimate “thin-file” users with unfamiliar documents and limited U.S. records, he helped broaden identity verification evidence beyond standard domestic documents, including sources such as the National Student Clearinghouse. His teams also focused on equitable face capture using the Monk Skin Tone Scale and accessible identity flows with voice prompts and haptic feedback, helping Socure achieve WCAG 2.2 conformance; the haptic work also unexpectedly improved bot detection by identifying physical differences between devices held by people and those placed on surfaces. Saxena applies the same inclusion-oriented approach to fraud prevention and online child safety, supporting privacy-preserving age verification that returns only an eligibility result rather than collecting or exposing a user’s full date of birth. Recognized in Okta’s 2026 Identity 25, he argues that identity systems should request only the minimum information needed while serving people whose circumstances traditional systems often overlook.

Socure argues that digital identity verification must balance strong fraud prevention with accessibility because inaccessible verification can prevent people with disabilities from opening accounts, accessing services, or proving who they are online. Its Predictive Document Verification product for web, iOS, and Android is designed to reduce visual and physical demands through features such as automatic document capture, passive biometric liveness checks, haptic feedback, screen-reader support, and actionable guidance. The company notes that these design choices can benefit both disabled users and the broader public by simplifying capture and reducing reliance on color, precise movement, or manual actions. Socure evaluates the product against WCAG 2.2 Levels A and AA and applicable Section 508 requirements, including newer criteria related to visible focus, target sizes, redundant entry, consistent help, and accessible authentication. It describes accessibility as an ongoing product responsibility supported by regular independent testing, automated and manual assessments, assistive-technology testing, and Accessibility Conformance Reports based on the VPAT framework.

Crypto malware encompasses malicious software involving cryptocurrency, while ransomware encrypts or blocks access to systems and demands cryptocurrency payments, often alongside theft of sensitive data for extortion. Although ransomware payments declined or remained flat in 2024–2025, reported victims and the median payment increased, reflecting both “big game hunting” against high-value targets and a fragmented ecosystem of smaller groups using ransomware-as-a-service models. Active threats including Medusa, Akira, Interlock, Gunra, RansomHub, and Clop commonly combine encryption with data theft, targeting critical infrastructure, healthcare, finance, government, manufacturing, education, and small businesses through phishing, stolen credentials, exposed remote access, software vulnerabilities, and social engineering. The consequences can extend far beyond restoring locked systems, as leaked personal and financial information can be reused for account takeovers, synthetic identities, and new-account fraud across institutions that were not directly breached. Law enforcement generally advises against ransom payments because recovery is not guaranteed and payments may create legal complications; recommended response measures include isolating affected systems, preserving evidence, notifying authorities, and engaging incident-response specialists. Prevention relies on layered controls such as rapid patching, offline backups, phishing defenses, employee training, network segmentation, multi-factor authentication, and identity verification measures designed to limit downstream fraud.

AI-enabled voice cloning and other synthetic-media scams are undermining phone-based verification for financial transactions, with the FBI’s 2025 Internet Crime Report recording 22,364 AI-related complaints and nearly $893 million in confirmed losses, while Deloitte projects U.S. AI fraud losses could reach $40 billion annually by 2027. Because a voice can reportedly be cloned from only seconds of public audio, familiar speech is no longer a reliable checkpoint for urgent wire transfers, account changes, or card reissues. The passage argues that identity verification should occur before a phone call through analysis of device activity, session behavior, network signals, and other digital patterns associated with the requester, with a real-time digital interaction used when prior activity is unavailable. This approach is presented as more resistant to impersonation because synthetic voices cannot readily reproduce a legitimate user’s consistent device history or behavioral signals. It also notes that FINRA’s 2026 oversight guidance calls for enterprise-level supervision, human review, and documentation of generative AI tools, increasing pressure on firms to strengthen their fraud-control processes.

Cryptojacking is a cyberattack in which criminals secretly use the processing power and electricity of internet-connected devices, including phones, laptops, servers, and cloud systems, to mine cryptocurrency, often Monero through abused tools such as XMRig. It commonly spreads through phishing, malicious downloads or browser extensions, compromised website scripts and ads, weak cloud configurations, or stolen credentials, and may operate in browsers, persist on devices, or run only in memory to evade detection. Warning signs include unexplained CPU or GPU spikes, slow performance, overheating, battery drain, loud fans, and increased electricity or cloud-computing costs. Although individual effects may appear minor, large-scale infections can create substantial business costs, downtime, security exposure, and reputational harm; cited industry research reports a sharp increase in detected attacks during 2023. Cryptojacking can also serve as an entry point for broader fraud because malware may steal passwords and enable account takeover or the creation of fraudulent accounts. Prevention and response measures include prompt patching, cautious treatment of links and attachments, browser and endpoint protections, cloud security audits, monitoring resource usage, malware scans, removal of suspicious processes or extensions, and stronger authentication and identity verification to reduce the impact of stolen credentials.

AI platforms face significant multi-account abuse, in which operators create seemingly new accounts with different emails, phones, or payment methods to repeatedly obtain free credits, compute, and access to advanced tools. The passage argues that common signup checks such as email verification, CAPTCHAs, and payment validation confirm control of individual attributes but do not establish whether an account belongs to a genuinely new user. It recommends assessing connected signals across email and phone history, devices, networks, payments, addresses, identity details, and prior account activity before granting valuable access, while using a passive, risk-based approach that applies additional verification or restrictions only when warranted. It also emphasizes measuring the effects of controls on both abuse reduction and legitimate customer growth, including signup completion, trial activation, paid conversion, resource losses, detection speed, repeat attempts, and the number of legitimate users subjected to extra checks.

Brokerage and retirement accounts with little activity can be especially vulnerable to account takeover because they lack the behavioral history that helps institutions identify unusual logins, transfers, or account changes. Account takeover losses reportedly reached $15.6 billion in 2024, with compromised credentials, intercepted authentication codes, call-center resets, and SIM-porting attacks cited as common entry points. Fraudsters may test stolen credentials across multiple institutions before exploiting an account, making institution-specific monitoring insufficient. The passage argues that effective detection should combine device behavior, session patterns, identity signals, historical customer activity, and cross-platform intelligence rather than relying on credentials or multifactor authentication alone, since coordinated signals are harder for attackers to imitate consistently.

Synthetic identity fraud increasingly combines stolen Social Security numbers with fabricated personal details that are cultivated over months or years to appear legitimate and evade standard verification checks. Deloitte projects U.S. losses of at least $23 billion by 2030, while Juniper Research forecasts global financial-institution fraud losses rising from $23 billion in 2025 to $58.3 billion by 2030; U.S. unsecured credit losses associated with these identities have reportedly grown from $1.8 billion in 2020 to nearly $3 billion. Investment firms digitizing high-net-worth client onboarding may face particular exposure through unpaid margin loans, absorbed trading losses, and fraudulent positions, with estimated average attacks yielding $81,000 to $98,000 and some causing losses in the millions. Because synthetic accounts can look normal and losses may resemble ordinary defaults or poor trades, fraud often remains undetected until after funds have disappeared. The passage argues that static, institution-specific checks are insufficient, citing a 311% rise in synthetic identity document fraud from early 2024 to early 2025, and advocates continuous identity verification and cross-institution data sharing to identify patterns unavailable to individual firms.

A major U.S. insurer detected a subtle rise in suspicious online registrations involving stolen third-party identity details, suggesting fraudsters were attempting to establish accounts for later takeover. Rather than treating the activity as routine noise, the fraud team investigated quickly and determined that registration, traditionally subject to lighter controls than payments or claims, had become a key attack entry point. During the active incident, the team implemented a targeted rule within its existing decisioning system, using Socure’s RiskOS, Global Graph, and Local Graph identity signals to identify the pattern while maintaining step-up verification for uncertain cases. The approach avoided downtime and preserved approval rates for legitimate applicants, while flagged fraud reportedly increased by about 280% within a month and the attack was reduced to a manageable level. The case highlights the importance of treating registration as a fraud decision point, coordinating controls across systems, offering verification alternatives for borderline applicants, and responding rapidly across fraud, product, decisioning, and customer teams.

Socure has expanded its DocV Image Alert List to compare both captured selfies and document headshots against faces from previous transactions, helping detect repeated use of the same person across different identities or altered account details without requiring integration, workflow, API, or configuration changes; selfie-related alerts use the existing R859 reason code. The company also now supports verification of US mobile driver’s licenses through Google and Samsung wallets, retrieving and cryptographically validating credentials directly from supported digital wallets alongside standard document verification. Guardian Consent, a RiskOS feature, enables parents or legal guardians to authorize identity verification for minors under 18 through an auditable, automated workflow. Socure also previewed a next-generation Document Verification platform that will combine document, biometric, device, velocity, PII, network, and consortium signals in a unified predictive model with configurable thresholds, detailed reason codes, and expanded risk visibility.

A reported breach exposing scans of more than 153 million driver’s licenses illustrates how real, valid-looking identity documents can be used at scale by fraud rings and cannot alone establish who is attempting to open an account. Socure argues that fraud prevention must assess the relationship between a credential and its presenter through layered signals, including document forensics, selfie and liveness verification, device and IP history, behavioral patterns, reuse and velocity detection, and network-level fraud intelligence. The company also cites a separate DMV printing error involving mismatched photos and dates of birth as evidence that even legitimately issued credentials may not reliably identify the person presenting them. Its Predictive DocV and RiskOS products are described as combining these signals during capture and enabling adaptive verification steps, such as authoritative-source checks, when session risk warrants them. Socure says its existing approach is designed to detect scenarios involving leaked document scans by evaluating the document alongside the face, device context, presentation behavior, and broader fraud patterns.

Age assurance systems should move beyond a binary choice between behavioral age estimation and high-friction selfie or document checks, as estimation errors can wrongly block legitimate users and verification processes face risks from synthetic identities, fake documents, deepfakes, and injection attacks. A proposed middle layer uses passive identity-linked signals from devices, phones, emails, and addresses to assess confidence and risk without requiring additional user action. Users with consistent, low-risk signals can receive lower-friction access, while those near an age threshold, with conflicting indicators, or seeking high-risk access can be escalated to stronger verification. Because most users are adults, this approach can reduce unnecessary verification while limiting collection of sensitive data. Age assurance is increasingly becoming an ongoing product and compliance function rather than a one-time signup screen, particularly as regulatory developments such as the proposed August 2026 Meta settlement emphasize robust controls, continuous improvement, independent oversight, explainable decisions, and demonstrable protection of minors.

AI-enabled fraud has reportedly surged sharply, prompting major technology, cybersecurity, and financial organizations to call for stronger authentication and traceable, accountable AI agents. The passage argues that AI security has focused largely on model behavior while overlooking the identity of the people or entities using AI systems, a gap that can enable fraud, influence operations, sanctions evasion, and threats to critical infrastructure. As access to advanced AI models becomes more restricted, platforms face pressure to improve onboarding and recognize coordinated malicious activity across related accounts, devices, businesses, and identities. Rather than applying burdensome verification to every user, the proposed approach uses passive, networked identity signals for real-time risk assessment and escalates uncertain or high-risk cases before granting access to sensitive tools. It concludes that identity verification should become a central AI security control that protects platforms without unnecessarily undermining product-led growth.

A Socure webinar featuring underwriting innovation leaders from Transamerica and Nationwide examined how life insurance underwriting has evolved from agent-led, face-to-face assessments to digital, data-driven, direct-to-consumer processes. Speakers described how e-applications, accelerated underwriting, and electronic health and prescription data have enabled faster decisions while increasing the importance of reliable identity verification and fraud prevention. They argued that speed need not weaken risk discipline when insurers use high-quality data to identify which applicants require additional review, citing Transamerica’s reported growth in individual life sales associated with instant-decision offerings. Identity verification was presented as an increasingly front-end, largely passive process that minimizes friction for most legitimate applicants while applying targeted checks to a small number of cases, helping reduce fraud-related costs. The discussion also emphasized that coordination among distribution, underwriting, risk, and compliance teams can be built through incremental, data-backed pilots focused on specific business problems rather than broad technology transformations.