Troubleshooting and FAQs

Make sure the fields required by the products utilized in the workforce verification workflow are passed in the RiskOS Evaluation API request. Please refer to the product documentation for Socure products utilized in the workflow to understand what fields are required by the respective products. For example, if you are utilizing Socure's Digital Intelligence in the account takeover workflow, you would need to pass di_session_token.

Make sure the RiskOS Evaluation API request includes the docv.config field and docv.config.send_message is set to true.

Account takeover fraud is a form of identity theft where a bad actor gains unauthorized access to a victim’s online account.

The process unfolds in three stages:

1. Account Compromise: The fraudster breaches the victim’s account.
2. Access Lockout: They alter account details to lock out the rightful owner.
3. Fraudulent Activity: The compromised account is used for unauthorized transactions or abuse.

Targets include:

• Banking and financial accounts
• Ecommerce accounts
• Social media profiles
• Loyalty program accounts
• Government benefit accounts

Account takeover attacks often begin with one of the following techniques:

• Credential Stuffing: Using botnets to test stolen username/password combos.
• Phishing & Social Engineering: Emails, SMS, or calls trick users into providing credentials or downloading malware.
• Malware & Keyloggers: Software records keystrokes to steal credentials.
• Brute Force Attacks: Automated tools guess passwords using dictionaries or randomization.

Once inside, fraudsters:

• Change credentials, PII, and security settings
• Add unauthorized users
• Request new cards or conduct transactions
• Abuse consumer protections like Regulation E to extract funds

• Logins from unfamiliar devices or locations
• Access during atypical times

• Multiple failed login attempts in a short time
• Spikes in login frequency

• Changes to personal info or security settings

• Uncharacteristic transactions
• Irregular navigation patterns

• Disabled alerts or unexpected contact info changes

KBA asks users to verify identity via questions based on personal info.

Types:

• Static KBA: User-defined questions
• Dynamic KBA: Data-derived questions

Why it's flawed:

• Adds friction before validating identity
• Data used is often leaked or publicly available

To prevent ATO:

• Monitor for early warning signs
• Deploy layered fraud detection (e.g., device, behavior, biometric signals)
• Avoid outdated auth methods like KBA

Use Socure Sigma Identity and Account Intelligence for real-time ATO prevention.