July 15, 2026

Successfully Fighting AI-Powered Fraud with Sigma V4.5

AI has fundamentally changed fraud, shattering our ability to trust what we see. At Socure, we reported AI-based fraud up 8,000% YoY as the cost of fraud is plummeting and sophisticated fraud attacks are launched at scale.

At its core, AI has everyone questioning whether the person or entity on the other end of any transaction is real, creating real problems. Socure is seeing new threat vectors introduced every day, across both fraud types:

Third-Party

– North Koreans infiltrating the corporate workforce using stolen or borrowed real identities

– Fraudsters using deepfakes of real people to bypass document verification

Synthetic

– Fraudsters creating “ghost students,” fabricated identities built to access student loan funds

– Fully synthetic identities created at scale, nearly indistinguishable from real people

Consequently, the old methods used to fight fraud and defend the identity of your customers won’t work. A fundamental new approach must be introduced, which is why we’re excited to announce our Sigma V4.5 model for all of our customers to turn on today.

Continued Evolution to Solve Identity Fraud.

Since Socure’s founding in 2012, we’ve been on a mission to solve identity fraud and protect the identity of consumers and businesses. Every generation of our Sigma fraud model has moved this mission forward. With the announcement of Sigma V4.5, it’s the biggest improvement so far.

The first to introduce a transformer-based model for fraud.

All fraud models today leverage tree-based models as an architectural foundation which have a structural limit. Tree-based models evaluate signals one at a time, following fixed decision paths built on historical fraud patterns. The problem isn’t that these models ignore data. It’s that they can’t evaluate how signals interact with each other. Each feature is assessed in isolation, along a path shaped by what came before it. This creates exploitable gaps: combinations of signals that look unremarkable when evaluated sequentially, but are highly suspicious when seen together.

Sophisticated fraudsters have learned to exploit exactly this, building identities that nudge scores just below the threshold for action, one signal at a time. Closing these gaps requires a model that can see every signal in relation to every other signal, all at once.

Sigma V4.5 started as a question at a Socure hackathon: could transformer architectures (the same technology behind modern large language models) be applied to identity risk? It wasn’t a roadmap item. It was a bet.

We used AI agents to develop initial transformer models specifically for fraud detection. They treated identity as a system, not a sequence of checks. Instead of evaluating signals one at a time along fixed decision paths, this new model evaluated all signals simultaneously, in context. The difference was immediate and clear.

These models detected emerging patterns that existed outside known fraud, and adapted in ways traditional approaches simply could not. They understood how seemingly disparate data points relate to each other, where they reinforce each other, where they conflict, and how they connect to a wider web of activity invisible in any single record. What started as an experiment became the foundation for V4.5.

On top of that foundation, we built a set of proprietary innovations that make V4.5 effective against the fraud patterns legacy systems were never designed to catch:

• Advanced data curation that corrects ground truth at scale. V4.5 draws on a vastly expanded set of label sources, aligns how fraud is defined across organizations, and balances training labels optimally for maximized fraud detection. The result: more data coming in, less noise getting through, and a model that learns attack patterns prior versions of Sigma never saw.
• Deep integration with Socure’s Identity Graph. Socure’s Identity Graph is our proprietary, cross-industry map of identities, devices, IPs, and behaviors that exposes patterns no single institution can see on its own. It captures shared devices, shared infrastructure, and velocity patterns that link seemingly unrelated applicants into coordinated attack networks. When a synthetic or stolen identity starts appearing across dozens of organizations within days, the graph surfaces that behavior in real time. A model trained on a single institution’s data would treat those events as isolated. V4.5 is the first version of Socure’s Sigma fraud models to directly leverage these graph-derived signals, turning Socure’s cross-network intelligence into a detection advantage no competitor can replicate.

We then trained V4.5 on billions of known outcomes across Socure’s network, recognized as the richest identity fraud dataset in the industry.

These are not incremental upgrades. They are capabilities no other vendor has built. And they are the reason V4.5 performs at a level legacy models cannot approach.

The results are showing up in production.

These changes translate to real results. The industry average fraud capture is 36% with a good-to-bad ratio of 6:1. That means that for every fraud that gets flagged, 6 good users also are flagged.

With Sigma V4.5, the entire tradeoff gets virtually eliminated. For an early adopter of Sigma V4.5 processing millions of credit card applications per year, fraud capture reached up to 90% while the good-to-bad ratio dropped to an impressive 1:1.

The cost of capturing each fraudster went from flagging 6 good users, down to 1 – an 83% reduction – all while also capturing almost 3x the amount of fraud. These are the results that change fraud operations altogether.

Existing users of the Sigma suite who upgrade from V4.0 can expect fraud capture performance increases of up to 20%, the result of our fundamental rethinking of how fraud gets captured.

Synthetic fraud capture with V4.5 achieves comparable heights, capturing up to 86% of synthetic frauds for a 1:2 good-to-bad ratio, meaning for every 2 synthetic identities stopped, only 1 user is asked to provide additional evidence. Users of the previous V4.0 generation can similarly expect increases in their fraud capture performance of up to 30% when upgrading to Sigma Synthetic V4.5. The result is that organizations can confidently prevent synthetic identities from opening accounts without impacting customer experience.

Together with Socure’s platform, V4.5 delivers outcomes legacy vendors cannot.

Sigma Identity V4.5 and Sigma Synthetic V4.5 operate within RiskOS®, Socure’s orchestration platform for identity, fraud, and compliance decisioning. Socure provides value to our customers by solving identity holistically and providing you with a layered defense system with no cracks. The key to decreasing friction for good users and catching fraudsters is to use as much data on consumers as possible to quickly identify the good from the bad. Socure’s Sigma v4.5 model now provides additional performance gains that allow you to more confidently say yes to good users.

Sigma V4.5 is the biggest step toward that mission in Socure’s history and it is only the beginning.

Frequently asked questions

What is Sigma V4.5?

Sigma V4.5 is Socure’s latest identity and synthetic fraud detection model, and the first in the Sigma line built on a transformer architecture instead of tree-based models like XGBoost. It’s available now to every Socure customer at no additional cost.

What does "good-to-bad ratio" mean in fraud detection?

A good-to-bad ratio measures how many legitimate consumers get flagged for every fraudster a model catches. A 6:1 ratio means six good consumers are flagged for every fraudster stopped; a 1:1 ratio means only one good consumer is flagged per fraudster caught. The lower the ratio, the less friction a model creates for legitimate consumers at the same level of fraud capture.

How is Sigma V4.5 different from tree-based models like XGBoost?

Tree-based models assess features one at a time along paths built from historical fraud. Sigma V4.5 weighs every signal against every other signal simultaneously, so a borderline signal gets judged in the full context of the identity rather than in isolation.

Is Sigma V4.5 a paid upgrade?

No. V4.5 is available to existing Sigma Identity and Sigma Synthetic customers at no additional cost, and it doesn’t require reintegration.

What is the difference between Sigma Identity V4.5 and Sigma Synthetic V4.5?

Sigma Identity V4.5 focuses on third-party fraud, where a real person’s stolen identity is used without their knowledge. Sigma Synthetic V4.5 focuses on fabricated identities built from a mix of real and invented information. Both run on the same transformer foundation.

Pablo Abreu

Pablo Abreu is Chief Product & Analytics Officer at Socure, a leading provider of machine learning and artificial intelligence technologies that provide a single source of trusted digital identity for online and in-store applications. An industry expert in the area of fraud, identity verification, predictive modeling, machine learning, and artificial intelligence, Abreu has been instrumental in creating Socure’s ID+ predictive analytics platform, now used by many of the leading institutions across banking, lending, crypto, BNPL, online gaming, digital health, telco, and more.