## Before you start

Make sure you have the following:

Access to the RiskOS™ Dashboard with the **Login and Authentication** solution enabled.

- Your account owner or administrator can enable this for you. If you're unsure who to contact, [reach out to support](mailto:support@socure.com) for assistance.

A basic understanding of RiskOS™ workflows and components.

- If this is your first time working with workflows, review the [Workflow overview](https://help.socure.com/riskos/docs/workflow-overview) to understand inputs, enrichments, routing logic, and decisions.

## How it works

Login and Authentication evaluates login attempts using a layered approach that combines device intelligence, identity risk signals, and step-up authentication when required.

At a high level, the workflow:

- Evaluates device and session risk  
- Screens identifiers against allow/deny and alert lists  
- Assesses phone and email risk  
- Detects SIM swap activity  
- Applies step-up authentication when risk thresholds are exceeded  
- Returns a final decision with reason codes and audit trails

Final outcomes include:

- **Accept**  
- **Manual Review**  
- **Reject**

### How Login and Authentication fits into a workflow

In RiskOS™, you build workflows by connecting reusable components. Login and Authentication is a **preconfigured use-case workflow** composed of enrichments, scorecards, conditions, and decisions.

Once triggered, the workflow orchestrates all checks and returns a single decision outcome.

For more detail on workflow components, see [Workflow Steps](https://help.socure.com/riskos/docs/workflow-steps).

### Execution flow in RiskOS™

Login and Authentication runs synchronously, with **conditional asynchronous step-ups** (for example, One-Time Passcode (OTP) or Document Verification) applied only when risk warrants additional verification.

1. ### Data collection

Collect Digital Intelligence (DI) session token, phone number and/or email as the minimal input needed to begin the flow.

2. ### API call to RiskOS™

RiskOS™ receives the input data and triggers the Account Takeover workflow to retrieve and enrich identity information.

3. ### Digital Intelligence (DI) scoring

A configurable, weighted scorecard evaluates device signals, behavioral signals, and Entity Profiler to assess device risk.

4. ### Allow/Deny lists

RiskOS™ cross-checks email, phone, IP address, and device against your configured Allow/Deny lists.

5. ### Alert List check

The workflow checks phone and/or email against the Alert List for fraud associations.

6. ### Verify phone and/or email

If you provide phone and/or email, the workflow evaluates them for risk using Phone Risk and Email Risk respectively.

7. ### SIM Swap check

If you provide a phone number, the workflow evaluates it for SIM Swap.

8. ### Conditional One-Time Passcode/Document Verification

Based on configured thresholds, RiskOS™ may require step-up authentication such as One-Time Passcode (OTP) or Document Verification (DocV).

9. ### Final decision

RiskOS™ applies decisioning logic (`Accept`, `Manual Review`, or `Reject`) to complete the Account Takeover workflow.

### Workflow components used by Login and Authentication

| Component | Purpose |
| --- | --- |
| Input | Collect session and identifier data |
| Enrichment | Evaluate device, phone, and email risk |
| Rule Score Cards | Aggregate device and behavioral risk |
| Condition | Apply thresholds and step-ups |
| On Hold | Pause workflow for OTP or DocV |
| Decision | Emit final authentication outcome |

## Configure Login and Authentication

### Enable required enrichments

Your Socure account team provisions a standard Account Takeover workflow with the following entitlements:

- Digital Intelligence  
- Alert List  
- Phone Risk  
- Email Risk  
- SIM Swap  
- One-Time Passcode  
- Document Verification

### Configure Allow / Deny lists

Configure allowlists and denylists for:

- Email addresses  
- Phone numbers  
- IP addresses  
- Devices

The workflow evaluates these lists early in the process.

### Configure inputs and routing

Typical configuration steps include:

- **Digital Intelligence scorecard**  
  - Assign positive or negative weights to risk signals.  
  - Use the aggregated score to determine when to reject or step up.  
- **Reject conditions**  
  - Reject when identifiers appear on deny lists.  
  - Reject when phone or email risk is high and SIM swap checks fail.  
- **Step-up triggers**  
  - Configure OTP or DocV when risk thresholds are exceeded or signals conflict.

You can start from the `account_takeover_v1_06042025` workflow template to accelerate setup.

If you’re unsure how to tune thresholds or routing, reach out to [support](mailto:support@socure.com) with context about your use case.

### Save and publish

Once your workflow is configured, publish it to go live.

> Most customers start with a Socure-provided best-practice workflow and iterate over time.

## Workflow testing checklist

Get your API keys from the RiskOS™ Dashboard

Integrate Socure’s Digital Intelligence

Integrate with the DocV SDK if stepping up for document verification or selfie re-verification

Configure optional step-up modules (One-Time Passcode and/or DocV)

Set thresholds for Accept, Reject, and Review

Test with sample data and confirm expected routing

Deploy to production and monitor results in the RiskOS™ Dashboard.