## Before you start

Make sure you have the following:

Access to the RiskOS™ Dashboard with the **Sigma First-Party Fraud** enrichment enabled.

- Your account owner or administrator can enable this for you. If you're unsure who to contact, [reach out to support](mailto:support@socure.com) for assistance.

A basic understanding of RiskOS™ workflows and components.

- If this is your first time working with workflows, review the [Workflow overview](https://help.socure.com/riskos/docs/workflow-overview) to understand inputs, enrichments, routing logic, and decisions.

## How it works

Sigma First-Party Fraud is a fraud detection enrichment available in RiskOS™. It evaluates identity and account attributes against consortium data to identify signals associated with first-party abuse.

Sigma First-Party Fraud returns:

- **Fraud risk scores**: Indicate the likelihood of first-party abuse.
- **Risk signals**: Surface relevant behavioral patterns and anomalies.
- **Reason codes**: Explain the contributing factors behind the assessed risk.

These outputs can be used to inform routing, review, or escalation decisions in your workflows.

### How Sigma First-Party Fraud fits into a workflow

In RiskOS™, workflows are built by connecting reusable components. Sigma First-Party Fraud is added as an **Enrichment** step.

Once the enrichment runs, its outputs are available to downstream workflow components, including:

- Conditions
- Decision rules
- Rule score cards
- Manual review steps
- Final decisions

For more detail on these components, see [Workflow Steps](https://help.socure.com/riskos/docs/workflow-steps).

### Execution flow in RiskOS™

Sigma First-Party Fraud runs synchronously as part of a RiskOS™ workflow. There is no user handoff or pause in execution.

```
Input

First-Party Fraud

Routing logic

Decision
```

At a high level, the execution flow looks like this:

1. **Input**  
   You call the Evaluation API with identity and account attributes.
2. **Sigma First-Party Fraud enrichment**  
   RiskOS™ evaluates the provided attributes against consortium data and returns fraud risk scores, signals, and reason codes.
3. **Routing logic**  
   The workflow evaluates risk scores, signals, and reason codes.
4. **Decision**  
   The workflow returns a final outcome (for example, **Accept**, **Review**, or **Reject**).

### Workflow components used by Sigma First-Party Fraud

Sigma First-Party Fraud uses a subset of standard RiskOS™ workflow components.

| Component | Purpose | Typical input | Output / What to use next |
| --- | --- | --- | --- |
| **Input** | Start an evaluation | Identity and account attributes | Workflow execution begins |
| **Enrichment** | Detect first-party fraud | — | Risk score, signals, reason codes |
| **Condition** | Branch based on risk or signals | Fraud risk outputs | Route to appropriate path |
| **Decision Rule / Score Card** | Apply policy or scoring logic | Fraud risk outputs | Pass/fail or cumulative risk classification |
| **Decision** | Emit final outcome | Routed value | Accept / Review / Reject |

## Configure Sigma First-Party Fraud

### Add Sigma First-Party Fraud to a workflow

1. In the RiskOS™ Dashboard, go to **Workflows** and create a new workflow or open an existing one.
2. On the workflow canvas, select the **plus (+)** icon.
3. Add an **Enrichment** step and select **Sigma First-Party Fraud**.

After the enrichment is added, its outputs can be referenced by downstream workflow logic.

### Configure inputs and routing

Sigma First-Party Fraud evaluates the identity and account attributes provided by your workflow. Providing complete and consistent inputs improves matching accuracy and risk assessment.

You can use Sigma First-Party Fraud outputs—including risk scores, signals, and reason codes—to configure routing logic that supports outcomes such as **Accept**, **Review**, or **Reject**.

Routing strategies should align with your organization’s fraud policy and risk tolerance.

### Save and publish

Once your workflow is configured, publish it to go live.

## Workflow testing checklist

Use this checklist to confirm accuracy, resilience, and completeness before going live.

- Required identity attributes are collected and passed correctly
- Workflow routing aligns with your fraud policy and risk tolerance
- Review and escalation paths are clearly defined
- Scores and reason codes are accessible to relevant teams

Updated 3 months ago