From verifying humans to AI agents: Socure prepares for the next identity challenge

Fraud has evolved alongside digital identity, from stolen credentials and account takeover to synthetic identities, deepfakes and AI-generated documents. Identity verification providers have responded with new signals, models and defenses.

Autonomous AI agents present a different challenge. Rather than simply making fraud faster or cheaper, they challenge a core assumption behind today’s identity infrastructure: that the entity opening an account, moving money or completing a digital transaction is a human.

Increasingly, that may not be the case.

Enterprises are beginning to deploy AI agents capable of executing workflows, making decisions and interacting with services on behalf of employees and customers. Some will be legitimate and useful. Others could give fraudsters the ability to automate attacks at unprecedented scale.

For identity and fraud prevention providers, the challenge therefore becomes more complicated than distinguishing humans from bots. Platforms may increasingly need to determine who or what is conducting a transaction, who authorized it, what it is permitted to do and whether its behavior remains within that authority.

Biometric Update spoke with Socure Chief Product Officer Chung-Man Tam to understand how a major identity provider views this transition, the threats and opportunities created by autonomous agents, and how Socure is preparing its platform for an economy in which machines increasingly act on behalf of people.

From verifying people to verifying actors

Socure sees autonomous agents as a structural shift rather than another technology hype cycle.

Tam’s perspective predates the generative AI boom. While studying at Carnegie Mellon University, he worked on autonomous AI agents and systems in which agents could collaborate. The concept is not new, he says. What has changed is their capability.

Modern agents can receive relatively simple natural-language instructions, understand an objective and independently determine how to accomplish it. That is moving them from experimental applications into operational enterprise workflows.

“We’re firmly convinced this is a structural shift, not a hype cycle,” Tam says.

Enterprises are already deploying agents to move money, open accounts and make decisions, he says. As agents take on more customer and employee activities, the fundamental question facing identity providers changes.

Historically, identity verification largely asked: Is this a real person?

The emerging question, according to Tam, is: Who or what is on the other side?

That distinction matters because non-human activity is no longer inherently undesirable. Traditional fraud systems have spent years detecting bots and preventing automated activity. With AI agents, enterprises may actively want non-human actors interacting with their systems.

An agent booking travel, filing a claim or completing a financial workflow on someone’s behalf could be entirely legitimate. Identity infrastructure therefore cannot simply detect an AI agent and block it. It needs to distinguish legitimate delegated activity from malicious automation.

AI gives fraud a force multiplier

The transition is occurring while generative AI is already changing the economics of fraud.

According to Socure, AI-driven fraud attacks across its network increased by more than 8,000 percent in 2025, spanning industries and organizations of different sizes.

Tam points to deepfakes as one example. The cost of generating fraudulent documents, synthesizing identities and producing supporting materials is approaching zero, while the speed at which those assets can be created continues to increase.

Autonomous agents could amplify that effect.

An individual fraudster has natural limitations on how many accounts they can open, password resets they can attempt or applications they can submit. An autonomous system can potentially perform those activities continuously and in parallel.

Tam describes this as a “force multiplier” for existing fraud typologies. Account-opening fraud, synthetic identity fraud and account takeover do not disappear. Instead, attackers gain the ability to automate them at software scale.

An attacker could instruct an agent to attempt hundreds of account openings using synthetic identities or password resets across a collection of targets and walk away.

Fraud defenses built around human-paced activity may consequently need to operate at machine speed.

Identity becomes a chain of trust

The larger implication is that identity verification can no longer be treated primarily as an onboarding event.

Tam describes the emerging model as a chain of trust.

First, an organization establishes that a person is who they claim to be. It then needs to establish whether that person authorized an agent, the identity and authority of that agent, the scope of actions it can perform, and whether individual actions remain within that scope.

“Today, you verify the person and trust the session,” Tam says. “Going forward, services will have to verify the person, verify that they’ve delegated authority, verify the agent’s identity and scope of what it’s allowed to do, and then verify that the action being taken is within that scope.”

The model becomes even more complicated when agents invoke other agents. Some may complete their assignments and should lose access, while others require continuing authority. Permissions could also change while those agents are operating.

Identity infrastructure therefore begins to overlap with authorization, governance and continuous fraud monitoring.

Instead of asking whether an identity was legitimate at the beginning of a transaction, platforms may need to determine whether the entire chain connecting a person, an agent, its delegated authority and the resulting action remains trustworthy.

Network intelligence moves to agents

Socure believes network-level intelligence will become increasingly important as fraud moves toward agent speed.

Fraud prevention has already evolved beyond isolated identity checks. Providers can examine whether devices, documents, phone numbers, identities and other signals appear across suspicious activity elsewhere in their networks. Tam argues that similar concepts will need to apply to agents.

Socure’s scale helps explain that strategy. The company says it serves more than 3,000 customers across 190-plus countries, including 18 of the top 20 banks, more than 600 fintechs and 160 public-sector organizations. It closed Q2 2026 with $364 million in total annual recurring revenue, up 63 percent year over year.

Rather than create a separate trust system for agents, Socure’s approach is to extend its existing identity graphs, device and behavioral signals and consortium intelligence to this new class of actor.

“When we verify one agent’s legitimacy, it benefits every organization on the network,” Tam says.

The broader argument is that the same transition from isolated identity checks to network-level fraud intelligence that occurred for humans may now need to happen for AI agents — only at much greater speed.

Enterprise requirements are changing

There are already signs of identity platforms moving beyond binary verification. Socure says a prediction-market customer reduced fraudulent account creation by 65 percent after replacing binary identity checks with a broader identity and fraud decisioning layer. Another crypto customer expanded RiskOS into five additional products within three months, extending protection across onboarding, login and account funding.

Agent adoption could push that evolution further.

Tam characterizes the emerging shift in buyer requirements as moving from “Can you verify my customer?” toward “Can you monitor the agents acting on my customers’ — or my business’s — behalf?”

Enterprises may need mechanisms for establishing delegated authority, persistent agent risk assessment, behavioral monitoring and permission revocation. Explainability and auditability will also matter.

When an autonomous system moves money, opens an account or makes a consequential decision, compliance teams may need to reconstruct who authorized the agent, what it was permitted to do and whether the action remained within that authority.

Accountability could therefore become one of the defining identity requirements of an agentic environment.

Socure’s strategy: extend rather than rebuild

Socure’s product strategy addresses both sides of the AI transition: using AI inside fraud prevention products while preparing for a world in which agents themselves become actors that need to be trusted.

The company has historically used machine learning across phone, email, identity and other risk models. Tam says Socure is now applying transformer-based approaches to its next generation of identity models while embedding generative AI throughout RiskOS, its identity decisioning and orchestration platform.

Socure launched its RiskOS AI Suite in October 2025. Capabilities include an AI-assisted case review system that recommends outcomes with plain-language reasoning, natural-language creation of fraud rules, generative AI explanations of scores and decisions, and an MCP agent server that brings risk requests into AI-enabled developer environments.

Tam says future agent capabilities can build on the same consortium intelligence already supporting Socure’s fraud models rather than requiring a parallel identity stack.

That points to a broader strategic question for the identity industry: Does agent identity become a separate product category, or an extension of existing identity and fraud infrastructure?

Socure is betting on the latter.

What AI agents mean for identity vendors and buyers

The rise of autonomous agents creates both a threat and an opportunity for identity providers.

Platforms built predominantly around point-in-time verification of humans may find enterprise requirements moving beyond their existing architectures. But identity providers already occupy critical trust points between consumers and enterprises. If agents increasingly act on behalf of those consumers and businesses, that role could expand from verifying people to establishing trust across humans, agents and transactions.

The challenge is doing so without treating all automation as suspicious.

The winning systems may need to answer not merely “Is this an AI agent?” but “Is this the right agent, acting for the right person or organization, with the right authority, taking the right action?”

Tam expects that distinction to eventually become commonplace.

“We project — maybe even sooner, given the pace things are moving — that verifying agents will be as standard as verifying humans,” he says.

For enterprise buyers, that means AI-agent deployment cannot be considered solely an AI governance or productivity initiative. Organizations will increasingly need to determine how agents establish identity, receive delegated authority, authenticate to systems and remain accountable throughout their lifecycles.

For identity vendors, the shift is equally significant. The industry spent decades building infrastructure to establish whether a person is who they claim to be. Autonomous agents could force that infrastructure to evolve into something broader: a trust layer capable of determining who — or what — is acting, on whose behalf, with what authority and whether the resulting actions can ultimately be accounted for.

Article Topics

AI agents  |  AI fraud  |  biometrics  |  digital identity  |  fraud prevention  |  identity orchestration  |  Socure