Fraud Decisioning

Fraud decisioning is the step in a fraud prevention system where an organisation decides what to do with an event, such as a card payment, bank transfer, login or new account application, based on its assessed risk. The possible outcomes typically include approving the event, declining it, asking for more authentication, holding it for manual review or allowing it with conditions such as a lower limit. Decisions must usually be made in milliseconds, so they are automated and run by a decision engine that combines rules, scores and business policies.

Fraud decisioning sits between data collection and action. Upstream, systems gather data about the customer, device, transaction and context, and produce risk indicators such as a transaction risk score. Downstream, the decision triggers a response in the payment flow, the authentication process or a case management queue. It is a core part of fraud management systems used by banks, card issuers, acquirers, payment service providers and online merchants.

• Transaction data. Amount, currency, merchant, payee, channel and time.
• Customer data. Account age, history, typical spending patterns and previous fraud reports.
• Device and network data. Signals from device fingerprinting, IP address, location and signs of emulators or proxies.
• Behavioural data. Typing rhythm, navigation and session behaviour from behavioural biometrics.
• External data. Consortium fraud data, identity verification results, sanctions lists and card network risk scores.
• Model scores. Outputs from machine learning models trained on past fraud.

Decision engines usually combine two approaches. A fraud rule is an explicit condition, such as declining payments above a certain amount from a newly added payee or challenging logins from a new country. Rules are transparent, quick to change and good for known patterns and regulatory requirements. Machine learning models estimate the probability that an event is fraudulent by learning from large amounts of labelled data. They can capture complex patterns that rules miss but are harder to explain. Many organisations use models to produce a score and rules to turn scores into decisions, for example approving below one threshold, challenging between two thresholds and declining above another.

The available outcomes depend on the setting. For card payments at the issuer, decisions are approve or decline, sometimes with a partial approval. For online merchants, the options include passing an order, sending it for 3-D Secure authentication, holding it for manual review or rejecting it. For bank transfers, banks may hold a payment, ask the customer questions about its purpose, show a warning or block it. For logins, they may require step-up authentication. Choosing the right outcome balances fraud losses against customer experience; an approach that declines too often loses good customers, while one that approves too readily lets fraud through.

Organisations track how well decisioning works using measures such as the fraud detection rate, the false positive rate, the share of good customers who are challenged or declined, approval rates, the fraud loss rate and the cost of manual review. Because fraud labels arrive late, often only after chargebacks or customer complaints, performance is analysed over time and models are retrained regularly. Controlled tests, in which a share of traffic is handled by a new rule or model, help assess changes before full deployment.

Regulation shapes fraud decisioning in several ways. In Europe, the transaction risk analysis exemption under strong customer authentication rules allows providers to skip authentication for low-risk transactions only if their overall fraud rates stay below set reference levels. Rules on reimbursing fraud victims, such as those covering authorised push payment fraud in the UK, give banks stronger reasons to detect and stop scam payments. Data protection laws govern the use of personal data and may give individuals rights relating to automated decisions. Supervisors expect firms to document their rules and models, monitor for bias and maintain controls over changes, consistent with model risk management principles.

Fraud decisioning faces adaptive adversaries who change tactics as controls improve, and fraud patterns can shift quickly. Data quality, latency and integration across channels limit what decision engines can see. Explainability is a concern when declines are driven by complex models, particularly when customers or regulators ask why an action was taken. Balancing speed, accuracy and customer experience requires ongoing tuning, and many firms combine automated decisioning with skilled analysts who investigate cases, adjust rules and feed outcomes back into models.