A fraud rule is a defined condition, usually written in an if-then form, that a fraud system checks for each payment, login or application. When the condition is met, the rule triggers an action, such as blocking the event, requiring extra authentication, sending it for manual review or adding to a risk score. Examples include limiting card attempts per device per hour or holding a large first payment to a new payee.
Rules are transparent and quick to change, which makes them useful for known fraud patterns, urgent responses and policy requirements. They are commonly combined with machine learning scores in fraud decisioning and support fraud screening and velocity checking. Too many rigid rules can produce false positives and be bypassed by fraudsters who learn them, so rules need regular testing and tuning, similar to transaction monitoring rule tuning in AML.