Fraud Screening

Fraud screening is the process of examining a transaction or other event, such as an online order, a card authorisation, a bank transfer, a login or an account opening, to assess whether it is likely to be fraudulent before it is allowed to proceed. Screening applies checks, rules and risk models to the data available at that moment and produces a result that determines what happens next: accept, reject, challenge or review. It is used by merchants, payment gateways, acquirers, card issuers, banks and fintechs, and is usually automated so that it can run in real time.

The term is often used for the merchant side of card-not-present commerce, where online shops screen orders before sending them for authorisation or shipping goods. It overlaps with fraud detection and feeds into fraud decisioning. Fraud screening is distinct from sanctions screening and watchlist screening, which check names against official lists for legal compliance rather than for fraud.

• Card and identity checks. Address verification, card security code checks, email and phone validation and identity data matching.
• Velocity checks. Counting attempts per card, account, device, email or IP address within a period, to spot card testing and bot activity.
• Device and network signals. Device fingerprinting, detection of emulators and proxies, and IP reputation.
• Geographic consistency. Comparing billing, shipping, card issuing and IP locations.
• Lists. Blocking known fraudulent cards, emails, devices and addresses, and allowing trusted customers to pass more easily.
• Behavioural analysis. Looking at how a user moves through a site or app, how quickly forms are filled and whether patterns match past behaviour.
• Model scores. Machine learning scores trained on historical fraud and chargeback data, sometimes supplied by card networks or consortium providers.

For an online merchant, screening usually takes place at checkout, before authorisation, so that obviously fraudulent orders are not sent to the issuer. It may run again after authorisation and before fulfilment, especially for high-value goods. Payment gateways and acquirers screen traffic across many merchants, which gives them broader visibility of attacks. Issuers screen authorisation requests against cardholder history and network data before approving. Banks screen outgoing transfers for signs of scams and account takeover, and screen new account applications for application fraud and synthetic identities.

Screening results are commonly expressed as a score or a set of flags that map to actions. Low-risk orders are accepted automatically. High-risk orders are declined or cancelled. Medium-risk orders may be sent for authentication, such as 3-D Secure, or placed in a queue for manual review by analysts, who check details, contact customers or look for links to known fraud. Manual review improves accuracy but adds cost and delay, so merchants aim to keep review rates low and focus analysts on cases where judgement adds value.

Screening must strike a balance. Strict screening reduces fraud losses and chargebacks but causes false declines, where legitimate customers are rejected, which leads to lost sales and customer frustration. Studies by industry participants suggest that the value of falsely declined orders can exceed the value of fraud prevented, so merchants monitor approval rates and customer complaints as well as fraud losses. Techniques such as risk-based authentication, which challenges only suspicious transactions, and allowing returning customers through with fewer checks help reduce friction.

Merchants and payment firms use a mix of in-house rules and specialist fraud management systems. Many payment service providers include screening as part of their service, with configurable rules and scores. Specialist vendors offer machine learning, device intelligence, identity data and chargeback guarantees, in which the vendor reimburses the merchant for fraud on orders it approved. Card networks also provide risk scores in authorisation messages, and consortium databases share signals of known fraud across participants.

Fraud screening faces constantly changing attacks, including bots that imitate human behaviour, device spoofing and organised fraud rings. Data quality and completeness limit accuracy, and privacy rules restrict the collection and sharing of some data. Rules that worked well can become outdated, so screening setups require regular tuning, testing and review. Labels for training models arrive late, often only after chargebacks are filed, which makes it harder to respond quickly to new fraud patterns. Effective programmes therefore combine automated screening with monitoring, investigation and feedback loops.