Real-Time Fraud Scoring

Real-time fraud scoring is the practice of assigning a numeric risk score to each payment, login or account change at the moment it happens, quickly enough that the result can decide what happens next. A card issuer, acquirer, bank or payment provider runs the score inside the authorisation or payment flow, usually within a few tens or hundreds of milliseconds, and uses it to approve the transaction, decline it or ask for extra verification.

Scoring is the decision engine at the heart of most modern fraud management systems. It differs from after-the-event review and from anti-money laundering transaction monitoring, which typically analyses patterns over days or weeks. Its importance has grown with real-time payment systems, where money moves irrevocably in seconds and cannot be stopped later.

Picture a doorman at a busy venue who glances at each guest for a second or two. Most walk straight in. A few get a second look or a question, and a handful are turned away. The doorman relies on experience: someone arriving at 4 a.m. in a hurry with no ticket looks different from a regular who comes every Friday.

Real-time fraud scoring does the same for payments, but with a computer and far more information. Every payment gets a quick number that says how unusual and risky it looks compared with what that customer normally does. Low numbers pass without fuss, middle numbers get an extra check such as a code sent to a phone, and very high numbers are stopped.

When an event arrives, the scoring engine enriches it with stored data about the customer, account, device and counterparty, calculates features, and passes them to one or more models. Typical inputs include:

• Transaction details. Amount, currency, merchant type, channel and time of day compared with the customer's usual behaviour.
• Velocity. How many attempts, cards or payees have been seen in a short period, the basis of velocity checking.
• Device and session signals. Data from device fingerprinting, IP address and location, and behavioural biometrics such as typing rhythm.
• Network intelligence. Scores or alerts shared by card networks, consortium data and lists of compromised cards or mule accounts.

Models are often machine-learning classifiers trained on past confirmed fraud, combined with hand-written rules for known patterns such as card testing. The output is a score, commonly scaled from 0 to 999 or 0 to 1, plus reason codes that explain the main drivers.

The score alone does nothing until it is compared with thresholds set by the fraud team. A typical policy approves low scores, declines very high scores and routes the middle band to step-up authentication, such as 3-D Secure online or a call-back for a large bank transfer, or to a manual review queue. Thresholds are tuned to balance fraud losses against false positives, because every genuine customer who is declined costs revenue and goodwill. Different thresholds often apply to new customers, high-value payments and risky merchant categories.

Card issuers score authorisations to catch stolen and counterfeit card use, while acquirers and merchants score online orders to limit chargebacks and friendly fraud. Banks score logins and payee changes to detect account takeover, and score outgoing instant payments to spot authorised push payment fraud, where a customer is tricked into sending money. Receiving banks increasingly score incoming payments too, to find accounts used by money mules.

In the European Union and the United Kingdom, rules on strong customer authentication allow a payment provider to skip the extra check for remote payments when its real-time transaction risk analysis judges the risk low, provided its overall fraud rate stays below set reference levels for each value band. The UK's mandatory reimbursement regime for authorised push payment fraud, in force since October 2024, has given banks a further reason to invest in scoring. In the United States, supervisors expect banks to manage the models behind these decisions under model risk management guidance.

Scoring has limits. Models learn from past fraud and can miss new schemes, fraud labels arrive late, and criminals test systems to learn what passes. Poorly governed models can be hard to explain or may treat some customer groups unfairly, which is why firms monitor performance, retrain models and keep human review for difficult cases. Scoring is one layer of fraud prevention, not a substitute for strong authentication and customer education.