Transaction Risk Score

A transaction risk score is a number assigned to a payment by a risk model to estimate how likely it is to be fraudulent, unauthorised or otherwise problematic. Card issuers, acquirers, payment gateways, merchants, banks and wallet providers calculate scores in real time, usually within milliseconds, and use them to approve, decline, review or challenge each transaction. A higher score normally means higher risk, though each system uses its own scale.

Risk scores are the output of fraud detection systems and feed into fraud decisioning, where business rules turn a score into an action. They are related to, but separate from, the customer risk ratings used in anti-money laundering programmes, which assess a customer over time rather than a single payment. In Europe the idea also has a legal role, because a low-risk score can allow a payment to skip strong customer authentication.

Modern scores come mostly from machine learning models trained on historical transactions labelled as genuine or fraudulent. The model weighs many signals at once. Typical inputs include:

• Transaction details. Amount, currency, merchant category, channel and whether the card was present.
• Customer history. How the transaction compares with the customer's usual spending, locations and times, and whether the payee is new.
• Device and network data. Device fingerprinting, IP reputation, geolocation and signs of emulators or proxies.
• Velocity. How many attempts have been made with the same card, account, device or address in a short time, which helps detect velocity abuse and card testing.
• Consortium intelligence. Patterns seen across many institutions, such as cards recently used at a compromised merchant.

Simpler systems combine weighted rules into a points score. Most firms use a mix, with a model producing the score and rules adding hard blocks for known bad patterns. Scores are refreshed as new data arrives, and models are retrained to keep up with changing fraud tactics.

Several parties may score the same card payment. The card networks run their own models on every transaction passing through them and pass scores to issuers; Visa Advanced Authorization and Mastercard Decision Intelligence are well-known examples. Issuers then combine network scores with their own models before responding to the authorisation. On the merchant side, payment gateways and fraud vendors score orders before they are sent for authorisation, and 3-D Secure servers produce a score that issuers use to decide between frictionless authentication and a challenge flow. Banks also score outgoing transfers, especially instant payments, to detect account takeover and authorised push payment scams before money leaves.

A score only matters once thresholds are set. A firm might approve automatically below one level, send transactions to manual review or step-up authentication in a middle band, and decline above a higher level. Setting these bands is a trade-off. Low thresholds stop more fraud but decline more genuine customers, which costs revenue and goodwill; high thresholds do the opposite. Fraud teams measure detection rates, false positive rates and the fraud loss rate to tune them, and many use different thresholds for different merchant types, customer segments or amounts. This approach, known as risk-based authentication, aims to add friction only where it is justified.

In the European Economic Area and the UK, the regulatory technical standards on strong customer authentication allow a payment service provider to skip SCA for remote payments if real-time transaction risk analysis (TRA) finds the payment low risk. The exemption is available only if the provider's overall fraud rate for that payment type stays below set reference rates, which become stricter as the transaction amount rises. For remote card payments, the bands run up to 500 euros, with fraud rates of 0.13% for payments up to 100 euros, 0.06% up to 250 euros and 0.01% up to 500 euros. Providers must monitor and report their fraud rates, and lose the exemption if they exceed the limit. The TRA exemption is one of several described under strong customer authentication exemptions.

A risk score is a probability estimate, not a verdict. Models can be biased by the data they learn from, may struggle with new types of fraud and can be difficult to explain to customers whose payments are declined. Scams in which genuine customers authorise payments themselves are particularly hard to score, because the device, login and behaviour all look normal. Firms therefore combine scores with human review, customer warnings and post-event transaction monitoring, and regulators increasingly expect them to govern and validate their models.