# Fraud Detection
Source: https://paymentsandrisk.com/docs/fraud/detection

Last updated 22 October 2026.

TL;DR

-   **Signals** = Data points indicating risk (device, velocity, behavior, identity)
-   **Rules** = Fast, explainable, good for known patterns
-   **ML models** = Find patterns you haven't seen, but they need training data
-   **Stack by stage**: Starter (rules + AVS) → Intermediate (+ device ID + ML) → Advanced (+ behavioral)
-   Detection is **layered**. Nothing catches everything on its own

Something's getting through and you want to catch it earlier. Build the stack your volume justifies, not the one a vendor's selling.

* * *

## How Detection Works

```mermaid
flowchart LR
    A[Transaction\nData] --> B[Signal\nExtraction]
    B --> C{Rules &\nML Models}
    C -->|Low Risk| D[Auto-Approve]
    C -->|High Risk| E[Auto-Decline]
    C -->|Medium Risk| F[Manual Review]
    F --> G{Analyst\nDecision}
    G -->|Legit| D
    G -->|Fraud| E
```

| Component | Purpose | Example |
| --- | --- | --- |
| **Signals** | Raw data points | Device ID, IP, velocity, AVS result |
| **Rules** | Known-pattern matching | "Block if >5 cards in 1 hour" |
| **ML Models** | Pattern discovery | Anomaly score from transaction features |
| **Review** | Human judgment | Edge cases, high-value orders |

## Core Topics

### [Evidence Framework](https://paymentsandrisk.com/docs/fraud/detection/evidence-framework/)

How to sort signals into Tier 1 and Tier 2:

-   Tier 1: Direct evidence to verify against the specific case
-   Tier 2: Supporting signals to investigate, not a count that proves fraud

### [Rules vs. ML](https://paymentsandrisk.com/docs/fraud/detection/rules-vs-ml/)

Which one you've actually got a use for:

-   When rules work best
-   When ML excels
-   Hybrid approaches

## Detection Methods

| Method | Coverage | Use Case |
| --- | --- | --- |
| [Velocity Rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/) | Transaction patterns | Real-time decisioning |
| [Data Enrichment](https://paymentsandrisk.com/docs/fraud/detection/data-enrichment/) | IP, email, phone signals | Enriching transaction data |
| [Building Fraud Rules](https://paymentsandrisk.com/docs/fraud/detection/building-fraud-rules/) | Rule sets, allow/block lists | Day-one setup and lifecycle |
| [Fraud Model Feedback](https://paymentsandrisk.com/docs/fraud/detection/fraud-model-feedback/) | ML feedback loops | Model accuracy and monitoring |
| [Device Fingerprinting](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting/) | Device/browser attributes | Account-level linking |
| [Behavioral Analytics](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/) | User behavior patterns | ATO, bot detection |
| [Identity Verification](https://paymentsandrisk.com/docs/fraud/detection/identity-verification/) | Identity confirmation | Application, step-up |
| [Manual Review](https://paymentsandrisk.com/docs/fraud/detection/manual-review/) | Complex/edge cases | High-value decisions |

## Building Your Detection Stack

### Starter Stack

1.  Basic [velocity rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/)
2.  [AVS/CVV verification](https://paymentsandrisk.com/docs/fraud/prevention/avs-cvv/)
3.  Simple device ID
4.  [Manual review](https://paymentsandrisk.com/docs/fraud/detection/manual-review/) queue

### Intermediate Stack

1.  Advanced [velocity rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/)
2.  [Device fingerprinting](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting/) service
3.  [Data enrichment](https://paymentsandrisk.com/docs/fraud/detection/data-enrichment/) (IP, email, phone intelligence)
4.  [ML scoring](https://paymentsandrisk.com/docs/fraud/detection/rules-vs-ml/) (vendor or custom)
5.  [Fraud rule lifecycle management](https://paymentsandrisk.com/docs/fraud/detection/building-fraud-rules/) (shadow mode, allow/block lists)
6.  Case management system

A [full-stack fraud platform](https://paymentsandrisk.com/docs/fraud/vendors/#full-stack-fraud-platforms) (Sift, Sardine, Kount) bundles items 2-4 into one integration. You can assemble the same thing from separate vendors. It's just more plumbing. [Fraud vendors](https://paymentsandrisk.com/docs/fraud/vendors/) covers when each way makes sense.

### Advanced Stack

1.  Real-time [ML models](https://paymentsandrisk.com/docs/fraud/detection/rules-vs-ml/)
2.  [Behavioral biometrics](https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics/)
3.  Network analysis
4.  Custom feature engineering
5.  Automated decision engine
6.  [ML feedback loops](https://paymentsandrisk.com/docs/fraud/detection/fraud-model-feedback/) and model monitoring
7.  [Operational cadence](https://paymentsandrisk.com/docs/operations/running-fraud-operations/) (daily/weekly/monthly reviews)

## When to Escalate

It's all in the [evidence framework](https://paymentsandrisk.com/docs/fraud/detection/evidence-framework/): Tier 1/Tier 2 indicators and when to escalate.

## Popular in This Section

-   **[Evidence Framework](https://paymentsandrisk.com/docs/fraud/detection/evidence-framework/)** - Tier 1/Tier 2 indicator system
-   **[Velocity Rules](https://paymentsandrisk.com/docs/fraud/detection/velocity-rules/)** - Real-time transaction limits
-   **[Device Fingerprinting](https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting/)** - Identifying devices across sessions
-   **[Manual Review](https://paymentsandrisk.com/docs/fraud/detection/manual-review/)** - When humans beat algorithms

## Related Topics

-   [Fraud Types](https://paymentsandrisk.com/docs/fraud/types/) - Know what you're detecting
-   [Prevention Strategies](https://paymentsandrisk.com/docs/fraud/prevention/) - Stop fraud before it happens
-   [Fraud Metrics](https://paymentsandrisk.com/docs/fraud/metrics/) - Measure detection effectiveness
-   [Risk Appetite](https://paymentsandrisk.com/docs/fraud/fundamentals/risk-appetite/) - Tolerance thresholds
-   [Fraud Economics](https://paymentsandrisk.com/docs/fraud/fundamentals/economics/) - Cost of fraud decisions
-   [Processor Rules Configuration](https://paymentsandrisk.com/docs/fraud/processor-rules-configuration/) - Native fraud tools
-   [Fraud Vendor Landscape](https://paymentsandrisk.com/docs/fraud/vendors/landscape/) - Third-party tools
-   [Running Fraud Operations](https://paymentsandrisk.com/docs/operations/running-fraud-operations/) - Operational cadence playbook
-   [Chargeback Alerts](https://paymentsandrisk.com/docs/chargebacks/prevention/alerts/) - Deflection before dispute
-   [Compelling Evidence](https://paymentsandrisk.com/docs/chargebacks/representment/compelling-evidence/) - Evidence for representment
-   [Network Programs](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs/) - Monitoring thresholds
-   [Benchmarks](https://paymentsandrisk.com/docs/reference/benchmarks/) - Industry comparisons
-   [3D Secure](https://paymentsandrisk.com/docs/fraud/prevention/3ds/) - Authentication layer