Fraud Detection

Last updated 22 October 2026. Copy page as text

TL;DR

• Signals = Data points indicating risk (device, velocity, behavior, identity)
• Rules = Fast, explainable, good for known patterns
• ML models = Find patterns you haven't seen, but they need training data
• Stack by stage: Starter (rules + AVS) → Intermediate (+ device ID + ML) → Advanced (+ behavioral)
• Detection is layered. Nothing catches everything on its own

Something's getting through and you want to catch it earlier. Build the stack your volume justifies, not the one a vendor's selling.

---

How Detection Works

Component	Purpose	Example
Signals	Raw data points	Device ID, IP, velocity, AVS result
Rules	Known-pattern matching	"Block if >5 cards in 1 hour"
ML Models	Pattern discovery	Anomaly score from transaction features
Review	Human judgment	Edge cases, high-value orders

Core Topics

Evidence Framework

How to sort signals into Tier 1 and Tier 2:

• Tier 1: Direct evidence to verify against the specific case
• Tier 2: Supporting signals to investigate, not a count that proves fraud

Rules vs. ML

Which one you've actually got a use for:

• When rules work best
• When ML excels
• Hybrid approaches

Detection Methods

Method	Coverage	Use Case
Velocity Rules	Transaction patterns	Real-time decisioning
Data Enrichment	IP, email, phone signals	Enriching transaction data
Building Fraud Rules	Rule sets, allow/block lists	Day-one setup and lifecycle
Fraud Model Feedback	ML feedback loops	Model accuracy and monitoring
Device Fingerprinting	Device/browser attributes	Account-level linking
Behavioral Analytics	User behavior patterns	ATO, bot detection
Identity Verification	Identity confirmation	Application, step-up
Manual Review	Complex/edge cases	High-value decisions

Building Your Detection Stack

Starter Stack

1. Basic velocity rules
2. AVS/CVV verification
3. Simple device ID
4. Manual review queue

Intermediate Stack

1. Advanced velocity rules
2. Device fingerprinting service
3. Data enrichment (IP, email, phone intelligence)
4. ML scoring (vendor or custom)
5. Fraud rule lifecycle management (shadow mode, allow/block lists)
6. Case management system

A full-stack fraud platform (Sift, Sardine, Kount) bundles items 2-4 into one integration. You can assemble the same thing from separate vendors. It's just more plumbing. Fraud vendors covers when each way makes sense.

Advanced Stack

1. Real-time ML models
2. Behavioral biometrics
3. Network analysis
4. Custom feature engineering
5. Automated decision engine
6. ML feedback loops and model monitoring
7. Operational cadence (daily/weekly/monthly reviews)

When to Escalate

It's all in the evidence framework: Tier 1/Tier 2 indicators and when to escalate.

Popular in This Section

• Evidence Framework - Tier 1/Tier 2 indicator system
• Velocity Rules - Real-time transaction limits
• Device Fingerprinting - Identifying devices across sessions
• Manual Review - When humans beat algorithms

Related Topics

• Fraud Types - Know what you're detecting
• Prevention Strategies - Stop fraud before it happens
• Fraud Metrics - Measure detection effectiveness
• Risk Appetite - Tolerance thresholds
• Fraud Economics - Cost of fraud decisions
• Processor Rules Configuration - Native fraud tools
• Fraud Vendor Landscape - Third-party tools
• Running Fraud Operations - Operational cadence playbook
• Chargeback Alerts - Deflection before dispute
• Compelling Evidence - Evidence for representment
• Network Programs - Monitoring thresholds
• Benchmarks - Industry comparisons
• 3D Secure - Authentication layer