Fraud Detection
TL;DR
- Signals = Data points indicating risk (device, velocity, behavior, identity)
- Rules = Fast, explainable, good for known patterns
- ML models = Find patterns you haven't seen, but they need training data
- Stack by stage: Starter (rules + AVS) → Intermediate (+ device ID + ML) → Advanced (+ behavioral)
- Detection is layered. Nothing catches everything on its own
Something's getting through and you want to catch it earlier. Build the stack your volume justifies, not the one a vendor's selling.
How Detection Works
| Component | Purpose | Example |
|---|---|---|
| Signals | Raw data points | Device ID, IP, velocity, AVS result |
| Rules | Known-pattern matching | "Block if >5 cards in 1 hour" |
| ML Models | Pattern discovery | Anomaly score from transaction features |
| Review | Human judgment | Edge cases, high-value orders |
Core Topics
Evidence Framework
How to sort signals into Tier 1 and Tier 2:
- Tier 1: High confidence, standalone indicators
- Tier 2: Supporting evidence, combine for confidence
Rules vs. ML
Which one you've actually got a use for:
- When rules work best
- When ML excels
- Hybrid approaches
Detection Methods
| Method | Coverage | Use Case |
|---|---|---|
| Velocity Rules | Transaction patterns | Real-time decisioning |
| Data Enrichment | IP, email, phone signals | Enriching transaction data |
| Building Fraud Rules | Rule sets, allow/block lists | Day-one setup and lifecycle |
| Fraud Model Feedback | ML feedback loops | Model accuracy and monitoring |
| Device Fingerprinting | Device/browser attributes | Account-level linking |
| Behavioral Analytics | User behavior patterns | ATO, bot detection |
| Identity Verification | Identity confirmation | Application, step-up |
| Manual Review | Complex/edge cases | High-value decisions |
Building Your Detection Stack
Starter Stack
- Basic velocity rules
- AVS/CVV verification
- Simple device ID
- Manual review queue
Intermediate Stack
- Advanced velocity rules
- Device fingerprinting service
- Data enrichment (IP, email, phone intelligence)
- ML scoring (vendor or custom)
- Fraud rule lifecycle management (shadow mode, allow/block lists)
- Case management system
A full-stack fraud platform (Sift, Sardine, Kount) bundles items 2-4 into one integration. You can assemble the same thing from separate vendors. It's just more plumbing. Fraud vendors covers when each way makes sense.
Advanced Stack
- Real-time ML models
- Behavioral biometrics
- Network analysis
- Custom feature engineering
- Automated decision engine
- ML feedback loops and model monitoring
- Operational cadence (daily/weekly/monthly reviews)
When to Escalate
It's all in the evidence framework: Tier 1/Tier 2 indicators and when to escalate.
Popular in This Section
- Evidence Framework - Tier 1/Tier 2 indicator system
- Velocity Rules - Real-time transaction limits
- Device Fingerprinting - Identifying devices across sessions
- Manual Review - When humans beat algorithms
Related Topics
- Fraud Types - Know what you're detecting
- Prevention Strategies - Stop fraud before it happens
- Fraud Metrics - Measure detection effectiveness
- Risk Appetite - Tolerance thresholds
- Fraud Economics - Cost of fraud decisions
- Processor Rules Configuration - Native fraud tools
- Fraud Vendor Landscape - Third-party tools
- Running Fraud Operations - Operational cadence playbook
- Chargeback Alerts - Deflection before dispute
- Compelling Evidence - Evidence for representment
- Network Programs - Monitoring thresholds
- Benchmarks - Industry comparisons
- 3D Secure - Authentication layer