Skip to main content

Risk Appetite

TL;DR
  • Risk appetite = The fraud loss level you accept to achieve business goals (conversion, growth, UX)
  • No "zero fraud" without "zero revenue." Every fraud decision is a trade-off
  • Conservative: under 10 bps fraud rate, under 30% false positives. Aggressive: 30-50 bps, 50-70% FPs
  • Segment by customer type (new vs. returning) and transaction type (digital vs. physical)
  • See Economics of Fraud for cost calculations

Risk appetite is the fraud loss you take on purpose, to keep revenue, conversion, and customer experience. Every fraud decision is a trade. Conservative (under 10 bps fraud rate) blocks more good customers. Aggressive (30-50 bps) lets more fraud through and maximizes sales. Neither one is wrong, but not picking is.

SMB Risk Appetite in Plain English​

Here's what that looks like if you're a smaller merchant:

ApproachWhat It MeansFalse Positive RateBest For
Conservative"I'll decline the occasional good customer to block fraud"0.5-1% of good orders declinedUnder $500K/month. The cost of a false positive (one $100 order) is lower than the cost of sophisticated fraud tools.
Balanced"I want to block obvious fraud without annoying customers"1-3% of good orders declined$500K-$5M/month. You have enough volume that false positives start to matter, but fraud losses also add up.
Aggressive"I'd rather lose a few dollars to fraud than lose a good customer"Under 0.5% of good orders declinedWhen your fraud rate is already low and customer retention is your priority. Requires confidence in your detection tools.
For Most SMBs

If you're under $500K/month, "conservative" is almost always correct. The math is simple: a blocked $100 order costs you $30 in margin. A fraud tool that reduces false positives by 1% saves you maybe $150/month. That's not worth $500+/month in tool costs. Start conservative, and only loosen your thresholds when false positive complaints become a real business problem.

What is Risk Appetite?​

It's the fraud loss you'll accept to hit business goals. That means conversion, growth, and customer experience.

Key Insight

There's no "zero fraud" without "zero revenue." Every fraud decision is a trade-off.

Defining Your Risk Appetite​

Quantitative Targets​

MetricConservativeModerateAggressive
Fraud Rate (bps)Under 1010-3030-50
False Positive RateUnder 30%30-50%50-70%
Manual Review Rate5-10%2-5%Under 2%
Block Rate3-5%1-3%Under 1%

Pick a column and write the numbers down. If you can't name the target, you don't have one.

Qualitative Factors​

Consider your:

Segmented Risk Appetite​

One number for every customer is the lazy answer. Split it:

By Customer Type​

SegmentRisk AppetiteRationale
Returning customersHigherTrust earned, lower fraud rate
New customersLowerUnproven, higher fraud rate
High-value customersHigherWorth the risk for LTV
First transactionLowestHighest fraud concentration

By Transaction Type​

TypeRisk AppetiteRationale
Small purchasesHigherLimited loss exposure
Large purchasesLowerSignificant single-transaction risk - use 3DS
Digital goodsLowerInstant delivery, no recovery - see third-party fraud
Physical goodsModerateDelivery delay allows intervention

Operationalizing Risk Appetite​

Translate to Rules​

IF customer_tenure > 12_months AND prior_orders > 5:
    threshold = "permissive"
ELIF new_customer AND order_value > $500:
    threshold = "strict"
ELSE:
    threshold = "standard"

See processor rules configuration for implementation.

Regular Calibration​

  • Monthly: Review fraud rate vs. target
  • Quarterly: Adjust thresholds based on performance
  • Annually: Strategic review of risk appetite

Next Steps​

Defining your risk appetite?

  1. Set quantitative targets - Pick your thresholds
  2. Segment by customer type - Different rules for different segments
  3. Understand the economics - Know the cost trade-offs

Operationalizing risk appetite?

  1. Configure processor rules - Translate to rules
  2. Set up risk scoring - Combine signals
  3. Build velocity rules - Implement limits

Optimizing existing approach?

  1. Review fraud metrics - Know your current rates
  2. Check network thresholds - Stay below limits
  3. Balance with conversion - Monitor friction
Last updated on