Risk Appetite
- Risk appetite = The fraud loss level you accept to achieve business goals (conversion, growth, UX)
- No "zero fraud" without "zero revenue." Every fraud decision is a trade-off
- Set your fraud loss budget and the cost of blocked good orders before changing rules
- Segment by customer type (new vs. returning) and transaction type (digital vs. physical)
- See Economics of Fraud for cost calculations
Risk appetite is the fraud loss you take on purpose, to keep revenue, conversion, and customer experience. Every fraud decision is a trade. Conservative rules block more orders. Permissive rules let more through. Compare fraud losses and blocked good orders on the same customer segment. Neither one is wrong, but not picking is.
SMB Risk Appetite in Plain English
Here's what that looks like if you're a smaller merchant:
| Approach | What It Means | What to Measure | Best For |
|---|---|---|---|
| Conservative | "I'll decline the occasional good customer to block fraud" | Fraud losses avoided and good orders blocked | Under $500K/month. Compare the margin lost on good orders with tool costs. |
| Balanced | "I want to block obvious fraud without annoying customers" | Net cost of fraud, blocked good orders and prevention | $500K-$5M/month. You have enough volume that false positives start to matter, but fraud losses also add up. |
| Aggressive | "I'd rather lose a few dollars to fraud than lose a good customer" | Added completed sales and fraud losses | When your fraud rate is already low and customer retention is your priority. Requires confidence in your detection tools. |
If you're under $500K/month, start with your processor's controls. Price a fraud tool against your own blocked good orders and margin. Test one rule change on a matched customer segment. Keep it only if the sales you recover cover the added fraud loss and tool cost.
What is Risk Appetite?
It's the fraud loss you'll accept to hit business goals. That means conversion, growth, and customer experience.
There's no "zero fraud" without "zero revenue." Every fraud decision is a trade-off.
Defining Your Risk Appetite
Quantitative Targets
| Metric | Set From | Check After a Rule Change |
|---|---|---|
| Fraud Rate (bps) | The losses your margin can absorb, within processor limits | Fraud losses on the same customer segment |
| False Positive Rate | Confirmed legitimate fraud blocks / All fraud blocks; report unknowns and use Fraud Metrics | Lost margin on those orders |
| Manual Review Rate | Your staffing and review cost per order | Queue size, decisions and response time |
| Block Rate | Your current segment baseline | Fraud avoided and good orders lost |
Write your own targets down before testing. Compare the same product, channel and customer mix before and after. Allow equal time for fraud reports to arrive.
Qualitative Factors
Consider your:
- Industry - High-risk MCCs have different norms
- Margin structure - High-margin can absorb more fraud
- Customer base - New vs. established customers
- Regulatory environment - Compliance requirements
- Competitive landscape - Friction vs. competitors (see checkout conversion)
Segmented Risk Appetite
One number for every customer is the lazy answer. Split it:
By Customer Type
| Segment | Risk Appetite | Rationale |
|---|---|---|
| Returning customers | Higher | Trust earned, lower fraud rate |
| New customers | Lower | Unproven, higher fraud rate |
| High-value customers | Higher | Worth the risk for LTV |
| First transaction | Lowest | Highest fraud concentration |
By Transaction Type
| Type | Risk Appetite | Rationale |
|---|---|---|
| Small purchases | Higher | Limited loss exposure |
| Large purchases | Lower | Significant single-transaction risk - use 3DS |
| Digital goods | Lower | Instant delivery, no recovery - see third-party fraud |
| Physical goods | Moderate | Delivery delay allows intervention |
Operationalizing Risk Appetite
Translate to Rules
Illustrative conditions below. Choose tenure, purchase count and order value from your own confirmed outcomes. Test them against lost margin and fraud exposure before changing live decisions.
IF customer_tenure > 12_months AND prior_orders > 5:
threshold = "permissive"
ELIF new_customer AND order_value > $500:
threshold = "strict"
ELSE:
threshold = "standard"
See processor rules configuration for implementation.
Regular Calibration
- Monthly: Review fraud rate vs. target
- Quarterly: Adjust thresholds based on performance
- Annually: Strategic review of risk appetite
Next Steps
Defining your risk appetite?
- Set quantitative targets - Pick your thresholds
- Segment by customer type - Different rules for different segments
- Understand the economics - Know the cost trade-offs
Operationalizing risk appetite?
- Configure processor rules - Translate to rules
- Set up risk scoring - Combine signals
- Build velocity rules - Implement limits
Optimizing existing approach?
- Review fraud metrics - Know your current rates
- Check network thresholds - Stay below limits
- Balance with conversion - Monitor friction
Related Topics
- Economics of Fraud - Cost calculations
- Rules vs. ML - Detection approaches
- Fraud Prevention - Prevention strategies
- Risk Scoring - Combining signals
- Velocity Rules - Rule-based detection
- 3D Secure - Authentication trade-offs
- Manual Review - Review costs
- Fraud Metrics - Measuring performance
- Chargeback Metrics - Dispute costs
- Checkout Conversion - Friction impact
- Auth Optimization - Approval rate impact
- Network Programs - Threshold consequences