Fraud decisioning explained

Introduction to fraud decisioning

What is fraud decisioning?

Fraud decisioning is the process of using data, rules and machine learning models to decide, in real time, whether to approve, decline or review a transaction or user action.

Traditional fraud detection flags suspicious activity for a human to investigate later. Fraud decisioning does more than that: it produces an automated outcome at the exact moment a customer checks out, logs in or requests a refund.

For a fraud manager working in ecommerce, this distinction matters. Decisioning is what actually determines revenue, loss rate and customer experience, not just what gets reported afterwards.

Why fraud decisioning matters for modern businesses

Cross-border ecommerce, instant payment methods and rising synthetic identity fraud mean merchants can no longer rely on manual review queues alone. A strong fraud decisioning capability gives a business several advantages:

• It can increase order volume without increasing headcount.
• It protects revenue by reducing false declines.
• It keeps the business compliant with regional rules such as PSD2 and strong customer authentication (SCA) in the UK and EU.

It also supports broader fraud prevention and fraud detection efforts by converting insight into an automated, real-time outcome.

Key objectives of an effective fraud decisioning programme

A well-established fraud decisioning programme should:

• Minimise fraud losses and chargebacks.
• Maximise approval rates for legitimate customers.
• Keep operational costs under control.
• Remain adaptable as fraud patterns and regulations evolve.

Meeting these objectives together, rather than focusing on just one, is what separates a good fraud prevention programme from a great one.

Core concepts and terminology

Fraud risk versus credit risk versus compliance risk

Fraud risk relates to losses caused by criminal intent, such as stolen card details or account takeover. Credit risk relates to a legitimate customer’s ability or willingness to pay, for example with buy now, pay later products. Compliance risk covers a business’s obligation to meet regulatory requirements, including anti-money laundering rules and PSD2. Fraud decisioning sits primarily within fraud risk, but a well-designed fraud prevention programme accounts for all three.

Authorisation, authenticating, and decisioning

Authorisation confirms that a payment method has funds and permission to be used. Authentication confirms that the person presenting the payment method is who they claim to be, often through SCA or biometric checks. Decisioning sits above both, combining the outputs of authorisation and authentication with wider risk signals to decide whether a transaction should proceed, be challenged or be blocked.

False positives, false negatives, and customer friction

A false positive occurs when a legitimate order is declined or flagged as fraud, while a false negative occurs when fraud passes through undetected. Both carry a cost.

According to J.P. Morgan, false positives and unnecessary friction are a persistent challenge for merchants trying to fight card-not-present fraud, and industry research consistently shows that false declines cost merchants significantly more in lost revenue than the fraud those same tools are designed to stop.

Reducing friction for genuine customers while still catching fraud is the central tension that fraud decisioning is built to resolve.

Loss rate, chargebacks and operational cost metrics

Loss rate measures fraud losses as a percentage of revenue, while chargeback rate tracks disputed transactions that are reversed by the card issuer. Operational cost metrics, including manual review volume and average handling time, complete the picture.

Together these metrics tell a fraud manager whether their decisioning strategy is actually working, or simply moving the problem from one column of the ledger to another.

Fraud decisioning lifecycle

Data collection and ingestion

Every fraud decision starts with data: device information, behavioural signals, transaction details and identity attributes are collected at the point of interaction and ingested into the decisioning system in real time.

Risk assessment and scoring

The decisioning engine analyses this data against known fraud patterns, business rules and machine learning models to produce a risk score. This score reflects the likelihood that a given transaction or user action is fraudulent.

Decision execution and orchestration

Based on the risk score and the merchant’s risk thresholds, the system instantly decides to approve, decline, or route the transaction for step-up authentication or manual review. Orchestration ensures this decision is applied consistently across channels, from web and app checkout to call centre orders.

Feedback loops and continuous improvement

Confirmed fraud and confirmed legitimate outcomes are fed back into the models and rules that made the original decision. This feedback loop is what allows a fraud decisioning system to keep pace with evolving fraud tactics rather than becoming stale.

Data foundations for fraud decisioning

Internal data sources

Internal data includes a merchant’s own order history, customer accounts, past chargebacks and confirmed fraud cases. This first-party data is often the most predictive, because it reflects how fraud actually behaves on a specific storefront.

External and third-party data sources

External sources add context that a single merchant cannot see alone, including device fingerprinting, IP and geolocation intelligence, consortium fraud networks, credit bureau data and identity verification checks.

Data quality, governance and privacy considerations

Fraud decisioning depends on accurate, well-governed data. In an EMEA context this means handling personal data in line with UK GDPR and the EU GDPR, maintaining clear data retention policies, and ensuring third-party data sources are properly vetted. Poor data quality does not just weaken model performance, it introduces compliance risk of its own.

Decisioning strategies and rules

Deterministic rules-based decisioning

Simple, explainable rules, such as blocking a known fraudulent email domain or flagging orders above a certain value, remain a foundational layer of fraud decisioning. Rules are fast to deploy and easy to audit, but they may not adapt well when fraud patterns change quickly.

Risk thresholds, limits and step-up flows

Thresholds define the risk score at which a transaction moves from automatic approval to a step-up flow, such as additional authentication, or to an automatic decline. Setting these thresholds correctly is one of the most important levers a fraud manager has.

Segmented strategies by product, channel and geography

A single global rule set rarely fits every market. Segmenting strategies by product line, sales channel and geography, for example applying different thresholds across the UK, EU and Middle East, allows a business to reflect genuinely different risk profiles and payment method mixes.

Scenario-based detection and velocity checks

Velocity checks monitor how frequently a customer, device or payment method is used within a given window, helping to catch account takeover and card testing attacks that a single-transaction rule would miss.

Using business policies and risk appetite in decisions

Ultimately, decisioning strategy should reflect a business’s own risk appetite. A luxury retailer with high average order values will tolerate a different level of risk to a marketplace selling low-cost, high-volume goods.

Fraud prevention

From fear of fraud to confident growth

Stop fraud without sacrificing conversion. Signifyd uses AI and network intelligence to approve more good orders, reduce false declines and protect revenue at scale.

learn more

Machine learning and advanced analytics in fraud decisioning

Machine learning has become essential to modern fraud decisioning because it can identify patterns across millions of transactions that static rules would never catch.

Supervised models learn from historical, labelled fraud and legitimate outcomes to predict the probability that a new transaction is fraudulent, while unsupervised models can surface entirely new fraud patterns that have not yet been labelled.

Behavioural analytics, which studies how a genuine user typically types, scrolls or navigates a checkout, provides additional evidence that is difficult for a fraudster to replicate.

Generative AI is increasingly used defensively too, for example to simulate emerging fraud scenarios and test decisioning models against difficult conditions before new attack patterns reach production traffic.

The strongest fraud decisioning programmes combine machine learning models with human-defined business rules rather than relying on either in isolation. Rules provide explainability and controls that pure machine learning models can lack.

This combination is also what separates modern fraud detection from decisioning: detection flags what looks suspicious, decisioning acts on it instantly.

Real-time decisioning architecture

A real-time fraud decisioning system typically evaluates a transaction in well under a second, often in single-digit milliseconds, by running device, behavioural, identity and payment signals through rules and machine learning models simultaneously rather than in sequence.

This requires a low-latency architecture: data pipelines that can ingest and enrich signals instantly, a scoring layer that can call multiple models in parallel, and a decision layer that can apply business logic and return an outcome before the checkout page has finished loading.

For EMEA merchants operating across multiple currencies, languages and payment methods, from cards and open banking to regional wallets, this architecture also needs to orchestrate authentication flows such as 3D Secure and PSD2 SCA exemptions without adding noticeable delay for the customer.

Customer experience and business impact

Balancing fraud prevention and customer friction

Every additional check a business asks a genuine customer to complete can reduce conversion slightly. Fraud decisioning exists to add that friction only where risk genuinely warrants it, rather than for every customer.

Optimising approval rates and revenue protection

Because false declines can cost a business several times more in lost revenue than the fraud its controls are designed to prevent, approval rate should be tracked and optimised with the same discipline as loss rate, not treated as an afterthought.

Dynamic customer journeys and adaptive authentication

Adaptive authentication applies stronger checks, such as a one-time passcode or biometric verification, only to higher-risk journeys, while allowing trusted, low-risk customers to move through checkout with minimal friction.

Measuring customer impact of fraud controls

Metrics such as false decline rate, checkout abandonment and customer complaints should sit alongside fraud loss rate on any fraud decisioning dashboard, since a programme that eliminates fraud but drives customers away has simply replaced one problem with another.

Analytics, reporting and performance measurement

Key performance indicators (KPIs) for fraud decisioning

Common KPIs include:

• Fraud loss rate
• Chargeback rate
• False positive rate
• Approval rate
• Manual review rate
• Average decision latency

Reviewing these KPIs together, rather than in isolation, gives a fraud manager a clear view of whether the decisioning strategy is delivering balanced outcomes across fraud, revenue and customer experience.

Human in the loop and case management

Manual review workflows and queues

Even the most advanced fraud decisioning system will route a portion of transactions to a human analyst for manual review. Efficient case management, with prioritised queues, clear escalation paths and consistent decision guidelines, keeps this workflow fast enough that it does not slow down the wider process.

Implementation approaches and build versus buy

Evaluating vendor fraud platforms

Specialist fraud decisioning platforms, such as Signifyd’s Fraud Protection, bring pre-trained machine learning models, established data networks and dedicated engineering resource that would take most in-house teams years to replicate.

Learn more about evaluating a fraud prevention vendor

Building in-house fraud decisioning capabilities

Building in-house gives a business full control over its models and data, but requires sustained investment in data science, engineering and ongoing model maintenance as fraud patterns shift.

Hybrid models and phased implementations

Many merchants adopt a hybrid approach, using a vendor platform for real-time decisioning and data science, while retaining in-house policy control over risk thresholds and business rules. A phased rollout, market by market, allows a business to validate performance before scaling further.

Future trends in fraud decisioning

Generative AI and synthetic identity detection

Synthetic identity fraud, where fabricated or blended identity data is used to open new accounts, is a growing concern for ecommerce and financial services alike, and deepfakes and synthetic identities are widely viewed as a defining fraud trend businesses need to prepare for.

Generative AI is lowering the cost of creating convincing fake identities, which means fraud detection and fraud decisioning models increasingly need to look for signals of synthetic behaviour, not just synthetic documents.

Robust identity verification at onboarding remains an important complement to real-time decisioning at checkout.

Behavioural biometrics and continuous authentication

Behavioural biometrics, which analyse patterns such as typing rhythm and touchscreen pressure, are moving from a supporting signal to a central part of fraud decisioning, enabling continuous authentication throughout a session rather than a single check at login or checkout.

Conclusion and best practices

Principles for designing an effective fraud decisioning programme

Effective fraud decisioning programmes are built on:

• Good data
• A blend of rules and machine learning
• Clear risk thresholds tied to business risk tolerance
• Continuous feedback between outcomes and models

Common pitfalls and how to avoid them

Common mistakes include:

• Optimising for loss rate alone while ignoring false declines
• Applying a single global strategy across very different markets
• Allowing models to run without regular retraining or human oversight

Roadmap for maturing fraud decisioning capabilities

Most businesses progress through four stages:

• Manual review
• Rules-based automation
• Machine learning-augmented decisioning
• Real-time, adaptive decisioning supported by continuous feedback loops

Wherever a business is in this process, the goal remains the same: approve more good orders, stop more bad ones, and keep the customer experience frictionless throughout.