Fraud Signals That Actually Matter

Every fraud team eventually faces the same trade-off. Tighten the rules and good customers get declined. Loosen them and chargebacks rise. The way out is not more rules but better signals: a small number of features that genuinely predict fraud, scored together, with friction applied only where risk is high. This note covers the signals we have found most useful in sample models, how to combine them and how to keep legitimate customers moving while you stop the rest.

Why most rules age badly

Static rules — block this country, decline orders above that amount, flag every new email domain — are easy to write and hard to maintain. Fraud patterns shift within weeks, and each rule quietly declines a slice of legitimate customers who happen to match it. Over time, a rule set grows into a list nobody fully understands, with approval rates slowly eroding underneath it.

Signals are different. A signal is a measurable feature of a payment, device or identity that carries information about risk. Rather than deciding on its own, it contributes to a score. That makes signals easier to evaluate, weight and retire as patterns change.

Signals that predict fraud

Across illustrative datasets, a handful of signal families consistently do most of the work.

Velocity

How fast is something happening relative to normal? Many cards tried from one device in a short window, many devices using one card, or a sudden burst of small authorisations followed by a large one are classic patterns of card testing and account takeover. Velocity signals are cheap to compute and among the most predictive available.

Consistency

Does the information in the payment agree with itself? Mismatches between billing country, card issuing country, IP geolocation and shipping address are not proof of fraud — travellers and gift buyers exist — but combinations of several mismatches are strongly associated with it.

Identity age and history

How long has this email, phone number, device or account existed, and how has it behaved? A brand-new identity placing a high-value first order carries more risk than a returning customer with a clean history. Positive history is one of the strongest signals for approving payments that would otherwise look unusual.

• Device: stable fingerprint, previously seen with successful payments.

• Account: age, past orders, past disputes.

• Contact data: age and reputation of email and phone, not just their format.

• Behaviour: time on page, copy-paste of card details, navigation that looks automated.

The most valuable fraud signal is often the one that tells you a customer is good. Approving with confidence is as important as declining with confidence.

Combining signals into a score

Individual signals are noisy. Combined, they become useful. Most teams start with a weighted score and move to a trained model once they have enough labelled outcomes — chargebacks, confirmed fraud and confirmed good orders.

def risk_score(p):
    score = 0
    score += 30 if p.cards_per_device_1h > 3 else 0
    score += 20 if p.billing_country != p.ip_country else 0
    score += 25 if p.account_age_days < 1 and p.amount > 500 else 0
    score -= 30 if p.device_seen_with_success else 0
    return max(0, min(100, score))

def risk_score(p):
    score = 0
    score += 30 if p.cards_per_device_1h > 3 else 0
    score += 20 if p.billing_country != p.ip_country else 0
    score += 25 if p.account_age_days < 1 and p.amount > 500 else 0
    score -= 30 if p.device_seen_with_success else 0
    return max(0, min(100, score))

def risk_score(p):
    score = 0
    score += 30 if p.cards_per_device_1h > 3 else 0
    score += 20 if p.billing_country != p.ip_country else 0
    score += 25 if p.account_age_days < 1 and p.amount > 500 else 0
    score -= 30 if p.device_seen_with_success else 0
    return max(0, min(100, score))

The example is deliberately simple and the weights are illustrative. Its value is in the structure: risk signals add, trust signals subtract, and the output is a number you can set thresholds against and monitor over time.

Keep good customers moving

A score is only useful if it drives proportionate action. Treat every payment the same and you either let fraud through or block good customers. A tiered response works better:

1. Low risk: approve without friction. This should be the large majority of payments.

2. Medium risk: add a step — strong customer authentication, a one-time code or address verification.

3. High risk: decline, or hold for review if the order value justifies human attention.

Measure the cost of friction as carefully as the cost of fraud. Track how many challenged customers complete the extra step, and how many legitimate orders end up declined. A rule that blocks a little fraud but drives away many good buyers is a net loss.

Closing the loop

Fraud prevention improves only when outcomes flow back into the system. Chargebacks, refunds marked as fraud, manual review decisions and customer complaints about false declines are all labels. Feed them back into scoring weekly, retire signals that stop carrying information, and review thresholds whenever approval rates or dispute rates move. The goal is not zero fraud. It is the lowest total cost of fraud, friction and lost customers combined.

Sample engineering note for a website template — fictional brand, illustrative values, not security advice.