Black-box scores vs transparent flags
Vendors sell single-number fraud scores: convenient, but unexplainable. When a score of 87 blocks a real customer, nobody on your team can say why, and disputing the vendor's opinion is not possible. The alternative is transparent signals: named true/false flags, is_datacenter, is_vpn, is_disposable_email, combined with weights you choose. You can explain every decision, tune every rule, and audit false positives.
That transparency is Abstract's approach: the IP Intelligence API returns the network flags and geolocation as plain booleans and fields rather than a proprietary score, and the same signals power the customer risk assessment solution. A reasonable starting model is simple addition: datacenter IP +40, disposable email +30, geo mismatch +20, VPN +15, with review at 40 and block at 70. Tune from your own dispute data.
Setting thresholds: the cost of each mistake
Scoring is a trade between two errors. A false negative costs the goods plus a chargeback fee and ratio damage; a false positive costs the sale and often the customer. That asymmetry is why most teams run three bands rather than a single cutoff: auto-allow the clean majority, auto-block the obvious attacks, such as card testing runs, and route the ambiguous middle to review. Keep the review band under a few percent of volume or the queue collapses.
Build, buy, or combine?
Buying a scoring product makes sense at high volume with a fraud team to manage it. Building a full model needs labeled dispute history most businesses lack. The middle path fits most teams: buy the signals, combine them with rules you own. One enrichment request per event, a weighted sum, three thresholds. The broader detection pipeline around it is covered in the payment fraud guide.
Frequently Asked Questions
What is a fraud risk score?
A real-time number expressing how likely an event, a transaction, signup, or login, is to be fraudulent, computed from network, identity, consistency, and velocity signals. Thresholds on the score decide allow, review, or block.
What is a good fraud score threshold?
There is no universal number; it depends on your margins and dispute costs. Start with three bands, roughly allow below 40, review 40 to 70, block above 70 on a 0 to 100 scale, and tune against your own chargeback outcomes.
What signals matter most for fraud scoring?
Network type is the strongest single online signal: datacenter, VPN, proxy, and Tor traffic correlates heavily with automation and evasion. Disposable emails and geography mismatches follow close behind. Combinations beat any single flag.
What is the difference between risk scoring and rules?
Rules are binary: match and act. A score accumulates evidence across many weak signals, so no single factor decides alone. Most real systems are rules layered on top of a score.
Should I use a vendor's fraud score or build my own?
If you need explainable decisions, combine transparent signal flags with your own weights. Buy a full scoring product when volume and a dedicated fraud team justify it. Signals-plus-rules covers most businesses well.
How is customer risk assessment different from transaction scoring?
Transaction scoring judges a single event; customer risk assessment scores the account behind events, its history, identifiers, and network patterns, so trusted customers skip friction and risky accounts get watched everywhere.
