Fraud screening is the automated and manual evaluation of orders and payment attempts to estimate the likelihood of fraud and decide whether to accept, challenge, review or decline each transaction before goods or services are delivered. In e-commerce payment security, it is the merchant’s own line of defense against stolen card use, account takeover and other forms of payment fraud.
Screening combines rules, risk scores, device intelligence and human review. Its goal is not to stop every suspicious transaction at any cost but to find the best balance between fraud losses, chargeback costs and lost sales from false declines, which are often larger than the fraud itself.
How fraud screening evaluates a transaction
Fraud screening evaluates a transaction by collecting signals, scoring risk and applying a decision policy, usually within a few hundred milliseconds of checkout submission. The process typically runs before payment authorization, after it, or in both positions, depending on the merchant’s setup.
- Data collection gathers order details, customer history, payment data, device fingerprint and network information.
- Enrichment adds derived facts such as IP geolocation, email age, address validation and velocity counts.
- Rules check explicit conditions, for example a mismatch between billing and shipping countries.
- A machine learning model produces a risk score, commonly on a scale such as 0 to 100 or 0 to 1.
- A decision policy maps the score and rule results to accept, step-up authentication, manual review or decline.
- Outcome feedback from chargebacks, refunds and confirmed fraud is fed back to tune rules and retrain models.
The feedback loop is essential. Fraud labels arrive weeks or months later, when chargebacks are filed, so models and rules always learn from slightly outdated patterns and must be monitored for drift.
Signals used in fraud screening
No single signal proves fraud; screening relies on combinations of weak indicators. The table groups the most common signal categories and what each one helps detect.
| Signal category | Examples | What it helps detect |
|---|---|---|
| Payment data | AVS result, CVV match, card BIN country | Stolen card details and card testing |
| Identity data | Email age, phone validity, name consistency | Synthetic or throwaway identities |
| Device and network | Device fingerprint, proxy or VPN use, IP location | Bots, emulators and location masking |
| Velocity | Attempts per card, device or IP in a time window | Card testing and automated attacks |
| Order content | Resalable goods, high quantities, gift cards | Fraud targeting liquid merchandise |
| Behavior | Typing speed, navigation path, time on page | Scripted checkouts and account takeover |
| Customer history | Previous orders, disputes, account age | Trusted repeat buyers versus new risk |
The address verification service (AVS) and card verification value (CVV) checks are useful but weak on their own, because fraudsters who hold full stolen card records can pass both easily.
Screening approaches and decision outcomes
Merchants use several screening approaches, often in combination. Rules are transparent and fast to change, while models capture complex patterns that rules miss. The table compares the main approaches.
| Approach | Strengths | Limitations |
|---|---|---|
| Rule-based screening | Transparent, immediate control | Brittle, many false positives as rules grow |
| Machine learning scoring | Detects complex patterns at scale | Needs labeled data, harder to explain |
| Consortium data | Sees fraud across many merchants | Less tailored to one business |
| Manual review | Human judgment on edge cases | Slow, costly, does not scale |
| Guaranteed fraud protection | Provider absorbs chargeback cost | Fee per order, less policy control |
Each score band should lead to a defined action. The following decision table shows a typical policy structure.
| Risk level | Action | Reason |
|---|---|---|
| Low risk | Accept automatically | Minimize friction for good customers |
| Moderate risk | Request 3D Secure authentication | Verify identity and shift liability |
| Elevated risk | Hold for manual review | Human checks before shipping |
| High risk | Decline the order | Expected loss exceeds expected margin |
Fraud screening compared with related security controls
Fraud screening is often confused with compliance and authentication controls, but it answers a different question: is this specific order likely fraudulent? The table places it among its neighbors in payment security.
| Concept | Main question | Relationship to fraud screening |
|---|---|---|
| PCI DSS | Is cardholder data stored and handled securely? | Protects data; does not judge orders |
| 3D Secure | Is the payer the real cardholder? | A step-up action screening can trigger |
| Chargeback | Does the cardholder dispute the payment? | The cost screening aims to prevent |
| Payment fraud | Is the payment unauthorized or deceptive? | The threat that screening detects |
Tuning, metrics and common mistakes
Effective screening is tuned with business metrics, not only fraud metrics. A system that declines aggressively may show a very low chargeback rate while losing far more revenue through false declines of legitimate customers, many of whom never return.
- Track the chargeback rate against card network monitoring thresholds, which are typically around 1 percent of transactions or lower.
- Measure the false positive rate by sampling declined or reviewed orders and confirming their legitimacy.
- Monitor the manual review rate and review time, because slow reviews delay shipping and frustrate customers.
- Watch the approval rate per segment, such as new customers, international orders and mobile apps.
Common mistakes include adding rules without retiring old ones, blocking entire countries instead of risky patterns, ignoring friendly fraud where real cardholders dispute legitimate purchases, and failing to protect against card testing attacks that run thousands of small authorization attempts through a checkout.
A non-technical view
Fraud screening is the check an online shop runs on each order to spot purchases made with stolen cards or fake identities. It looks at many small clues, such as where the buyer is, which device they use and whether the details match.
It works like an experienced shop assistant who notices when something does not add up, without treating every customer as a suspect. Good screening stops fraudsters while letting honest customers buy without delay.
A concrete example
An online electronics store selling game consoles and headphones noticed a rise in chargebacks for unauthorized purchases, mostly on new accounts with express shipping to addresses far from the billing location.
The team combined a machine learning risk score with three targeted rules: velocity limits per device, a review queue for high-value orders from new accounts with mismatched addresses, and 3D Secure authentication for moderate-risk orders. Reviewers worked from a checklist and aimed to decide within two hours.
Within two months, fraud chargebacks fell clearly, while sampled reviews showed that most held orders were legitimate and could be released quickly. The store reduced fraud losses without broadly declining good customers.