Fraud Score

A fraud score is a number summarizing how likely a transaction, application or session is to be fraudulent, produced by a model that weighs many signals at once. It exists to rank cases so that limited review capacity goes to the ones most likely to warrant it.

A score is not a verdict. It is a position in an ordering, and what happens at each position is a business decision made separately from the model.

What goes into a score

Models differ, and the signal families are consistent: device and network attributes such as fingerprint, IP reputation and proxy detection; behavioral signals including navigation patterns, typing cadence and time spent on a form; velocity across entities — how many applications share a device, how many cards share an address; identity attributes and whether they are internally consistent; and historical outcomes for similar cases.

The model learns weights from labeled history. That dependence on labels is where most of the trouble originates, and it is covered below.

The threshold matters more than the model

This is the part most discussions of fraud scoring skip, and it is where the money is.

A model produces an ordering. A threshold turns that ordering into approvals, application reviews and declines — and the threshold is a business decision about the relative cost of two errors, not a technical property of the model. Moving it trades false positives against false negatives along a curve the model fixes but does not choose a point on.

Two organizations running the same model with different thresholds get materially different outcomes, and both can be correct. A lender with thin margins and a high cost per fraud loss belongs at a different point from a marketplace whose main risk is losing good customers to friction.

The practical consequence: a vendor comparison based on score values is meaningless. Scores are on arbitrary scales, so a 700 from one system and a 700 from another have no relationship. Comparison has to be made on ranking quality at a matched operating point — catch rate at an equal false positive rate, or the reverse.

Why it matters for identity verification

A fraud score is inference about an identity. Identity verification is evidence about it, and the two do different work.

Inference is probabilistic and available everywhere, cheaply, on every transaction. Evidence is expensive, slower, and answers a question inference cannot reach. A score of 850 says this case resembles cases that turned out badly; it does not say who the applicant is. A verified document with a matched live face does, and produces no ranking at all.

Used together the division is clean: score everything, and let the score decide where to spend evidence. That is the same structure as risk-based authentication and it generalizes for the same reason — friction is a budget, and a ranking is how you allocate it.

There is a second contribution that matters more than it sounds. Verified identity attributes are among the strongest features a fraud model can have. A model scoring self-asserted data is reasoning about claims the applicant chose; the same model given a verified name, date of birth and document number is reasoning about facts. It also makes entity resolution possible — linking applications to the same real person — which is precisely what velocity features need and what unverified data cannot support.

What a fraud score cannot tell you

It is usually not a probability. Unless a model has been explicitly calibrated, a score of 900 does not mean a 90% chance of fraud. Treating uncalibrated scores as probabilities produces expected-loss calculations that are confidently wrong.

It learns from labels, and the labels are incomplete. Declined applications have no outcome, so the model never learns whether those declines were correct. Undetected fraud is labeled legitimate. A model trained this way gets better at reproducing past decisions, which is not the same as getting better at detecting fraud.

It reflects what the data contains. Where historical decisions correlated with geography, device cost or other proxies for protected characteristics, a model learns those correlations. Removing the explicit attribute does not remove the correlation, and a score is not neutral merely because it is numeric.

It degrades. Fraud patterns change and models drift. A model that is not monitored and retrained gets quietly worse while continuing to emit confident numbers.

It cannot explain itself without effort. Several regimes require adverse decisions to be explained to the person affected. A score alone does not satisfy that, and the explanation has to be produced deliberately.

Frequently asked questions

Is a higher fraud score always worse?

It depends on the system’s convention — some score risk ascending, some score trust, so direction has to be confirmed rather than assumed. Within one system, higher risk means a case ranks above others, not that fraud is established.

Can fraud scores from different vendors be compared?

Not by value. The scales are arbitrary and unrelated, so equal numbers mean nothing in common. Meaningful comparison fixes one metric and measures the other: catch rate at an equal false positive rate, or false positive rate at an equal catch rate.

What is a good fraud score threshold?

Whatever balances the cost of a fraud loss against the cost of rejecting a genuine customer, for that business. There is no universal answer, and the same threshold is right for one organization and wrong for another running the identical model.

Why do fraud models get worse over time?

Because fraud adapts and the population changes, so the relationships the model learned stop holding — model drift. Systems also retrain on their own decisions, which reinforces existing patterns rather than correcting them. Both require deliberate monitoring against fresh outcome data.

Related reading

• Area under the curve — how a model’s ranking quality is measured
• False positive ratio — the cost of where the threshold is set
• Behavior-based fraud analysis — the signal family scores lean on most
• Risk-based authentication — using a score to decide where to spend friction