Glossary
What is transaction risk scoring?
Transaction risk scoring gives each payment a score for how likely it is to be fraudulent or otherwise risky, based on signals about the customer, device, payment instrument and transaction. The score drives a decision: approve, add a check such as 3-D Secure, send to manual review, or decline. Risk scoring helps merchants stop more fraud without putting every customer through the same friction.
- Transaction risk scoring
- Assigning each payment a score for how likely it is to be fraudulent or otherwise risky, based on signals about the customer, device, payment instrument and transaction, and using thresholds to turn that score into an approve, challenge, review or decline decision.
How does transaction risk scoring work?
A risk score doesn't prove anything about a transaction. It's a prediction. Its value depends on the quality of the signals behind it and on how sensibly you set the thresholds that turn a score into an action.
1. Collect signals. When a customer submits a payment, the scoring system collects data available at that moment: transaction details, device and session information, customer account history and the payment instrument. Some signals come from your checkout, some from your own customer database, and some come back from providers.
2. Calculate a score. The signals are combined into a score using rules, a statistical model or both. Higher scores usually mean higher risk, though the scale differs between systems. Good systems also return the reasons behind the score (for example, billing country doesn't match card country, or many attempts from this device in a short time) so people can understand and challenge the decision.
3. Make a decision. The score is compared with thresholds you define, as listed below. The outcome (approved, declined, disputed or confirmed as fraud) can feed back into the system to improve future scores, as described in the privacy notice.
- Low risk: approve and send for authorization with minimal friction.
- Medium risk: add a step-up check, such as 3-D Secure, or extra verification.
- High risk: hold for manual review, or decline.
- Very high risk or a block-list match: decline before the payment reaches a provider.
What are common risk signals?
Scoring systems draw on several groups of signals.
No single signal is decisive. A mismatch between card country and IP address might be fraud, or a customer who's traveling. Scoring works because it weighs many signals together.
| Signal category | Examples | What it can indicate |
|---|---|---|
| Transaction context | Amount, currency, product type, time of day | Unusual purchases for this merchant or customer |
| Payment instrument | Card country, card type, card seen before, number of cards per account | Stolen or tested cards, mismatched geography |
| Velocity | Attempts per card, device, IP address or email in a time window | Card testing, automated attacks |
| Device and session | Device fingerprint, browser settings, IP reputation, proxy or VPN use | Masked identity, bots, repeat offenders |
| Identity and contact | Email age and format, phone validity, name and address consistency | Synthetic or throwaway identities |
| Geography | IP country vs billing country vs card country vs shipping country | Cross-border mismatch that needs context |
| Customer history | Previous successful orders, refunds, disputes, account age | Trusted returning customer, or past problems |
| Behavior | Time spent in checkout, copy-paste of card data, failed attempts before success | Scripted or unusual checkout behavior |
Rules-based vs model-based risk scoring
There are two main ways to build a score, and most teams end up combining them.
Most mature setups are hybrid. Rules handle non-negotiables (block lists, velocity limits, regulatory requirements), and a model handles the gray area.
| Approach | How it works | Strengths | Weaknesses |
|---|---|---|---|
| Rules-based | Fixed rules add or subtract points, or block outright (more than N attempts per card per hour) | Easy to understand, quick to change, transparent | Hard to maintain as rules pile up, misses new patterns, can cause false positives |
| Model-based | A statistical or machine-learning model learns patterns from labeled past transactions | Picks up complex patterns, adapts with new data | Needs good labeled data, harder to explain, can drift over time |
| Hybrid | Rules for hard limits and known patterns, a model for the overall score | Combines control and adaptability | Needs governance over both |
How do you set risk score thresholds?
Thresholds are business decisions, not just technical settings. When setting them, follow the steps below.
- Start from your own data. Look at how past fraud, disputes and good orders spread across score ranges.
- Define the cost of each mistake. A missed fraud can cost the order value plus any dispute fees and handling time. A false decline costs the sale and possibly the customer.
- Use a middle band. Step-up authentication or manual review for medium scores is often better than a hard approve/decline split.
- Segment where it matters. New vs returning customers, digital vs physical goods and different markets may need different thresholds.
- Review regularly. Fraud patterns change, so check thresholds against outcomes on a fixed schedule.
How does risk scoring affect approval rates?
Fraud prevention and approvals pull in opposite directions. Rules that are too strict block legitimate customers. These false positives are often invisible, because the customer just leaves. Rules that are too loose let fraud through, which leads to disputes, losses and pressure from providers.
Risk scoring helps balance the two: low-risk customers move through quickly, and checks are focused where risk is real. Track false-positive indicators, such as declined customers who later succeed with another method or contact support, alongside fraud and dispute rates.
Where does risk scoring fit in payment orchestration?
In a multi-provider setup, risk scoring works best before a payment reaches any provider.
One shared score across providers also avoids a common problem in multi-provider setups: each provider applies its own fraud checks with no shared view of the customer. See our guide to payment orchestration.
- Before routing: decide whether the payment should be sent at all, and whether it needs 3-D Secure.
- Before cascading: check that a declined payment is still low risk before resubmitting it to another provider. Never cascade payments that the issuer or your own checks flagged as fraud.
- In reporting: keep risk scores, signals and decisions in the same transaction record as provider responses, so operations teams see the full picture.
How does risk scoring handle data and privacy?
Risk scoring processes personal data, so it comes with obligations. Collect only the signals you need, document why each one is used, keep card data out of risk logs (mask it), and limit who can see raw signals.
Under the GDPR, decisions based solely on automated processing that significantly affect a person are restricted (Article 22): they need a legal basis such as contract necessity or explicit consent, plus safeguards such as the right to human review, and customers must be informed in your privacy notice. Keeping reason codes for each decision makes reviews, customer complaints and audits much easier.
How does RiskCogs score transactions?
RiskCogs is the anti-fraud module of OrsunPay, payment orchestration software that connects you to licensed PSPs. RiskCogs calculates a risk score for each transaction, shows the signals behind it and records the resulting decision in the transaction view, next to provider responses and the payment timeline. Merchants configure the decisions and thresholds. Scores feed into routing and cascading rules, so risk is checked once across all providers. Talk to us to see how RiskCogs would work with your traffic.
Frequently asked questions
What is a transaction risk score?
It's a number that estimates how risky a payment is, based on signals such as amount, device, location, payment instrument and customer history. The score is used to approve, challenge, review or decline the payment.
What is a good risk score threshold?
There's no universal threshold. It depends on your products, customers, fraud history and what each type of mistake costs you. Set thresholds from your own data and review them regularly.
Is risk scoring the same as 3-D Secure?
No. Risk scoring is your own assessment of a transaction. 3-D Secure is an authentication step with the card issuer. A risk score can decide when to trigger 3-D Secure.
Can risk scoring reduce false declines?
It can help. Instead of blocking whole categories of payments with blunt rules, scoring lets low-risk payments through and focuses extra checks on genuinely risky ones.
Do I need machine learning for risk scoring?
Not necessarily. Rules-based scoring can work well, especially early on. Models help when you have enough labeled data and patterns are too complex for rules alone. Many teams use both.
What data does transaction risk scoring use?
Typically transaction details, payment instrument data, device and session data, velocity counts, geography and customer history. Card data should be masked or tokenized in risk logs.