Fraud Scoring: Set Risk Thresholds Using Chargeback and Margin Data

Fraud scoring is the process of combining multiple risk signals into a single numeric score for each transaction, then setting thresholds that route that score to an automatic approval, manual review, step-up verification, or automatic decline. The score itself is just an estimate. The threshold is the actual business decision, and it is only correct once it has been validated against dispute outcomes from transactions old enough to have settled.

Most fraud scoring writeups stop at how the score gets calculated. The part that determines whether the score makes or loses money is where you cut it into bands, and whether you checked those cut points against what actually happened to the orders in each band, not just what the model predicted would happen.

Entendendo a pontuação de risco de fraude

A fraud score combines transaction, device, and behavioral signals into one weighted number, typically using a model such as a decision tree, logistic regression, or a similar statistical classifier trained on labeled historical data. Each signal contributes evidence toward or against a transaction being fraudulent, and the model outputs a single score representing overall risk.

The model is necessary but not sufficient. Two stores can use an identical scoring model and get different results, because the thresholds that turn a score into approve, review, step-up, or decline decisions were tuned against each store's own order economics and dispute history, not the model's raw output.

Data Sources for Fraud Scoring, and How Fast Each One Is Usable

Fraud scoring models draw on several data sources, and each one becomes usable at a different point in the transaction lifecycle:

• Transactional data: purchase details, payment method, order value, shipping address, and timestamps, available instantly at checkout.
• Device and IP data: device fingerprint, geolocation, and IP reputation, also available instantly, though IP reputation lists lag real-world fraud reports by days.
• User behavior data: browsing patterns, session duration, and click behavior, available instantly but only meaningful once a customer has enough history to compare against.
• Dispute outcome data: confirmed fraud reports and chargeback results, the one input that is not available at the moment of decision. It takes 30 to 120 days to arrive, depending on the card network's reporting window, and it is the only source that tells you whether the score was actually right.

Score Bands: Turning a Number Into a Decision

A score only becomes a decision once you define what happens at each range. A typical structure uses four bands.

Validate Every Band Against a Mature Dispute Cohort

You cannot validate a decline band using last week's transactions, because the confirmed fraud and chargeback outcomes that prove whether the band was calibrated correctly have not arrived yet. Validating a score requires pulling a cohort of transactions old enough for their disputes to have settled, typically 90 days or more, and checking two things per band: what share of the decline band would have turned out to be legitimate, and what share of the approve band turned into confirmed fraud or a chargeback.

Every band in that validation needs the same maturity window. Comparing a decline band measured on 90-day-old, fully settled data against an approve band measured on last week's unsettled data is not a fair comparison, since the approve band's fraud and dispute outcomes are still arriving and will look artificially clean. Hold every band to the same cohort age before drawing a conclusion about where the cut points belong.

Segment Bands by Reason Code, Issuer, Product, and Geography

A score band that is well calibrated for your overall traffic can be badly miscalibrated for a specific segment. Check band precision separately by dispute reason code, issuing bank, product category, and geography, since a model trained on blended data tends to reflect your largest segment's behavior and can systematically misprice risk for smaller ones. Layering decline and authorization codes from your payment service provider onto this segmentation shows whether a band's false-positive rate is a scoring problem or a processor-routing problem.

Calculate False-Positive Cost and Net Recovery by Band

Every band carries a cost on both sides: the false-positive cost of legitimate orders it declines or over-verifies, and the chargeback cost of fraud it approves. US merchants absorb an average $128 per chargeback, split between $82 in internal handling cost and $46 in third-party fees, according to Mastercard and Javelin Strategy and Research's 2026 whitepaper. On the other side, PYMNTS Intelligence's March 2026 report, Orchestrating Trust: The Future of Fraud Prevention in Payments, found that merchants estimate up to 5% of legitimate orders are wrongly declined, a loss the report puts near $50 billion industry-wide. Running both figures against the same band, using the same fraud analytics discipline applied to any other rule, is what tells you whether a cut point needs to move.

Turn Validation Results Into Threshold, Workflow, or Ownership Changes

A band that fails validation should trigger a specific change: move the cut point, route the band to step-up verification instead of auto-decline, or rebuild it as an explicit fraud filter rule for the segment where the blended score is failing. It is also worth being direct about what a score cannot do. A score built from device, velocity, and behavioral signals is built to catch a stranger using someone else's card. It has little power against friendly fraud, where the actual cardholder places the order and disputes it later, since every signal the model relies on looks completely legitimate in that scenario. That gap has to be closed with evidence retention and dispute response, not a lower decline threshold.

Reviewing chargeback reports and chargeback data alongside your chargeback win rate, and pairing risky bands with chargeback prevention alerts, closes the loop between what the score predicted and what the dispute record actually shows.

A Score Is Only as Good as the Threshold Behind It

The model produces a number. The threshold decides what that number costs or saves. Validate every band against a dispute cohort old enough to have matured, segment before trusting a blended result, and price the false-positive side of every band against the chargeback side it exists to prevent, as part of the same ecommerce fraud prevention program that governs your filters and analytics.

Fraud Scoring FAQ

What is a fraud score?

A fraud score is a single numeric estimate of how likely a transaction is to be fraudulent, calculated by combining transactional, device, and behavioral signals into one weighted output that a merchant then routes to an approve, review, step-up, or decline decision.

What is considered a high fraud score?

There is no universal number, since scoring scales and calibration differ by provider and by store. What matters is where your own decline and step-up bands sit relative to validated dispute outcomes for your traffic, not a specific score value taken from another business.

What data feeds a fraud score?

Transactional data such as order value and shipping address, device and IP data such as fingerprint and geolocation, and behavioral data such as browsing and session patterns feed the score in real time. Confirmed fraud and chargeback outcomes feed the validation of the score after the fact, once they have had time to settle.

What is the difference between fraud scoring and fraud filters?

Fraud scoring produces one composite number from multiple signals and routes transactions by score band. Fraud filters apply discrete rules to individual signals, such as blocking any order above a set velocity threshold. Most mature programs use scoring for routing and filters for specific, high-confidence rules layered on top.

Can fraud scoring catch friendly fraud?

Not reliably. Friendly fraud involves the legitimate cardholder making the purchase and disputing it later, so the device, location, and payment signals a fraud score relies on look identical to a normal transaction. Preventing friendly fraud chargebacks depends on evidence retention and dispute response rather than a lower score threshold.

See how Chargeflow Insights lets you validate score bands against dispute performance across every store and processor in one view.