Fraud Rules That Do Not Cost You Sales

The number most merchants never measure

Fraud losses are visible: a chargeback arrives with a value attached. False declines are invisible — a good customer is turned away and never appears in a report.

For many card-not-present businesses the revenue lost to false declines exceeds the fraud prevented. If you cannot estimate your false-decline rate, your fraud strategy is being optimised against half the data.

Segment before you tighten

A single global rule set treats a £20 repeat order and a £2,000 first-time order identically. Segmenting lets you be strict where exposure is real and permissive where it is not.

• Order value bands, with tighter checks above a threshold you set from your own data
• Customer history — returning customers with clean records deserve fewer obstacles
• Product type, since easily resold goods attract different behaviour
• Geography, judged on your own fraud data rather than reputation
• Delivery-address mismatches, which matter far more for physical goods than digital
• Velocity patterns, such as repeated attempts with different cards

Use three outcomes, not two

Approve and decline is a lossy pair. Adding a review outcome for the narrow band of genuinely ambiguous orders converts guesses into decisions.

Keep the queue small enough to clear inside your dispatch window. A review queue that delays shipping becomes a non-receipt dispute generator, which is the problem you were trying to avoid.

Authentication as a tool, not a wall

Where 3-D Secure or equivalent authentication applies, a successful challenge can shift liability for fraud disputes to the issuer. That is valuable, but every challenge adds friction and some customers abandon.

The practical approach is selective: authenticate where exposure justifies it, use available exemptions for low-risk transactions where the rules in your market permit them, and monitor both the fraud outcome and the abandonment cost.

Review the rules on a schedule

Fraud patterns move. A rule written for last year’s attack is now just friction that nobody has audited.

Set a recurring review: which rules fired, what they caught, what they blocked that later proved legitimate. Retire rules that no longer earn their place. Note also that fraud disputes and service disputes are different problems — do not treat a rising ratio driven by non-receipt as a fraud-screening failure.