Fraud and policy abuse controls lift ecommerce approval rates

At a glance

What this is: Riskified says Kogan.com improved approval rates above 98% while cutting fraud and policy abuse losses through identity-aware decisioning.

Why it matters: This matters because ecommerce teams need controls that reduce fraud without suppressing legitimate customers, and the same balancing act increasingly affects identity signals, policy abuse, and operational workload.

By the numbers:

• Kogan achieved approval rates exceeding 98% after improving fraud and policy abuse management, according to Riskified.

Context

Fraud and policy abuse become governance problems when approval controls are tuned only to block loss and not to preserve legitimate commerce. In card-not-present ecommerce, that trade-off directly affects conversion, customer experience, and the quality of identity signals used in downstream decisions.

Kogan’s case shows the operational tension clearly: serial policy abuse, promo misuse, and subscription chargebacks can erode margin without looking like classic payment fraud. For teams running identity-linked commerce journeys, the lesson is that approval logic has to reason about intent, not just transaction risk.

Key questions

Q: What fails when ecommerce approval systems focus only on fraud blocking?

A: When approval systems focus only on fraud blocking, they create false positives that reject legitimate customers and hide policy abuse behind a generic risk score. Merchants then lose revenue, increase manual review load, and still miss serial abuse patterns that do not look like classic fraud.

Q: Why do behavioural and device signals matter more as fraud becomes more automated?

A: Behavioural and device signals matter because automated attacks can mimic static credentials but struggle to reproduce real interaction patterns, device characteristics, and network behaviour consistently. When organisations rely only on one-time codes or basic checks, they leave gaps that agentic AI driven fraud can exploit. Continuous signal analysis makes impersonation harder and improves detection across the session.

Q: How can teams tell whether exec approvals are actually working?

A: They should test the exact execution path used in production, not the configuration label. If shell commands that reach the network run without visible allowlist or approval enforcement, then exec approvals are not functioning as a real barrier. The control has to block or mediate the command before output can be passed back into the agent.

Q: What is the difference between fraud prevention and policy abuse management?

A: Fraud prevention is aimed at stopping illegitimate transactions, often using payment and behavioural risk signals. Policy abuse management targets customers who exploit returns, promotions, subscriptions, or guarantees in ways that may be allowed by the payment rail but still damage margin and operations.

Technical breakdown

Why approval models need identity and intent signals

Ecommerce approval engines often rely on device, behavioural, and transaction attributes to infer whether a purchase is legitimate. That is different from simple fraud blocking, because the system must separate risky actors from good customers who happen to trigger a rule. When policy abuse, promo misuse, and first-time buyer behaviour sit in the same decision path, approval logic needs richer identity context to reduce false positives without weakening control quality. In practice, machine learning models work best when they are trained on outcome data that reflects both fraud and customer intent.

Practical implication: enrich decisioning with identity and behavioural signals so approval controls can distinguish abuse from legitimate purchasing intent.

How chargeback automation changes the control model

Manual dispute handling is a compensating control, not a primary prevention layer. It can recover some losses, but it does not improve the upstream quality of decisions or reduce the operational cost of repeated reviews. Chargeback guarantee models change the incentive structure by shifting part of the downside away from the merchant, while automated dispute management reduces the labour required to contest and resolve cases. That makes governance more continuous, because teams can focus on tuning decisions rather than processing exceptions after the fact.

Practical implication: treat chargeback automation as a decision-support and workload-reduction control, not a substitute for upstream fraud and abuse governance.

NHI Mgmt Group analysis

Approval optimisation is now an identity governance problem, not just a fraud problem. The article shows that merchants are no longer trying to maximise block rates alone. They are trying to make accurate trust decisions across customers, devices, behaviours, and policy-abuse patterns. That pushes ecommerce risk management closer to identity verification governance, where the quality of the signal matters as much as the severity of the loss. Practitioners should read this as a shift from static fraud blocking to intent-aware approval governance.

Policy abuse creates a distinct control gap because it is not always visible in traditional fraud metrics. Serial abuse, promo misuse, and subscription chargebacks can damage margin without producing the same alarm profile as obvious account takeover or stolen-card use. That means merchant controls need a named concept we can call approval confidence gap: the space between what a system flags as risky and what it can confidently approve as legitimate. Practitioners should design controls to close that gap, not just to score transactions.

Identity signals are becoming the bridge between fraud prevention and customer experience. The strongest part of this case is not the headline approval rate but the operational confidence behind it. When behavioural and device intelligence improve, teams can reduce false positives and still preserve control over abusive patterns. For identity and fraud teams, the governance task is to ensure those signals are explainable, monitored, and aligned to business tolerance for risk.

Manual review and chargeback handling remain useful, but they are no longer sufficient as the center of the operating model. The article points to a broader pattern in digital commerce: controls must scale with transaction volume without creating process drag. That is especially relevant where identity signals, payment risk, and policy enforcement converge. Practitioners should expect approval governance to become more automated, more data-rich, and more dependent on continuous model tuning.

What this signals

Approval governance in ecommerce is becoming a balancing exercise between loss prevention and trust calibration. Teams that optimise only for fraud suppression will keep paying for false positives in conversion, support, and manual review cost. The better control objective is to make each approval decision more confident, not just more restrictive.

Policy abuse is the control blind spot many fraud programmes still under-measure. Promo misuse, serial abuse, and subscription chargebacks often sit outside the same reporting discipline as stolen-card fraud, which leaves margin leakage hidden until it becomes operationally painful. Practitioners should treat those patterns as a separate governance stream with their own thresholds and escalation logic.

Approval confidence gap: this is the space between transactions that are blocked as risky and transactions that can be approved with enough evidence to support business growth. Closing that gap requires better identity, device, and behaviour context, not simply harsher fraud rules.

For practitioners

• Tighten approval thresholds around false positives Review where good customers are being blocked because rules over-weight stolen-card patterns and under-weight behavioural context. Rebalance decisioning for first-time buyers, high-value baskets, and repeat purchasers so approval rates can rise without opening obvious abuse paths.
• Separate policy abuse from payment fraud Track promo misuse, serial returns, and subscription chargebacks as distinct abuse categories rather than folding them into a single fraud metric. Separate reporting makes it easier to see where revenue leakage comes from and where approval logic needs adjustment.
• Use richer identity and device intelligence Feed device, behavioural, and customer-level signals into the decision engine so the platform can distinguish legitimate intent from repeated abuse patterns. This is most useful where card-not-present commerce makes traditional card checks insufficient.
• Reduce dependency on manual chargeback handling Treat manual dispute work as an exception process, not a core control. Use automation where possible to lower review overhead and preserve analyst time for cases that truly require judgment.

Key takeaways

• Ecommerce fraud control is moving beyond simple blocking, because merchants now need to distinguish legitimate customers from abusive behaviour without damaging conversion.
• The case shows that policy abuse can erode margin even when chargeback rates remain controlled, which means traditional fraud metrics do not tell the whole story.
• The practical response is to use richer identity and behavioural signals, automate dispute handling where appropriate, and measure approval quality alongside loss reduction.

Key terms

• Policy Abuse: The misuse of a legitimate transaction flow to bypass merchant rules around quantity, eligibility, resale, refunds, or claims handling. It may not always be fraud in the narrow sense, but it still creates governance risk because the merchant loses control over how buying privileges are exercised.
• False Positive: A false positive is a scanner result that looks like a secret but is not actually sensitive. In secret governance, false positives matter because they consume analyst time, weaken trust in alerts, and can delay response to the findings that truly change exposure and access risk.
• Chargeback: Chargeback is the allocation of technology costs back to the business unit, product, or service that incurred them. For AI workloads, it becomes a governance control when pricing and attribution are reliable enough that cost responsibility can influence design, usage, and prioritisation.
• Behavioural Signal: A pattern in how a user acts over time that can help distinguish normal activity from abuse. In fraud operations, behavioural signals include timing, repetition, device consistency, channel switching, and claim history. They are most useful when combined with human review and case context.

Deepen your knowledge

NHI Foundation Level course covers NHI governance, machine identity security, and secrets management through the industry's only accredited NHI security programme. It helps security and identity practitioners build the governance foundation needed for modern access and trust decisions.