Fraud controls and authorization rates in ecommerce payments

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Riskified's report: Selective authentication can improve approval rates while reducing fraud and manual review in a payment fraud and authorization case study.

Why it matters: It matters to identity and fraud practitioners because checkout controls now sit at the intersection of identity signals, risk decisions, and customer experience.

By the numbers:

• and ST Co., Ltd. increased authorization rates by 15% after working with Riskified for approximately eight months.
• Fraud chargebacks were reduced to approximately 0.0005%, effectively near zero, according to Riskified.
• Manual fraud review was eliminated, saving approximately 10 hours per week.
• The platform surpassed 100 featured brands and 22.2 million total members as of the end of June 2026.

Context

Ecommerce fraud control is no longer just a loss-prevention problem. It now affects approval rates, customer friction, and how payment authentication rules are applied at checkout, especially when merchants are balancing fraud exposure against false declines.

In this case, the control gap was not a lack of authentication but the use of authentication across too many low-risk transactions. That created operational review burden and reduced authorisation efficiency, which is a familiar pattern in mature ecommerce programmes that have not yet tied risk scoring to payment decisions.

Key questions

Q: How should ecommerce teams balance fraud prevention with approval rates?

A: Treat fraud prevention as a decision-quality problem, not a blocking problem. Use identity, device, behavioural, and history signals to distinguish legitimate customers from repeat abusers, then measure success with approval rate, chargeback outcome, and false-positive rate together. The goal is to reduce loss without suppressing good revenue.

Q: Why do strict authentication controls sometimes increase false declines?

A: Because authentication adds friction and creates more chances for legitimate customers to be challenged or rejected. If every transaction is treated as high risk, the control punishes safe users while not necessarily improving fraud precision. The fix is selective authentication, where identity and risk signals determine whether extra verification is justified.

Q: What are the signs that ecommerce fraud operations are not scaling well?

A: Common signs include rising manual review queues, falling approval rates, and persistent friction at checkout even when fraud loss appears controlled. Those symptoms usually mean the programme is relying too heavily on human adjudication or static rules instead of decisioning that can separate low-risk from high-risk transactions.

Q: What should teams do when payment authentication and fraud operations are managed separately?

A: Bring them under one governance model and align policy ownership across fraud, identity, and payments teams. Separate ownership often creates conflicting incentives, such as higher security friction or higher conversion at the expense of control quality. A unified model lets teams tune customer experience without weakening fraud prevention.

Technical breakdown

Why EMV 3-D Secure can lower approval rates

EMV 3-D Secure adds an authentication step that can reduce fraud, but it also introduces more opportunities for payment abandonment and issuer decline. In practice, the problem is not authentication itself but applying it indiscriminately across transactions with different risk levels. When every payment is treated as equally risky, low-risk customers can be forced through unnecessary verification, which depresses authorisation rates and increases false declines. The more mature approach is to treat 3DS as one decision point inside a broader transaction risk engine, not as a universal gate.

Practical implication: Use risk-based routing so authentication is triggered only where the fraud profile justifies the extra friction.

How identity intelligence changes checkout governance

Identity intelligence in ecommerce is the combination of behavioural, device, account, and transaction signals used to determine whether a payment is likely legitimate. It does not replace authentication, but it changes when and how authentication should be applied. That matters because a checkout flow governed only by static rules tends to over-call risk, especially when fraud pressure rises. Risk-based identity decisions give merchants a way to preserve stronger controls for suspicious activity while allowing low-risk buyers to complete checkout more smoothly.

Practical implication: Blend account, login, and transaction signals into one decision model instead of managing each control separately.

Why manual review becomes the scaling bottleneck

Manual review is the human fallback for borderline fraud cases, but it rarely scales well when ecommerce volume rises. Review queues absorb time, create inconsistent decisions, and often become a hidden tax on both operations and customer experience. In this article, the manual-review burden was significant enough that eliminating it became part of the operational value. The underlying lesson is that fraud operations should be designed to shrink the number of transactions that require human adjudication, not to depend on humans as the primary control layer.

Practical implication: Reduce review volume by tightening decision thresholds and improving model confidence at the point of transaction.

Threat narrative

Attacker objective: The attacker objective is to push fraudulent transactions through payment controls without triggering effective challenge or review.

1. Entry occurs through account creation, login, or payment attempts that may look legitimate unless identity and transaction signals are assessed together.
2. Escalation happens when high-risk activity is authenticated too broadly, creating more friction for honest customers while still leaving fraud opportunities in the flow.
3. Impact is higher false-decline rates, more manual review, and weaker checkout conversion even when fraud controls are in place.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Selective authentication is becoming the real control plane for ecommerce fraud. The article shows that authentication itself is not the issue. The issue is whether authentication is applied with enough discrimination to preserve conversion while still containing fraud. For identity and fraud teams, this is a governance problem, not just a tuning exercise, because it links identity confidence to payment outcome.

Fraud, identity intelligence, and authorisation decisions now form a single operating model. Separating them produces brittle control design. If account trust, payment risk, and checkout friction are governed in different silos, teams either over-challenge low-risk users or under-control suspicious flows. The named concept here is checkout risk orchestration: the deliberate coordination of identity signals and payment checks to decide when friction is justified.

Manual review is a symptom of weak decision confidence, not a durable control strategy. Review queues are useful for exception handling, but they should not be the primary mechanism for scaling fraud operations. The more a merchant depends on human adjudication, the more it signals that upstream identity and transaction scoring are not decisive enough. Practitioners should treat reduction in review load as a governance outcome, not just an efficiency metric.

Payment authentication requirements are increasingly acting like identity policy decisions. Once merchants can bypass challenge for low-risk activity and reserve step-up for suspicious flows, payment controls start behaving like conditional access. That puts fraud operations closer to IAM-style policy design than many ecommerce teams realise. The practitioner implication is that fraud governance, customer identity signals, and checkout policy now need shared ownership.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Checkout risk orchestration: ecommerce merchants increasingly need one policy layer that coordinates identity signals, fraud scoring, and authentication decisions. When those controls are separate, teams either over-challenge low-risk buyers or let suspicious activity move too freely. The practical shift is from static fraud rules to conditional decisioning at checkout.

Manual review should be treated as an exception path, not the operating model for modern ecommerce fraud control. As transaction volumes rise, the control that matters most is the one that can confidently separate low-risk from high-risk activity before a human is needed.

For identity and fraud programmes, the key design question is no longer whether to authenticate, but when authentication adds value. That makes authorisation, risk assessment, and checkout policy part of the same governance conversation.

For practitioners

• Implement risk-based 3DS challenge policies Use transaction and identity signals to exempt low-risk payments from unnecessary step-up authentication while preserving verification for suspicious activity.
• Unify account and payment risk scoring Combine login, account creation, device, and transaction signals into one decision workflow so fraud controls can evaluate the whole customer journey.
• Measure false declines alongside fraud loss Track approval rate, chargeback rate, and manual review volume together so a fraud control does not look effective while harming conversion.
• Reduce dependence on manual review queues Reserve human review for ambiguous edge cases and tune models so routine decisions are made automatically at checkout.

Key takeaways

• The core problem is not a lack of payment authentication, but using it too broadly and creating avoidable friction for legitimate customers.
• The case study links stronger decisioning to better operational outcomes, including higher authorisation rates, near-zero chargebacks, and the removal of manual review.
• Ecommerce teams need a unified governance model that ties identity signals to payment decisions, so fraud controls support conversion instead of undermining it.

Key terms

• Smart Authentication: Smart authentication is an identity control that adds context or multiple verification factors before granting access. In regulated environments it usually combines MFA with device, location, or risk signals so that access decisions are more defensible and easier to audit.
• False decline: A false decline is a legitimate transaction that is rejected because the fraud controls interpret it as risky. It matters because the operational cost is not limited to one lost sale. It can also damage customer trust, reduce retention, and distort fraud programme metrics.
• Manual Review: Manual review is the human escalation path for cases that automated identity checks cannot resolve cleanly. It matters because edge cases often reveal whether the programme can explain exceptions, preserve evidence, and maintain consistent decision quality under fraud pressure.
• Transaction Risk Scoring: A policy method that adjusts authentication strength according to the value, sensitivity, and context of the action being attempted. It is not a login-only control. It uses device, behavioural, and transaction signals to decide whether a request should proceed, step up, or fail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and access control patterns that help practitioners think clearly about policy decisions. It gives security and identity teams a structured way to govern machine and human access across modern programmes.