TL;DR: Transaction authorization and merchant approval are separate decisions at checkout, and banks often decline good customers because they lack richer context while sophisticated fraud still gets through, according to Signifyd. The governance problem is not just fraud scoring but decision quality at each control point, where thin data creates revenue loss, chargebacks, and avoidable customer friction.
At a glance
What this is: This analysis separates bank authorization from merchant approval and shows that thin issuer data drives false declines, avoided sales, and missed fraud signals.
Why it matters: Merchants, fraud teams, and identity practitioners need to treat checkout as two distinct control points, because improving one decision layer does not fix the other.
By the numbers:
- According to Signifyd data, 15% of orders are falsely declined for authorization by banks.
Context
Transaction authorization is the bank's decision that a payment can proceed, while merchant approval is the separate decision that it should proceed. In practice, that split means the bank sees only a narrow slice of context, which can produce both avoidable declines and missed fraud.
For security and identity teams, the important lesson is that checkout is a governance problem, not just a fraud-scoring problem. Identity signals, device context, order history, and behavioural data can materially change the quality of access or payment decisions, especially when the first control point sees too little information.
Key questions
Q: What breaks when transaction authorization decisions are made with thin data?
A: Thin issuer data pushes banks toward conservative declines, which blocks legitimate customers while still allowing more sophisticated fraud patterns to pass. The practical failure is not only lost sales. It is a checkout control that cannot reliably distinguish risky orders from good ones because it lacks the richer behavioural and merchant context needed for better decisions.
Q: When should merchants prioritize fraud review before authorization?
A: Merchants should prioritize pre-authorization fraud review when they see avoidable declines, noisy transaction streams or inconsistent context reaching the issuer. Screening obvious fraud earlier reduces the number of low-confidence requests that reach bank decisioning, which improves approval quality without weakening downstream controls.
Q: What are the signs that authorization performance is hurting revenue?
A: Look for low authorization rates, a high share of falsely declined orders, and a growing gap between bank decisions and merchant approval outcomes. If card-not-present transactions underperform in a way that does not match actual risk, the issuer is likely seeing too little context and declining too aggressively.
Q: What do security teams get wrong about balancing fraud prevention and customer conversion in CIAM?
A: The common mistake is treating fraud and friction as opposing goals. If every user faces the same challenge, legitimate customers abandon the journey. CIAM works better when risk-based authentication uses signals such as device reputation, location, velocity, and behaviour to add friction only when risk rises. That keeps low-risk users moving while challenging suspicious activity.
Technical breakdown
Why authorization and approval are different control points
Authorization happens on the issuer side after the payment request is sent through the gateway and card network, and it answers a limited question: can this card and transaction move forward? Approval happens on the merchant side after authorization, and it answers a broader question: should the merchant fulfil and capture the order? The two steps use different data, create different liabilities, and fail in different ways. Conflating them hides the operational reality that one decision can be technically valid while still being commercially or fraud-wise wrong.
Practical implication: design fraud and payment controls separately for issuer authorization and merchant approval, rather than treating checkout as one gate.
How thin issuer data creates false declines and missed fraud
Issuers can check card status, available funds, and some fraud signals, but they do not see the richer behavioural and transactional context merchants often hold. That gap pushes banks toward conservative decisions, which blocks legitimate shoppers and still allows more sophisticated fraud patterns such as account takeovers or triangulation fraud to progress. The result is not just lower approval quality. It is a decision system that is blind at exactly the point where nuance matters most.
Practical implication: enrich pre-authorization decisioning with merchant context so legitimate orders are less likely to be declined and risky orders are more likely to be stopped.
Why pre-authorization changes decision quality
Pre-authorization sits between the merchant and the issuer and adds context before the bank makes its call. By filtering out obvious fraud early and passing deeper signals such as order history, device type, and shopper behaviour, merchants can improve the quality of traffic sent to issuers. That does not eliminate fraud. It narrows the volume of low-quality decisions and helps issuers trust the orders that remain. In practical terms, it turns checkout from a binary pass-or-fail event into a better-informed risk workflow.
Practical implication: use pre-authorization controls to reduce doomed transactions, improve issuer confidence, and preserve conversion on legitimate orders.
NHI Mgmt Group analysis
Checkout authorization is a governance boundary, not a single fraud rule: the bank's decision and the merchant's decision answer different questions, use different data, and create different risk outcomes. That means merchants cannot treat issuer declines as the only fraud control, because a technically authorized transaction may still be commercially unsafe. The practitioner takeaway is to manage the boundary, not just the score.
Thin decision data creates a false-confidence problem: when issuers see only limited fields, they will over-decline good customers and still miss sophisticated fraud that needs richer context. This is the same pattern identity teams see when a control is asked to make a trust decision without enough evidence. The named concept here is decision-data deficit, and it should be treated as a measurable governance gap.
Pre-authorization is most valuable when it improves signal quality before the bank decides: it does not replace fraud review, but it changes which transactions deserve to be reviewed at all. That distinction matters for conversion, chargeback exposure, and customer trust. For practitioners, the question is no longer whether to add more friction, but where better context will make less friction possible.
False declines are a revenue-control issue as much as a fraud issue: when 15% of orders are declined falsely, the business loses good customers before the merchant ever gets a chance to apply its own approval logic. That makes authorization performance a board-level metric, not just an operations statistic. The practitioner implication is to track decision quality by channel, not only fraud loss after the fact.
What this signals
Decision-data deficit: when authorization decisions are made with only thin issuer context, merchants inherit both the fraud losses and the revenue loss from avoidable declines. The practical response is to shift some trust evaluation earlier, before the wrong transaction is allowed to become a costly outcome.
The most useful governance change here is not more friction, but better sequencing. If pre-authorization enriches the signal set, downstream approval logic can focus on orders that genuinely need scrutiny instead of compensating for weak issuer visibility.
For practitioners
- Measure authorization and approval separately Track issuer authorization rate, merchant approval rate, and chargeback rate as distinct metrics so you can see where decision quality is failing. Do not collapse all checkout outcomes into one conversion number.
- Add richer pre-authorization signals Pass device, order history, and shopper behaviour context into the decision path before the bank authorizes the payment, so low-quality traffic is filtered earlier and legitimate orders are better understood.
- Review false-decline patterns by channel Compare card-not-present outcomes against in-store or lower-risk flows to identify where issuer conservatism is suppressing revenue and where the merchant needs better signal quality.
- Separate fraud review from fulfilment timing Ensure approval logic can act after authorization without relying on the issuer's first decision to carry the full fraud burden, especially where stock availability and capture windows matter.
Key takeaways
- False declines and missed fraud are two sides of the same authorization governance problem.
- Merchants need separate visibility into issuer authorization quality and their own approval decisions.
- Pre-authorization improves outcomes by giving banks better context before a payment is decided.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0040 — Credential Access; Impact | Fraudulent payment attempts rely on stolen payment credentials and create financial impact. |
| Recommendation — Map card-testing and account-takeover activity to TA0006 and TA0040, then prioritise monitoring on repeated failed payment attempts. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about authorization decisions and who is allowed to proceed. |
| ID.RA-01 — Asset vulnerabilities are identified and documented | Thin checkout context creates a risk assessment gap that affects decision quality. | |
| Recommendation — Use PR.AA-05 to govern transaction authorization logic and separate issuer checks from merchant approval controls. Document where payment data is too sparse to support reliable risk decisions and enrich those paths first. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account takeover and payment abuse often begin with compromised customer accounts. |
| Recommendation — Apply CIS-5 to reduce account abuse that later appears as fraudulent transaction activity. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Checkout and payment flows depend on trustworthy authentication and decision inputs. |
| Recommendation — Harden payment and checkout authentication paths so fraudulent requests cannot be mistaken for legitimate customers. | ||
Key terms
- Transactional Authorization: Transactional authorization is permissioning tied to a specific action rather than to broad session access. It lets teams define what an agent may do, where approval is required, and how to prevent a valid session from becoming an open-ended delegation path.
- Transaction Approval: The merchant-side decision that an authorized order should be fulfilled and captured. It often uses richer context than the issuer sees, such as device signals, order history, and shipping details, so it governs whether a technically valid payment is operationally acceptable.
- False decline: A false decline is a legitimate transaction that is rejected because the fraud controls interpret it as risky. It matters because the operational cost is not limited to one lost sale. It can also damage customer trust, reduce retention, and distort fraud programme metrics.
- Pre-authorization: A process that enriches or filters payment data before the issuer makes its authorization call. It is used to remove obvious fraud early and provide additional context such as behaviour, device, or order history so that the bank can make a better decision.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a fit for security and identity practitioners who need to connect governance, lifecycle control, and access decisions across modern programmes.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org