Why do rules-based fraud scoring systems often cost merchants good orders?

Why Rules-Based Fraud Scoring Over-Blocks Legitimate Buyers

Rules-based fraud scoring often costs merchants good orders because it treats uncertainty as danger. Thresholds, velocity rules, and pattern checks are useful for filtering obvious abuse, but they also create false positives when a real customer looks unusual for benign reasons such as first-time purchasing, device changes, travel, gift buying, or rapid checkout behaviour. The tighter the rule set, the more it suppresses legitimate revenue while still missing fraud that does not match the expected pattern.

That tradeoff matters because fraud teams are usually judged on loss avoidance, while commerce teams are judged on conversion and approval rate. When the scoring system leans too far toward rejection, it turns risk signals into a blunt gate rather than a decision aid. NIST’s control guidance on monitoring, access decisions, and process discipline is relevant here because merchants need traceable criteria, not just aggressive thresholds, to avoid turning security controls into revenue leakage. In practice, many merchants discover that their fraud rules are working exactly as designed only after good customers start disappearing from the checkout flow.

How Rules-Based Scoring Creates False Declines in Practice

Rules-based systems work by assigning points or triggers to observable events, then rejecting, reviewing, or challenging the transaction once a threshold is crossed. That design is easy to explain and audit, which is why it remains common. The weakness is that it depends on static assumptions about what fraud “should” look like. Real commerce is messy, so the same signals that correlate with abuse can also describe normal customer behaviour.

A few common mechanics drive the problem:

• High-risk rules over-weight single signals, such as mismatch between billing and shipping data, even when the mismatch is normal for the buyer.
• Velocity controls can flag genuine repeat purchases, especially for subscriptions, household accounts, and holiday buying.
• Device or network reputation can punish shared environments, mobile carriers, VPN use, or changing home addresses.
• Strict address or identity checks can force review on buyers who are legitimate but incomplete in the data they submit.

The key operational issue is that the system is often optimised for easy certainty, not for business value. A rule engine can be tuned to catch more bad activity, but every additional layer of caution increases review volume and the odds of a false decline. Teams then spend effort reversing their own controls through manual review, which creates delay, labour cost, and inconsistent outcomes. The better question is not whether a rule is “strict enough,” but whether it meaningfully separates fraud from legitimate edge cases in the merchant’s own customer base. Where that separation is weak, the system becomes a revenue filter rather than a fraud control, and it breaks down most visibly in high-growth stores, cross-border commerce, and mixed-risk product lines.

Where the Tradeoff Breaks Down and Good Orders Get Caught

Tighter fraud rules often reduce visible fraud at the cost of more friction, so organisations have to balance loss reduction against customer abandonment and support burden. That tradeoff becomes sharper when the merchant serves new customers, international buyers, or fast-moving campaigns where behaviour is inherently less predictable. In those environments, a static rule set tends to age quickly because it reflects yesterday’s fraud patterns more than today’s buying patterns.

There is no universal consensus on the “right” decline rate, because acceptable friction varies by sector, margin, and chargeback exposure. What is consistent is that rules perform poorly when they are used as a substitute for calibrated judgement. A rule that is sensible for one product line can be destructive for another, especially when basket size, repeat frequency, and fraud tolerance differ across channels.

The most common edge case is not sophisticated fraud but legitimate complexity: a loyal customer changing card, a buyer using a business address, or an order that looks unusual because it is the first one after a long gap. The system also struggles when attackers learn the rules and stay just below thresholds, which leaves the merchant paying the cost of false declines without materially improving defence. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful as a reminder that effective controls need monitoring, tuning, and accountable decision criteria, not just strict enforcement. The guidance breaks down when the merchant cannot measure false positives by channel, because then the business only sees lost revenue after the rule has already become normalised.

Risk and Threat Considerations

Rules-based fraud scoring creates two material risks: avoidable false declines that erode revenue, and predictable control behaviour that skilled fraudsters can learn to evade. The first is an operational and customer-trust problem, while the second is an adversarial problem where static thresholds become part of the attacker’s playbook.

Failure mechanism: The system materialises risk by mapping uncertain or atypical behaviour to rejection too early, or by relying on fixed thresholds that attackers can probe, infer, and work around. Over time, the merchant either tightens rules until good orders are excluded, or relaxes them until fraud passes through.

Impact: Legitimate buyers are denied, review queues grow, support costs increase, and conversion falls. At the same time, fraud can shift to lower-signal patterns that remain under the rules, creating a control that is costly on both sides of the decision.

Practitioner Guidance

What to prioritise: Measure false declines by segment, not just overall fraud loss. The most useful signal is where legitimate orders are being blocked, challenged, or manually reviewed at a rate that exceeds business tolerance.

Decision rule: If a rule cannot be tied to a measurable fraud pattern and a clear business exception policy, treat it as a candidate for tightening, segmentation, or removal rather than default acceptance.

What to verify: Check whether review outcomes are feeding back into rule tuning. If approvals, reversals, and customer complaints are not closing the loop, the scoring model will drift toward caution without proving value.

Common mistake: Treating lower chargebacks as proof of success. Merchants often overlook the orders they never saw complete, which means the control can look effective while silently suppressing revenue.

Practitioner takeaway: Rules-based fraud scoring should be judged as a conversion-impacting control, not just a loss-prevention control, because the real risk is buying a small reduction in fraud at the cost of a larger loss in good orders.

Related resources from NHI Mgmt Group

• Why do rules-based fraud systems struggle as ecommerce scales?
• Why do false declines increase when rules-based fraud systems grow?
• Why do token-based attacks often evade standard detection rules?
• Why do agentic AI systems make fraud harder to stop with static rules?