Rejected-good-customer rate measures the share of blocked transactions that would have been legitimate if approved. It is a governance metric, not just a fraud metric, because it shows how often control rules are converting uncertainty into avoidable revenue loss and customer churn.
What rejected-good-customer rate tells you
Rejected-good-customer rate is the share of blocked transactions that would have been legitimate if approved. It measures how often a control is mistaking normal behaviour for risk, turning caution into avoidable friction, lost revenue, and customer drop-off.
Why this metric matters in fraud and payments governance
This metric matters because every false decline is a policy decision with commercial consequences. A system can look strong on fraud prevention while still damaging conversion, support volume, and trust if legitimate customers are repeatedly stopped at checkout or during account actions.
It is also a governance signal, not just a fraud score. When the rejected-good-customer rate rises, teams need to ask whether rules, thresholds, device signals, or step-up controls are too aggressive for the customer population they are meant to protect.
How organisations interpret the rate correctly
The number is only useful when paired with a clear definition of what counts as a good customer and which transactions are included in the blocked set. Different channels, products, geographies, and risk appetites can produce very different outcomes, so the metric should be segmented rather than treated as a single enterprise truth.
It should also be read alongside approval rate, fraud loss, chargeback rate, and manual review outcomes. A low fraud rate does not automatically mean the policy is effective if it is doing so by rejecting a large number of legitimate transactions.
Where false declines usually come from
Rejected-good-customer problems usually come from overfitting controls to suspicious patterns, poor signal quality, or blunt thresholds that do not reflect context. Common causes include rules that punish normal travel, new-device behaviour, first-time buyers, or atypical but legitimate transaction patterns.
They also emerge when teams optimise for blocking certainty instead of balancing precision and customer experience. In practice, this is often a calibration problem, a segmentation problem, or a review-quality problem rather than a pure fraud problem.
Risk and Threat Considerations
High rejected-good-customer rate creates direct business risk because legitimate demand is being suppressed by security controls. It can also create secondary exposure when frustrated customers abandon purchases, increase support contacts, or move to less controlled channels to complete the same activity.
Failure mechanism: Overly strict rules, weak segmentation, or noisy risk signals cause the control layer to classify normal customer activity as suspicious, so the organisation pays the cost of security friction without earning corresponding fraud reduction.
Impact: The result is lost conversion, lower customer trust, avoidable operational workload, and a governance blind spot where a control appears effective while actually converting uncertainty into preventable rejection.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | This metric informs risk tradeoffs in control tuning and loss tolerance. |
| GV.OV-01 — Oversight of Risk Management | Rejected-good-customer rate is a governance metric that needs oversight and review. | |
| Recommendation — Use GV.RM-01 to balance fraud reduction against false-decline and revenue-loss exposure. Review false-decline trends under GV.OV-01 and hold control owners accountable for drift. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Monitoring transaction outcomes helps detect when controls are overblocking legitimate activity. |
| AU-6 — Audit Review, Analysis, and Reporting | Auditing blocked transactions and review decisions supports measurement of legitimate declines. | |
| Recommendation — Correlate rejection patterns with monitoring data to spot control miscalibration. Analyze blocked-transaction samples under AU-6 to separate fraud catches from false declines. | ||
| ISO/IEC 27001:2022 | A.5.36 — Compliance with policies, rules and standards for information security | Policy-based controls need review when legitimate activity is being rejected too often. |
| Recommendation — Reassess decision rules under A.5.36 when control outcomes harm legitimate users. | ||
Practitioner Guidance
Why practitioners should care: Treat this metric as a control-quality measure, not a narrow fraud metric. If the rate is rising, the question is whether the decision model is protecting the business or simply shifting risk into customer abandonment and revenue loss.
What to watch for: Look for spikes after new rules, model changes, or threshold tuning, especially in segments with higher legitimate variability such as new customers, mobile users, or cross-border activity. Those patterns often reveal where the policy is miscalibrated.
Practitioner takeaway: Use rejected-good-customer rate as a balancing metric whenever fraud controls are tuned, because effective governance should reduce loss without creating avoidable false declines.
Related resources from NHI Mgmt Group
- How should organisations decide whether fingerprint verification is a good fit for remote workers and customer-facing access?
- How should organisations implement CIBA in customer authentication flows that need strong security and good user experience?
- How should organisations decide whether social login is a good fit for their customer journeys?
- How should organisations decide whether OpenID Connect is a good fit for customer login journeys?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org