Fraud Score Thresholds

Fraud scoring assigns each transaction a number that estimates how likely it is to be fraudulent. The threshold, the point where that number changes what happens to the order, is a separate decision, and it belongs to the merchant.

Do you know who set yours? Your fraud tool returns a 64. A rule somewhere says decline above 60. Nobody on the current team set that number, and it treats a five-year customer reordering the same way it treats a first-time buyer shipping to a new country. Loosen it and chargebacks count against your card network ratios. Tighten it and good customers get turned away.

The fix is two lines instead of one, set differently for different customers and tested before they reach all your traffic.

A fraud score is an estimate, and the threshold is a business decision

A fraud risk score estimates how risky a transaction looks, based on device, identity, behavior, and order data. It doesn't decide anything. The threshold applies your tolerance for risk to that estimate, and that tolerance depends on your margins, products, and customer mix.

Scores aren't a shared unit, either. Some vendors return a probability. Others return a rank against the rest of their network. Scales run 0 to 100, 0 to 1,000, or 1 to 99. A 70 from one vendor isn't a 70 from another, so a threshold copied from one tool to the next means nothing.

The fraud scoring model produces the number, and your rules decide the outcome. We cover the rules side in our guide to building a fraud rules engine your team can change.

Many merchants can't see the number they're setting thresholds against. In the Merchant Risk Council's 2026 Global eCommerce Payments and Fraud Report, most merchants said they use or plan to use a vendor-provided solution described as "closed box, score not visible." And 64% use or plan to use multiple vendor negative behavior scores.

That second figure raises a question no single vendor console can answer. When two scores disagree, which one wins? Do both have to clear, or does either one trigger a step-up? Each vendor sees only its own score, so the logic that reconciles them has to live somewhere above both.

One cutoff forces a trade between fraud and false declines

A single fraud score cutoff can only move in two directions. Tighten it and good customers get declined. Loosen it and fraud and disputes climb toward card network monitoring limits. With one line, every adjustment fixes one problem by creating the other.

Two in three merchants run a false positive rate above 2%. In the MRC's 2026 report, 27% of merchants put their false positive rate, the share of good orders flagged as fraud, at 2% or below. Another 38% put it between 2.01% and 5%, 13% between 5.01% and 10%, and 16% above 10%.

The fraud side has a hard ceiling. Under the Visa Acquirer Monitoring Program, Visa flags a merchant as excessive when its ratio of fraud plus disputes to settled transactions reaches 150 basis points, with at least 1,500 fraud and dispute cases in the month. That threshold applies in the U.S., Canada, the EU, and Asia Pacific from April 1, 2026, down from 220 basis points.

That leaves little room on either side. Loosen the line to win back good customers and you drift toward a monitoring program flag. Tighten it to protect the ratio and you add to the false positives above. No position for a single line fixes both.

What a tight cutoff costs in lost customers and revenue is its own calculation. See our breakdown of the cost of false declines.

Three bands turn one score into three decisions

Graduated fraud scoring uses two thresholds instead of one. You approve orders below the lower threshold. You step up orders between the two, to 3DS for card payments or MFA for account-level risk. You block orders above the upper threshold.

Approve. Low scores go straight to authorization. A well-tuned low band keeps friction off the customers most likely to come back, and it's where most of your volume should land.

Step up. The middle band is where a single cutoff does the most damage, because it forces a yes or no on orders that are uncertain. Authentication settles that uncertainty in seconds. The cardholder proves who they are, and nobody on your fraud team has to guess. A successful 3DS authentication also generally shifts fraud chargeback liability to the issuer under card network rules.

Block. Decline high scores outright. Card testing is the clearest case. A bot cycling stolen card numbers through your checkout isn't a customer you want to challenge.

The case for sending the middle band to authentication rests on regulator data. The European Banking Authority and European Central Bank's joint report on payment fraud came out December 15, 2025 and covers 2022 to 2024. It found that transactions verified with strong customer authentication "were generally less susceptible to fraud than those without it, especially card payments." Card payment fraud was 17 times higher when the recipient was outside the EEA, where SCA is not legally required.

Step-up doesn't have to mean a challenge screen. A 3DS authentication can complete frictionless when the issuer has enough data to approve without asking the cardholder anything. Visa's Global Better Data Best Practices Guide reports that merchants completing the 3DS Method URL at least 95% of the time saw a 127% lift in frictionless rate and an 8% lift in approval rate. Merchants sending more than half of Visa's priority data elements saw a 57% frictionless lift and a 6% approval lift. The data is from 2022, and the mechanism hasn't changed. The more data you send the issuer, the less often it challenges your customer.

[OPTIONAL PROOF POINT, pending data pull: Spreedly 3DS frictionless vs. challenged share, challenge completion rate, or authorization rate for authenticated vs. unauthenticated transactions on the same gateway.]

In Europe, a tuned low band does a second job. Under the PSD2 regulatory technical standards, a payment provider can apply the transaction risk analysis exemption only while its fraud rate stays under set reference rates: 0.13% for remote card payments up to €100, 0.06% up to €250, and 0.01% up to €500. Fraud that slips through your approve band counts against that rate. We cover how the exemptions work in our guide to SCA exemptions.

Manual review works best as a narrow lane

Manual review belongs to the orders authentication can't answer: high-value orders, new account types, and payment methods where 3DS isn't available. When the middle band goes to step-up first, the review queue shrinks to the cases that need a person.

The MRC's 2026 report puts the average share of ecommerce orders screened manually at 21%, down from 25% in 2024. Analysts then decline only 18% of the orders they screen. MRC member merchants screen 8% of orders manually, against 22% for non-member enterprises.

A merchant sending a fifth of its orders to analysts who decline fewer than one in five of them should look at its thresholds before it hires more analysts. Every held order waits on an analyst, and the customer waits with it.

Order value matters here too. A low-value order rarely justifies an analyst's time, since the review can cost more than the order is worth. Those orders belong in the approve or step-up band. Your analysts belong on the cases only a person can judge.

Set different fraud score thresholds for different segments

The same fraud score means different things for different customers. Set bands per segment so a returning customer and a first-time buyer aren't held to the same line. The segments that matter most are customer tenure, order value, BIN country against shipping or IP country, payment method, and channel.

Customer tenure. Account age, prior successful authentications, and a clean dispute history earn a wider approve band. A customer who has paid you without incident for five years has already answered most of the questions a score asks.

Order value. Higher order values justify a lower step-up line, because the loss from a missed fraud grows with the order. Low-value orders justify a wider approve band.

Geography. A mismatch between BIN country and shipping or IP country moves the bands down. Set separate bands for higher-risk destinations instead of blocking whole BIN ranges, which turns away every good customer in the range along with the bad ones.

Payment method and channel. Cards, wallets, and local payment methods carry different risk, and 3DS isn't available on all of them. Where it isn't, the middle band needs another answer, such as MFA at the account level or a narrow review lane.

Look at the shape rather than the numbers. The bands slide down as risk rises, and the middle band stays wide enough to give a real customer the chance to prove themselves before you decline. Your own numbers should come from your approval and fraud data, not from a table in a blog post.

Measure every threshold change against approval rate and fraud rate together

Judge a threshold change against approval rate, false positive rate, step-up completion rate, review rate, and dispute ratio at the same time. A change that improves one metric and worsens another isn't an improvement. Test new bands on a share of live traffic before rolling them out.

Approval rate. The share of attempted orders that authorize. It's the first number to fall when a band tightens.

False positive rate. Good orders declined or held as fraud. It's harder to measure than fraud, which is why teams ignore it.

Step-up completion rate. The share of stepped-up customers who finish authentication. A low rate means the middle band is catching customers it shouldn't, or your 3DS data is thin.

Review rate. The share of orders that land in front of an analyst. If it climbs after a change, your bands are pushing work back to people.

Dispute ratio. Fraud plus disputes against settled transactions, the number Visa holds to its 150 basis point ceiling.

Lowering the block line might cut fraud by a tenth of a point and cut approvals by a full point. Watch only fraud and that looks like a win. Measuring one metric at a time is how a stale cutoff survives for years.

So test before you roll out. Run the new band on a share of traffic alongside the current one, compare all five metrics, then keep the winner or roll back.

That's easier when the threshold lives in a layer your fraud team can change, apart from any one vendor's console. In Spreedly Composer, a fraud check runs as a step inside a checkpoint, and a decision editor branches on the score to deny, step up to MFA or 3DS, or proceed to authorization. A common flow runs the fraud check first and triggers 3DS only when the risk score crosses your threshold. The score still comes from your fraud vendor. The decision about what it means stays with you.