A fraud score is a single number that estimates the fraud risk of an entity, transaction, or session, produced by a model or blended scoring logic. It turns messy, conflicting signals into one value an operator can act on, but its worth lives entirely in the thresholds and actions you map behind it.
What is a fraud score, in plain English?
A fraud score compresses everything the system knows about a case into one number, usually on a fixed scale like 0 to 100 or 0 to 1000, where higher means riskier. Behind it sits a model, or a blend of a model and rules, that weighs dozens of signals: device history, velocity, name and account matching, behavioral patterns, and more.
The point of the score is decisiveness. Instead of an analyst juggling twenty conflicting signals, the score gives one value the system can compare to a threshold and act on in milliseconds. Approve below one cutoff, step up in the middle band, decline above another.
In the detection stack the score is the bridge between modeling and action. But a score is inert on its own; it only becomes useful once you decide what each level of the score should trigger, which is where calibration and thresholds do the real work.
From raw signals to a decision
A fraud score is a step in a flow, not the end of it. The number is only as good as the calibration in front of it and the actions behind it.
- Signals — Gather the inputs. Features from the transaction, device, identity, and behavior are assembled at decision time.
- Score — Blend into one value. A model or scoring logic combines the signals into a single risk number.
- Threshold — Map score to action. Cutoffs turn the number into approve, step-up, or decline, tuned to loss appetite.
- Low score — Approve. Pass smoothly with little or no friction.
- High score — Decline or review. Block, or route to a human for a closer look.
- Monitor — Track score versus outcome. Watch how each score band maps to real fraud so accuracy is caught as it slips.
What it looks like in practice
In practice
A payments team runs a fraud score from 0 to 100 and declines anything above 80. For a year the score looks rock solid: the distribution is stable, the average barely moves, and nobody touches the thresholds.
Quietly, though, fraud has shifted, and cases that used to score 90 now score 70, landing just under the cutoff. The distribution looks unchanged because the good traffic still dominates it, but the score's meaning has drifted. Losses climb even though every dashboard about the score itself looks healthy. The team only catches it by tracking how each score band mapped to actual fraud outcomes, not by watching the score's shape.
Why the score alone is not enough
A fraud score is only as good as its calibration and the actions mapped behind it. The same number can mean "block" for one product and "let through" for another, depending entirely on where the thresholds sit and what business each is protecting. Two teams with identical models can get very different results purely from how they set cutoffs and what those cutoffs trigger.
The traps are subtle. Drift changes what a given score represents over time. Score compression, where values bunch together, robs the number of its ability to separate cases. And population shifts quietly move the meaning of a score without changing its raw distribution. That is why you should not trust the distribution's shape; monitor how scores map to actual outcomes, because a stable-looking score can hide fading accuracy.
What to watch in the data
- Score-to-outcome drift. Track fraud rate within each score band over time; if a band that used to be safe starts producing fraud, the score has drifted even if its shape has not.
- Compression. When scores bunch into a narrow range, the model has lost its ability to separate risky from safe, and thresholds stop working.
- Population shifts. New products, geographies, or channels change the underlying population, so a score means something different than it did last quarter.
- Stale thresholds. Cutoffs set once and never revisited slowly fall out of alignment with the current score meaning.
- Blended opacity. When a score mixes model and rules, understand which is driving it, or you cannot explain or fix a bad decision.
Quick questions
Is a fraud score the same as a risk score?
They are closely related, often the same idea narrowed to fraud. A risk score may blend fraud, credit, and other risk; a fraud score focuses on the likelihood that a case is fraudulent.
What does calibration mean for a score?
Calibration is whether a score reliably corresponds to real fraud probability, so that, say, cases scoring 90 really are riskier than cases scoring 60. A well-ordered but poorly calibrated score can still mislead your thresholds.
Why not just look at the score distribution?
Because a distribution can look perfectly stable while the relationship between score and actual fraud drifts underneath it. The good traffic dominates the shape, hiding changes in the risky tail.
Higher score, more fraud, always?
By convention higher usually means riskier, but the only thing that matters is that the mapping holds in practice. Confirm which direction your score runs and that it still tracks real outcomes.
How often should thresholds be reviewed?
Regularly, and any time the population, product mix, or fraud pattern shifts. Thresholds are not set-and-forget; they drift out of alignment as the score's meaning changes.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.