A signal is a single data point or indicator that feeds a risk decision, such as how old a device is, an email address's history, or a velocity count. Signals are the raw material of features, rules, and scores, and their power comes from combining them, not reading any one alone.
What is a signal, in plain English?
A signal is one piece of evidence about a user, device, or transaction. Device age, whether an email has been seen before, the distance between billing and shipping addresses, the number of cards tried on an account in the last hour: each of these is a signal. On its own it is a small fact, neither innocent nor guilty.
Signals are the raw material of everything above them. Combine and transform them and you get features; put features into logic and you get rules; feed them to a model and you get a score. Everything a fraud system decides ultimately traces back to the signals it was given, which is why coverage and quality at this layer set the ceiling for the whole stack.
The central truth about signals is that most any single one is weak. A brand-new device is common for legitimate users buying a new phone, and a mismatched shipping address is common for gifts. The power comes from reading signals together and in context, so a weak hit becomes strong only when several point the same way.
From signal to decision
- Collect — Capture the raw signal. A data point is observed, such as device age, email history, IP reputation, or a velocity count.
- Combine — Build features. Signals are transformed and joined into features that describe behavior over time and across entities.
- Evaluate — Feed rules and models. Features flow into rules and scores that weigh many signals together rather than trusting one.
- Weak — One signal fires. Usually a reason to look closer, not to decline outright.
- Strong — Signals stack up. Several pointing the same way support a confident action.
- Decide — Approve, review, or decline. The combined picture drives the outcome, and the result feeds back to sharpen future signals.
Where signals come from
Source | What it provides |
Device intelligence | Device age, fingerprint, reputation, and tampering indicators. |
Behavioral data | Typing, navigation, and session patterns that hint at bots or coaching. |
Identity and email checks | How long an email or phone has existed and whether it links to prior fraud. |
Transaction history | Velocity counts, amounts, and patterns across cards, accounts, and time. |
Third-party enrichment | IP reputation, consortium hits, and shared fraud data from vendors. |
What it looks like in practice
In practice
A checkout comes in on a device that was first seen four minutes ago. Taken alone, that signal means little; plenty of real customers buy on a new phone. An analyst who auto-declined on device age would block a stream of good buyers and generate a wave of complaints.
Now add context. The same session also shows an email created that morning, a shipping address far from the card's billing zip, and three prior card attempts in ten minutes. No single signal was damning, but four weak signals pointing the same direction turn a shrug into a confident hold. That is the whole game with signals: accumulate the picture before you make the hard call.
Why it matters to operators
Signals set the ceiling on everything downstream. A model or rulebook can only be as good as the signals it sees, so gaps and blind spots at this layer quietly cap detection no matter how clever the logic above. Understanding which signals you have, and how strong each really is, is the foundation of good decisioning.
The operator discipline is resisting the urge to act on a single strong-looking hit. One signal is usually a reason to investigate, not to auto-decline, because acting on it alone drives false positives and blocks good customers. Let signals accumulate into a picture, and reserve the hard action for when several agree.
What to watch with signals
- Coverage gaps. A signal missing for a share of traffic creates blind spots exactly where fraud may hide. Track how often each signal is actually present.
- Staleness. A signal that stops updating or reflects old data can go quietly wrong; monitor freshness, not just presence.
- Correlated signals. Two signals saying the same thing add little new lift and can make a score look more confident than the evidence warrants.
- Single-signal actions. Any rule that declines on one indicator alone is a false positive machine waiting to happen.
- Silent failures. When an upstream provider breaks, a signal may return a default value that looks normal; alert on unexpected shifts in its distribution.
Quick questions
What is the difference between a signal and a feature?
A signal is a raw data point, like device age. A feature is a signal that has been transformed or combined for use in a rule or model, such as the count of new devices on an account this week. Features are built from signals.
Can a single signal ever be enough to decline?
Rarely, and usually only for hard policy signals like a sanctions hit or a confirmed stolen card. For behavioral or risk indicators, acting on one signal alone drives false positives, so let several accumulate first.
What makes a signal strong or weak?
Strength is about how much a signal separates fraud from good traffic on its own. Most behavioral signals are weak individually because legitimate users trigger them too; strength comes from combining weak signals that rarely all fire together for good customers.
Why do correlated signals matter?
Two signals that measure nearly the same thing add little independent information. Stacking them can inflate a score and give false confidence, so teams prune redundant signals and prefer ones that capture genuinely different evidence.
How do I know a signal is reliable?
Check its coverage, its freshness, and how it behaves when its source fails. A signal with wide gaps, stale values, or silent default outputs can mislead more than it helps, even if it looks predictive on paper.
Do more signals always mean better detection?
Not automatically. Adding signals that are redundant, noisy, or poorly covered can add cost and confusion without lift. The goal is a set of independent, well-covered signals, not the largest possible pile.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.