53 min
We talk about fraud rules all the time, but I rarely hear anyone ask what we actually mean by the word. What are rules for, who should write them, and how often should they be reviewed? Over the course of my career, I've found that fraud rule types fall into three distinct categories, and most teams manage all of them the same way. That habit quietly costs a lot. Teams end up over-monitoring some rules, under-monitoring others, handing ownership to the wrong people, and expecting rules to perform in ways they were never designed for.
In this episode, I walk through strategy rules, behavioral rules, and trend rules, and explain how each one is written, measured, and owned. If you manage a rule engine, or you're responsible for how a fraud team spends its time, this is a practical way to organize that work.
What you'll hear in this episode:
- Why the three fraud rule types need different monitoring cadences, different owners, and different success criteria
- How ML score fraud rules and threshold fraud rules segment your population into approve, decline, and step-up groups
- Why changing one threshold in a strategy ruleset often means adjusting the others, and why those rules should be measured as a set
- How behavioral rules fraud teams write, including velocity rules fraud examples, can catch several rings with the same MO without overfitting to one attack
- What compound fraud rules look like in practice, including a device fingerprint fraud rules example that combines email risk, a new device, and a country mismatch
- Why trend rules are your fastest and most accurate tool at first, and why they degrade so quickly
- How the fraud rule lifecycle should work, with narrow rules acting as a stopgap while stronger defenses take over
- What goes wrong with fraud rule prioritization when every rule gets the same attention
You should listen to this episode if you:
- Manage a rule engine and want a clear framework for how to write fraud rules that fit their purpose
- Are building or restructuring a fraud team and need to decide which team should own which rules
- Want to improve fraud rule deployment by tying strategy rules to your model release process
- Keep adding narrow rules to stop attacks and are worried about the false positives piling up
- Rely on a vendor model and need to know what to ask them for when setting thresholds
Episode notes & key takeaways
Strategy rules are your base defense layer
Strategy rules segment your population and define the overall shape of your defenses. They decide which segments get approved, which get blocked, and which go through a step-up like authentication or manual review, and they usually sit on top of a score from a machine learning model, an AI agent, or a scorecard. Because these rules are interconnected, changing one threshold usually means adjusting the others. I recommend measuring them as a ruleset and not only one by one. Their accuracy tends to be modest, but they hold up well. A monthly review is typically enough. Since they are tied to the model's score distribution, they should be designed and released together with the model, ideally with data science closely involved or with vendor support if the model comes from a vendor.
Behavioral rules are the backbone
Behavioral rules catch typologies that slip past your model and your strategy rules, whether because the pattern is new, too small or intricate to model, or aimed at false positive behavior. The key idea is that they describe suspicious or legitimate behavior, not a particular attack, which keeps them from overfitting to one ring and lets them catch others with a similar approach. Velocity rules are a classic example, and a compound rule that combines a risky email domain, a new device, and a mismatched IP country is another. These rules should be more accurate than strategy rules, or there is little reason to maintain them. They degrade faster than models but not dramatically, so a weekly or monthly review works, and ownership belongs with the fraud analytics team because it takes both domain expertise and data skills.
Trend rules stop the bleeding, and then they should retire
Trend rules target a specific attack, trend, or fraud ring, and they are deliberately narrow. A typical one lists a handful of disposable email domains, a particular card BIN, a fragment of a shipping address, and a minimum amount, which makes it a blocklist-style rule built for one pattern. They start out very accurate and degrade very fast, because fraudsters only have to tweak one detail to get around them, so they deserve daily to weekly monitoring while an attack is active. I think they belong in the toolset of fraud operations, but they should always be treated as a stopgap. They buy you time to deploy sturdier defenses, and if they stay in place unchecked they pile up false positives.
Matching the right tool to the right job
This is more than a classification exercise. When every rule is handled the same way, you spend effort watching rules that do not need it, you miss degradation in the ones that do, you assign ownership to the wrong team, and you judge rules against the wrong success criteria. When each category gets its own cadence, owner, and expectations, your defenses get more resilient and easier to scale.
Final takeaway
If you take one idea from this episode, let it be that a rule is only as good as the job it was designed for. Strategy rules turn a score into action, behavioral rules describe how fraud tends to behave, and trend rules put out the fire in front of you. Give each one the owner, the monitoring schedule, and the expectations that fit, and your fraud defense will hold up better as it grows.
Resources & links
Not ready to stop the conversation about my, and hopefully your, favorite subject? Subscribe to The Saturday Fraud Strategist newsletter.
Connect with Chen Zamir | LinkedIn
Host of The Saturday Fraud Strategist
Helping fintechs build smarter fraud defenses
Co-author of “The Fraud Fighter’s AI Playbook”
Episode transcript
Chen Zamir
00:07
We talk about fraud rules all the time, but what do we actually mean when we say rules? What are rules for? Who writes them? How should they be monitored? Here's the thing. During my career, I found out that there are actually three distinct categories of rules. But most teams treat them all the same. And what are these categories? Strategy rules, behavioral rules, and trend rules. Each designed differently, written by different teams, and with completely different roles to play in your fraud defenses. Mixing them up means you'll either over monitor some while under monitor others, assign ownership to the wrong teams, or worse, expect them to perform in ways they were never designed to. So, in this video, I'll break down each category and show you exactly how to handle them. Let's get into it.
Chen Zamir
00:56
Strategy rules segment your population and define the overall design of your fraud defense. Which segments get approved? Which segments get blocked? Which segments go through a step up like authentication or manual review? In most cases, these rules are written around the score calculated by a machine learning model, an AI agent, or if your organization is still living in the 80s, a scorecard that tells the result of other rules. A good strategy segments the population according to risk bands and ideally other general risk factors like payment method, transaction amount or user history. It usually looks something like this. If score is above 80 and the amount is higher than $100, then decline the payment. Keep in mind that strategy rules are usually interconnected, especially if you manage multiple segments. Changing a threshold in one rule would dictate mirroring changes in other rules in the same set. For example, if in that previous example I had a rule that sends to manual review payments with scores between 50 and 80 and I raise the upper limit to 85, I now need to change my decline rule we just saw to only start declining above 85. This also means you may want to measure these interconnected rules as a rule set and not only individually. Performance-wise as these are high level rules that operate on the entire population and mostly translate a score into a deterministic action. Accuracy tends to be quite low. However, this also means they're more resilient to degradation. Machine learning models tend to degrade much more slowly than rules. So you don't need to monitor them daily or weekly. A monthly cadence is usually more than enough. And from an ownership perspective, since strategy rules are tightly coupled to a model score distribution, it makes sense that they'd be designed, reviewed, and deployed as part of the model release process. Should a data science team write them? Perhaps. If it makes sense within your team's context. But even if fraud analysts write them, they should work very closely with the data science team to do so. And what if the model you use is supplied by a vendor? Then ideally you should request them to support you with the required data analysis and segmentation.
Chen Zamir
03:13
Behavioral rules detect typologies that bypass your fraud model and strategy rules. This can happen for a few reasons. That typology is new and didn't appear in the model's training set. It's too intricate or small to describe with a model. Or you're targeting false positive behaviors that models aren't really designed to catch. Regardless of the reason, the point of these rules is to describe suspicious, or legitimate behaviors, and not a particular fraud attack. And by doing so, your rules can catch different rings that have similar MOS without the need to constantly tweak them and overfeit them to one particular attack. A good example would be velocity rules. They describe a certain typology that can manifest in different attacks and by different fraudsters. Here's an example. If domain risk is high, and the device is new, and the IP country mismatches the account country, then block the account. Let's talk about performance for a second. Ideally, behavioral rules should be quite accurate. And in all cases more accurate than the strategy rules themselves. Otherwise, why bother with them? And while behavioral rules degrade faster than models, because they describe general typologies rather than specific patterns, they don't degrade that fast. Even if a fraud ring leaves your platform, the rule would still catch new fraudsters attacking you in similar ways. So from a monitoring perspective, you want to review your behavioral rules on a weekly or monthly cadence. And in terms of ownership, behavioral rules sit squarely with the fraud analytics team. As they require both deep domain expertise and data literacy.
Chen Zamir
04:54
Trend rules are designed to stop specific trends, attacks, or fraud rings. When nothing else works, when fraudsters bypass your model, strategy rules, and fancy behavioral rules, you need to bring the hammer down. These rules focus on a specific narrow pattern to maximize the effectiveness of your defenses. They usually look like this. If the email domain is tempemail24.com or gorilla.info or 10minute.net net, and the card bin is specific to this trend, and the shipping address has 1247 harbor somewhere in it, and the amount is higher than 50 bucks, then decline the payment. From a performance standpoint, trend rules tend to start off being very accurate as they're tailored to a specific attack. That means that on paper they should be your most accurate rules and by a wide margin, but they also degrade fast, very fast. It's often easy for fraudsters to tweak something in their behavior and bypass a trend rule. This means these rules should be monitored daily to weekly, especially if they're part of stopping an ongoing attack. And when it comes to the ownership question, I personally believe that trend rules should be within the tool set frauds teams have at their disposal when dealing with fraud attacks. However, you should consider your trend rules as a stop gap solution. The idea is they buy you time to deploy more substantial defenses that degrade more slowly, and that scale better. Allowing you to eventually get rid of them completely. Because if they are left unchecked over time they can really cause havoc by accommodating false positives.
Chen Zamir
06:37
Understand the differences between the three types of rules isn't just academic, it's operational. Because when you treat all rules the same, you waste resources monitoring things that don't need daily attention while missing degradation in rules that do. You assign ownership to the wrong teams and you harm your overall effectiveness by mismanaging the success criteria for each role category. But get this right and your fraud defense would be more resilient and easier to scale. Anyway, that's all for today. I'll see you next Saturday.
View full transcript
