Understanding Risk Scores: How Fraud Detection Actually Works

A plain-English guide to fraud risk scores for store owners what the 0–100 number means, how it's calculated from dozens of signals, and how to tune your block threshold without rejecting real customers.

Every fraud-prevention tool eventually hands you a number. An order comes in rated 82 out of 100, or flagged high risk, and you're expected to do something about it. But what is that number? Where does it come from, and how much should you trust it?

After 15+ years in fraud prevention, I've found that the risk score is the single most misunderstood part of the whole system and also the most useful once it clicks. It's the piece that ties everything else together: the IP signals, the proxy/VPN detection, the device fingerprint, the payment details all flow into the score. Understand how it works and you stop treating fraud prevention as a mysterious black box and start tuning it like the dial it actually is.

This guide explains what a risk score is, how it's built, what the numbers mean, and most importantly how to set your threshold so you catch fraud without turning away good customers.

What a Risk Score Actually Is

A risk score is a single number that summarizes how likely an order or visitor is to be fraudulent. It takes a messy pile of individual signals dozens or even hundreds of them and distills them into one actionable measure, usually on a 0–100 scale where higher means riskier. (The 0–100 range is the most common convention across e-commerce fraud tools.)

The value of compressing everything into one number is that it lets you act consistently. Instead of eyeballing fifteen different indicators on every order, you get a single figure you can set rules around. The score does the weighing; you decide the response.

How the Score Is Calculated

Under the hood, a risk score is built in a few conceptual stages. You don't need to know the math just the logic, because the logic tells you why to trust it and where it can be wrong.

1. Signal collection. The system gathers every available data point about the order and visitor: the IP address and its location, whether the connection is a proxy/VPN/TOR, the device fingerprint and Visitor ID, billing-vs-shipping match, AVS/CVV results, order velocity, and behavioral cues. (Each of these is covered in its own guide see IP addresses, proxy/VPN/TOR, and Visitor ID.)

2. Comparison to baselines. Each signal is compared against what "normal" looks like for this store, this device type, this transaction category. An order that resembles millions of past legitimate transactions scores low; one that deviates in patterns historically tied to fraud scores high.

3. Weighting. Not all signals count equally. A failed CVV check or a datacenter IP carries more predictive weight than, say, a mismatched city (which we know is unreliable). The system weights each signal by how strongly it actually predicts fraud.

4. The final score. All of that collapses into one number. The order rated 82 isn't "82% certain fraud" it's "this order sits in a band where fraud is significantly more likely, based on how its combined signals compare to history."

Rules vs. machine learning

Older systems were purely rules-based: if billing ≠ shipping, add X points. Rules are transparent and easy to understand, but rigid they only catch what someone thought to write down. Modern systems layer in machine learning, which is trained on huge datasets of past fraud and learns subtle, counterintuitive signal combinations no human would codify. Industry reporting suggests ML-based scoring can improve detection meaningfully over rules-only systems while reducing false positives because it weighs signals in context rather than tripping on any single rigid rule. The best setups use both: rules for the obvious, clear-cut cases, ML for the nuanced ones.

What the Numbers Mean: Risk Bands

A raw score isn't useful until it's grouped into bands that map to actions. A common and sensible structure splits the 0–100 scale into three tiers:

• Low (roughly 0–33): let it through. These orders look like normal customers. Auto-approve them so checkout stays fast the vast majority of orders should land here.
• Medium (roughly 34–66): flag for review. Something's ambiguous. These deserve a human glance, a verification email, or a step-up check before fulfilling not an automatic rejection.
• High (roughly 67–100): block or redirect. These carry enough stacked risk to justify stopping or heavily scrutinizing them. 

The point of bands is graduated response. Instead of a blunt approve-or-reject for everyone, you treat low, medium, and high differently fast lane for the safe majority, a closer look for the ambiguous middle, and the brakes for the genuinely risky. That's what protects conversion while still catching fraud.

The Threshold Decision: Where You Draw the Line

Here's the most consequential setting in your entire fraud setup: the auto-block threshold the score at which the system stops an order automatically. Move it down and you catch more fraud but risk more false declines; move it up and you're more lenient but let more fraud through. There's no universally "correct" number it depends on your margins, your product, and your risk tolerance.

A few principles for setting it well:

Don't leave it at the maximum. If your tool defaults to auto-blocking only at the very top of the scale (say, a perfect 100), it's catching almost nothing automatically only the most blatant cases. Many stores get better protection by lowering the threshold somewhat (for example, toward 80) so genuinely high-risk orders are stopped without waiting for a flawless fraud signature. Tune from there based on what you actually see.

Respect the false-decline cost. This is the part most merchants underweight. Rejecting good customers is expensive some industry analyses put the total cost of false declines at many times the cost of the fraud itself, and a large share of wrongly declined shoppers never come back. So the goal isn't the lowest possible threshold; it's the threshold that catches real fraud while keeping false declines minimal.

Use the middle band instead of over-blocking. If you're tempted to drop your block threshold aggressively, route those borderline orders to review rather than outright rejection. Verification keeps a potential good customer in play.

Revisit it as you grow. Your store's risk profile changes with new products, new markets, and new traffic. A threshold set once and forgotten drifts out of tune. Review flagged orders periodically and adjust.

Where a Tool Fits

Computing all of this in real time, on every order, is exactly what a fraud-scoring tool is for. A store-security app like Browsify App assigns each visitor a Risk Score from 0 to 100, sorted into the same three bands Low (0–33) to let through, Medium (34–66) to flag for review, and High (67–100) to block or redirect and lets you set the auto-block threshold yourself. Its default auto-block sits at the top of the scale (100), but in practice lowering it toward 80 catches more genuinely high-risk traffic while still leaving room to review the ambiguous middle. Because the score blends IP, proxy/VPN/TOR, and Visitor ID signals into one verdict, no single ambiguous signal blocks an order on its own which is precisely what keeps false declines down. (For the underlying signals, see our guides on IP addresses, proxy/VPN/TOR detection, and Visitor ID.)

Frequently Asked Questions

Does a score of 80 mean an order is 80% likely to be fraud? No. The number reflects where an order falls on a risk scale based on how its combined signals compare to historical patterns not a literal probability. Treat it as a relative risk level, not a percentage chance.

What's a good auto-block threshold? There's no universal answer it depends on your margins and risk tolerance. A common approach is to avoid leaving it at the maximum (which auto-blocks almost nothing) and lower it somewhat, for example toward 80, then tune based on your results and false-decline rate.

Why not just block everything above medium risk? Because medium-risk orders include many legitimate customers who happened to trip a filter. Blocking them outright is a costly false decline; routing them to verification or review keeps good customers in play.

Are machine-learning scores better than rules? ML scoring generally catches more nuanced fraud and produces fewer false positives than rigid rules alone, because it weighs signals in context. The strongest setups combine clear-cut rules with ML for the subtle cases.

How often should I adjust my threshold? Periodically, and whenever your store changes meaningfully new products, new markets, traffic spikes. Your risk profile shifts over time, so a threshold set once and forgotten will gradually drift out of tune.

Final Thoughts

A risk score isn't a black box once you know what's inside it. It's a single number that gathers dozens of signals, weighs each by how well it actually predicts fraud, and hands you something you can act on consistently. The bands tell you how to respond fast lane for the safe majority, a closer look for the ambiguous middle, the brakes for the genuinely risky.

And the threshold is your dial. Set it too high and you catch nothing automatically; set it too low and you punish good customers. The sweet spot often a notch down from the maximum, with the middle band routed to review rather than rejection is where you stop real fraud while keeping your real customers flowing. Understand the score, tune the dial, and fraud detection stops feeling like guesswork.

This article is for general educational purposes and reflects common e-commerce fraud-prevention practices; it isn't legal or financial advice. Scoring methods and optimal thresholds vary by store and change over time always test settings against your own data before relying on them.