Why your fraud and risk rules are declining good customers, not just bad ones

Why your fraud and risk rules are declining good customers, not just bad ones is a problem that costs e‑commerce operators thousands of rand each month, yet most teams never see the loss until it is too late.

The hidden cost of over‑aggressive risk filters

When a rule blocks a legitimate shopper, the immediate impact is a lost sale. The secondary impact is a damaged brand perception that can turn a first‑time buyer into a lifelong detractor. Studies of checkout abandonment show that a single friction point can increase abandonment rates by up to 30 percent, and fraud filters are a common source of that friction.

Beyond the obvious revenue loss, over‑aggressive rules inflate customer acquisition costs. If a store spends R5 000 on Facebook ads to attract 200 visitors, but the fraud engine rejects 15 percent of those visitors, the effective cost per acquisition rises from R25 to almost R30. The loss compounds when the same shopper returns for future purchases.

Most operators assume that any decline is a win against fraud, but the data from the Baymard Institute’s checkout usability research (see baymard.com/checkout-usability) confirms that unnecessary declines are a top reason for cart abandonment. The challenge is to separate the truly risky transactions from the good customers who simply trigger a rule.

Mapping the decision tree of your fraud engine

Every fraud platform works as a decision tree: each rule evaluates a signal and either passes the order forward or blocks it. To understand why good customers are being rejected, you need to map that tree and identify the high‑impact nodes.

Step 1 – Export rule definitions

Most providers let you download a CSV of active rules. Include the rule name, condition, weight (if applicable), and the action (block, review, or allow). If your platform uses a score‑based model, note the threshold that triggers a block.

Step 2 – Capture declined orders

Set up a log that records every declined transaction: order ID, timestamp, customer email, IP address, device type, and the rule that caused the block. A simple Google Sheet with these columns is enough for a small store; larger merchants should stream the data into a BI tool.

Step 3 – Tag good vs. bad declines

Cross‑reference declined orders with known fraud cases (chargebacks, fraud claims) and with repeat customers who later complete a purchase using a different method. This tagging lets you see which rules are responsible for false positives.

Step 4 – Visualise the tree

Use a flow‑chart tool (draw.io, Lucidchart) to plot the rules in order of execution. Highlight the nodes that generate the most false positives. This visual map becomes the basis for rule optimisation.

A step‑by‑step audit method

The audit method below turns a chaotic list of declines into a clear action plan. Follow each step and record your findings in a spreadsheet.

1. Quantify the impact

Calculate the total revenue lost to false declines over the last 30 days. Use the average order value (AOV) of your store – for example, if AOV is R1 200 and you recorded 45 false declines, the direct loss is R54 000.

2. Rank rules by false‑positive rate

For each rule, divide the number of false declines by the total number of times the rule fired. A rule that blocks 200 orders but only 30 of those are fraud has a false‑positive rate of 15 percent. Prioritise rules above 10 percent for review.

3. Test rule adjustments in a sandbox

Most fraud platforms provide a test environment. Replicate a sample of the false‑positive orders and experiment with relaxing the condition (e.g., change “IP country mismatch > 2” to “> 3”) or lowering the weight. Record the effect on the pass‑rate.

4. Implement staged changes

Apply the most promising adjustments to a small traffic segment (1‑5 percent) using a rule‑based split test. Monitor key metrics: decline rate, conversion rate, and fraud loss. If the segment shows a higher conversion without a spike in fraud, roll the change out to the full traffic.

5. Document and monitor

Maintain a change log that notes the date, rule altered, new parameters, and observed outcomes. Schedule a monthly review to ensure that new fraud patterns do not re‑introduce false positives.

Hypothetical example with concrete numbers

Consider a store that processes 2 000 orders per month with an AOV of R1 500. The fraud engine blocks 120 orders (6 percent). After tagging, the merchant discovers that 40 of those blocks were legitimate customers who later placed an order using a different payment method, representing a false‑positive loss of R60 000.

The audit reveals two problematic rules:

• Rule A – “High velocity from same IP”: triggers when more than three orders are attempted from the same IP within 24 hours. It blocked 70 orders, 30 of which were false positives.
• Rule B – “Mismatched billing and shipping country”: blocks when the two countries differ. It blocked 50 orders, 10 of which were false positives.

Step‑by‑step remediation:

1. For Rule A, the team lowers the threshold to five orders per 24 hours. In sandbox testing, the false‑positive rate drops from 43 percent to 14 percent, while the fraud capture rate remains at 95 percent.
2. For Rule B, they add an exception for customers with a verified email address (using a third‑party email validation service). This change eliminates 8 of the 10 false positives without letting any new fraud slip through.

After deploying the changes to a 5 percent traffic slice, the store sees the decline rate fall to 4.5 percent, conversion rise by 2.3 percent, and no increase in chargebacks. Scaling the changes site‑wide recovers roughly R55 000 in lost revenue per month and improves the customer experience.

Implementing smarter rules without sacrificing security

True optimisation balances risk and revenue. Below are practical tactics that can be applied to most platforms.

Use behavioural signals instead of static thresholds

Rather than blocking any order with a new device, compare the device fingerprint to the shopper’s historical pattern. A rule that flags “new device + high order value” is more precise than “new device”.

Incorporate device reputation APIs

Services such as Stripe Radar provide a risk score that updates in real time. Instead of a binary block, set a review threshold (e.g., score > 80) and let a human agent decide. This reduces false declines by up to 20 percent in many cases.

Leverage email and phone verification

One‑time passcodes sent to a verified email or SMS can clear a high‑risk order instantly. The cost of the verification step is far lower than the lost revenue from a blocked sale.

Segment high‑value customers

Identify your top 10 percent of spenders and create a whitelist that relaxes certain rules for them. Monitor the segment closely; if a fraud incident occurs, you can quickly tighten the rules again.

Apply geographic risk weighting

Instead of outright blocking orders from high‑risk countries, assign a higher score and combine it with other signals. This approach catches fraud that originates from those regions while still allowing legitimate tourists or expatriates to purchase.

When you have refined your rule set, run a final test by run a free scan of your store. The scanner will highlight any remaining friction points in the checkout flow and suggest additional improvements.

Common pitfalls and how to avoid them

Even experienced operators fall into traps that undo their hard‑won gains.

• Changing rules without data. Adjusting a threshold based on intuition often creates new false positives. Always base changes on logged evidence.
• Ignoring the time dimension. Fraud patterns evolve. A rule that worked in Q1 may become obsolete in Q3. Schedule quarterly reviews.
• Over‑relying on a single signal. IP address, device type, or email alone cannot determine intent. Combine at least three independent signals before blocking.
• Failing to test on a live segment. Deploying changes site‑wide without a staged rollout hides problems until they affect all traffic.
• Not involving the customer service team. Front‑line agents often hear directly from frustrated shoppers. Their feedback can surface false‑positive rules that analytics miss.

Quick checklist for fraud‑rule health

Use this list as a weekly or monthly audit routine.

• Export rule definitions and recent decline logs.
• Tag each decline as fraud, false positive, or unknown.
• Calculate false‑positive rate per rule; flag any above 10 percent.
• Test rule adjustments in sandbox; record impact on pass‑rate.
• Run a staged rollout to 5 percent traffic; monitor conversion and fraud loss.
• Update the change log with outcomes and next review date.
• Schedule a quarterly review of emerging fraud signals.

By treating fraud rules as a living system rather than a static shield, you protect revenue while keeping the checkout experience smooth for the customers who matter most.