Internal rules — sometimes called heuristics — are simple logic statements built to catch conditions that suggest a risky order. Simple in concept, but easy to get wrong in practice.
The core principle
Rules written only from past fraud attempts need constant patching — new fraud looks different from old fraud, by design. A more durable approach profiles what legitimate orders actually look like, and lets good transactions flow freely by default, rather than chasing yesterday's fraud pattern forever.
- Base rules on quantitative data proving the majority of what they catch really is fraud
- Keep rule management with a single owner, not scattered across teams
- Apply rules consistently across every channel and check
- Keep the overall strategy simple enough to avoid drowning the team in manual reviews
Common rule categories
- Transaction-based: dollar thresholds (most effective above your average order value), expedited shipping as a risk signal, high-theft product types, unusual order quantity
- Geographic: regional risk by state or city, international restrictions, area code checked against billing/shipping address
- Data quality: profanity in text fields, gibberish with no vowels, famous-name lists, suspicious CVV patterns like "000" or "123," private mailbox detection
- Address: mismatches between billing and shipping
Three ways to implement
- Rule list: sequential checks returning a single pass/fail/review — simplest, but limited feedback
- Weighted list: each rule carries a score, letting factors combine into a nuanced result — more sophisticated, but needs real ongoing maintenance
- Decision tree: which check runs next depends on the result of the one before it
Build in-house if you have the technical expertise (inexpensive, but real effort), or buy a commercial platform — Kount, CyberSource, and FICO Falcon are common names in this space.