Managing fraud internationally. 6 chapters and a final quiz.

Chapter 1. Mapping each market before tuning the rules.

A fraud setup is tuned by combination, not by country. The rail that carries the payment, the regime that allocates the loss, and the threshold that penalizes the operator are three separate axes, and they do not line up. The UK and the euro area both run an instant payment rail, under two opposite reimbursement regimes. Neither the US nor Australia requires strong authentication, yet they fall under different monitoring programs. The unit that matters is the combination, not the border.

Four questions to answer before launching in a market

• Is the dominant payment method pull or push? A pull instrument leaves a way to dispute after the fact; a push instrument closes the window at settlement
• Is there a reimbursement regime, and who funds it? Three possible answers: nobody, the PSP, or a fund recovery process organized by the regulator
• Which threshold can penalize me, and how is it calculated? A network program on the card side; data published by the regulator on the transfer side
• Which local data feeds my rules? Card issuing country, the age of a proxy identifier, the result of a payee verification check
• Who answers the customer, and under what binding deadline? The claims desk belongs to the fraud setup, not to customer service

# rules/gb.yaml
market: gb
priority_rail: faster-payments           # push
reimbursement_regime: psr-mandatory      # 50/50, cap 85000 GBP
decision_clock_business_days: 5
controls:
  payee_verification: mandatory          # Confirmation of Payee
  new_payee_delay_h: 4
  first_transfer_cap_gbp: 500
monitored_metric: published_reimbursement_rate

---
# rules/us.yaml
market: us
priority_rail: card                      # pull
reimbursement_regime: none               # Regulation E: unauthorized only
strong_authentication: optional
controls:
  challenge_3ds_if: "amount > 300 USD or unknown device"
  avs_and_cvv: required
monitored_metric: vamp_ratio             # merchant threshold 1.5% from 2026-04-01

Chapter 2. Calibrating a threshold on the cost of both errors.

A decision threshold produces two kinds of error, and they do not cost the same. A false decline destroys a margin and sometimes a customer, while missed fraud costs the order, adds dispute fees, and erodes a monitoring ratio. Calibrating means finding the score at which the marginal costs of the two are equal. That point moves from one market to the next, because unit margin, the administrative cost of a dispute, and the customer’s propensity to retry move with it. A threshold inherited from another country arrives calibrated on three quantities it no longer measures. It is wrong from day one.

# calibrate_threshold.py — one threshold per market, recalculated monthly
# on the market's RESOLVED history, never on aggregated history

def total_cost(threshold, history):
    false_declines = [t for t in history if t.score >= threshold and not t.fraud]
    missed_fraud = [t for t in history if t.score < threshold and t.fraud]

    conversion_loss = sum(t.margin * t.p_no_return for t in false_declines)
    fraud_loss = sum(t.amount + t.cost_of_goods + DISPUTE_FEE
                     for t in missed_fraud)
    return conversion_loss + fraud_loss

chosen_threshold = min(CANDIDATE_SCORES, key=lambda s: total_cost(s, history_gb))

# Constraint: the network monitoring ratio bounds the result.
# If the optimal threshold breaches the program threshold, it is rejected.

Six parameters to collect, market by market

• Unit margin after cost of goods, in local currency: a false decline on a low-margin order costs little
• Probability of not returning after a decline, measured on a cohort rather than estimated: it varies widely depending on whether an alternative payment method is available
• Administrative cost of a dispute at the local acquirer, network fees included
• Recovery rate on funds: high where a refund mechanism exists, zero on a rail with no recourse
• Distance to the monitoring threshold in force in the market, which caps the fraud you can tolerate
• Case resolution time: an unresolved history overstates the performance of any rule

Chapter 3. Running a UK APP claims desk.

The UK reimbursement regime turns authorized push payment fraud into an industrial process. A customer reports, one PSP decides, another pays half, and everything hinges on a short clock and an exhaustive list of grounds for refusal. The regime covers payments executed on the Faster Payments Service and CHAPS since October 7, 2024. A team entering this market first builds a desk that can triage, investigate, and give reasons within the window, and only then builds detection models. The reverse order produces late decisions.

The gap between these two reimbursement rates is where the work lies. In-scope claims are reimbursed 97% of the time. Across all claims, the rate is 65%. The difference does not reflect resistance from PSPs; it measures out-of-scope cases: cards, international payments, and commercial disputes with a genuine seller. An effective desk therefore checks scope before investigating the merits, and tells the customer the result of that triage at first contact.

Chapter 4. Push rails: the controls that actually work.

On a push rail, the victims authenticate the transaction themselves. Biometrics, a PIN, a notification approved in the app: everything works exactly as the product intended. Stronger authentication therefore does not reduce this fraud by a single cent, while the money spent on it shows up in the income statement and never in losses avoided. The controls that work act elsewhere, at three distinct moments. Before the instruction, by checking where the money is going. During the instruction, by slowing down anything newly created. After the instruction, by chasing the funds while they are still somewhere.

• Delay rather than block: a block leads to a support call and a new attempt, while a delay breaks the script of a fraudster who keeps the victim on the phone
• Cap the ramp-up: the first hours of a payee, a device, or a proxy identifier concentrate the risk, and a limit there costs little in conversion
• Log what the customer saw, with the screen version: it is the only usable evidence when a claim is investigated
• Monitor the receiving side: incoming notifications per account, how fast the account is drained, onward transfers to a second account within seconds
• Put a cost on friction before adding it: a blanket delay on every transfer is paid for in abandoned payments and targets nothing

Chapter 5. Deciding when to authenticate in the US.

No strong authentication requirement applies in the US. There is no exemption to document and no fraud rate to maintain in order to keep the right not to authenticate. 3-D Secure becomes a commercial tool, turned on transaction by transaction. A team coming from the European Economic Area arrives with exactly the wrong reflex: it tries to avoid the challenge. The local question is when a challenge earns more than it costs. The answer is calculated segment by segment, from the liability shift gained and the conversion lost in return.

Signals available here that do not exist everywhere

• AVS (Address Verification Service): checks the street number and postal code; usable for US, Canadian, and UK addresses and useless elsewhere, it is often overlooked by European teams
• CVV check: decline on a mismatch, a choice to make explicitly rather than inherit from the PSP’s default setting
• Network tokens: automatic credential updates and a higher authorization rate, unrelated to cardholder authentication
• Regulation Z and Regulation E: they allocate losses between the cardholder and their bank, never to the merchant; no protection extends that far
• Network rules: the only ground on which the merchant can defend itself, using whatever proof of delivery and authentication it has kept

Chapter 6. Comparing decline rates and trading off fraud against conversion.

How you read a decline rate depends on where the payment was rejected. There are four successive rejection points, each controlled by a different party: first the merchant’s filter, then authentication, then the issuer’s authorization, and finally the retry after a decline. The same overall rate of 12% can reflect opposite situations: a filter set too tight in one case, abandoned challenges in another, a wary foreign issuer in a third. The denominator adds its own ambiguity, depending on whether it counts attempts submitted to the network or every cart that reached the payment page. Comparing two markets without this breakdown leads to the wrong conclusion and an expensive decision.

A soft decline is not a decline

When an issuer wants authentication on a transaction that has none, it responds with 65 on Mastercard and 1A on Visa and CB. These codes decline nothing. They tell you to resubmit the transaction with 3-D Secure, so a system that does not handle this step-up records as declines what were actually sales. Conversely, retrying a hard decline exposes you to penalties: Visa caps retries at 15 per card over 30 days, with fees beyond that. Retry rules are therefore set by response code, never in bulk.

• Segment by issuing country, not by merchant country: in the EEA, a payment whose counterpart is outside the region shows 17 times the domestic fraud rate (EBA / ECB, 2024 data)
• Separate volume from value: the ratio between the two varies widely from one instrument to another, and a rate calculated by value cannot be compared with one calculated by count
• Date the measurement: fraud reports arrive several weeks late, so a recent ratio always understates the final figure
• Distinguish a blocked attempt from a net loss: three figures circulate for the same event, and they do not add up
• Measure fraud against the channel, not total revenue: in the EEA, remote sales carry 83% of card fraud but only 28% of value (EBA / ECB, 2024 data)