What Is a Fraud Score and How Does Fraud Scoring Work?

A login comes in from a device the account has never used. On its own, that's not suspicious. People buy new phones. But the login also comes from an unusual location, and moments later someone tries to change the account's contact details. Now three signals point the same way, and none of them alone would have told you much.

That's the problem fraud scoring is built for. One data point rarely settles whether activity is fraudulent, so businesses weigh several risk indicators at once. A fraud score pulls them into a single risk signal you can use alongside your other controls and information to make risk-based decisions.

A score on its own doesn't do much, though. Its value depends on how you interpret it and where it sits in your control framework: the policies, procedures, analysis, and proportionate responses around it. Configured well, it can help flag suspicious activity while keeping friction low for lower-risk customers.

You'd typically read a fraud score alongside information from Know Your Customer (KYC) and Customer Due Diligence, transaction monitoring, and other relevant controls. Paired with the right policies and procedures, it helps you spot threats like account takeover and make more targeted, proportionate decisions.

The concept behind fraud score

A fraud score is a number or category estimating how likely it is that a specific event, transaction, session, or account is linked to potential fraud. It's produced by combining risk signals through rules or models. Those signals come from across the user journey: identity and contact details, devices and networks, behavioral patterns, transactions, and connections between accounts. Together, they give a broader view of risk than any single data point.

You can calculate a score per event (this transaction, this login) or build it up per account or profile over time. Either way, it's an input to a decision. It isn't the verdict, and it doesn't by itself fulfill AML obligations.

Methodology varies with the industry, the business model, and the organization's risk-management needs. The job stays constant. The score helps you decide whether to allow an action, request more verification, investigate further, or block it.

Most fraud scores are numerical and divided into predefined thresholds. Below one number is low risk. Then comes a medium range, and anything above a second threshold is high risk. What a given number means depends on the platform: a score of 100 could be very high risk in one system and relatively low in another.

Generally, a low score lets the action proceed without extra checks. A medium score may trigger additional verification, such as a liveness check, or further investigation. A high score may get the activity blocked or restricted, or send it to manual review.

Example fraud score scale

Why fraud scoring matters for businesses

Fraud scoring doesn't replace a business's fraud-prevention compliance program. Meeting AML/CFT and other regulatory obligations still takes a comprehensive set of controls and human judgment, and the score is one input into that framework. Used that way, a good fraud score offers four practical benefits.

• It helps focus investigative resources. Teams can point manual reviews at the accounts or transactions with higher assessed risk. They don't have to give all activities the same scrutiny, which may cut unnecessary review effort and its costs.
• It may reduce friction for lower-risk activity. Where your own policies allow it, activity the score marks as lower risk may proceed with fewer manual checks. That can shorten onboarding or transaction times for legitimate customers.
• It can surface coordinated or hard-to-detect patterns. Correlating signals across devices, networks, and behavior can expose coordinated activity that's harder to see when you review accounts one at a time. Spot it earlier, and you may limit exposure before it spreads across linked accounts.
• It supports consistent, documented risk assessment. Investigation and compliance teams get a repeatable, recorded signal to reference. That can make risk-based decisions more consistent and better documented, especially where your controls route significant or borderline cases to human review.

Suggested read: Adaptive, Accurate, Efficient: How Dynamic Risk Scoring Elevates Compliance

Key factors that influence fraud scores

Which signals go into a score depends on the use case and methodology. They fall into three groups.

Identity and contact signals include email and phone verification results, the history or reputation of an email address or phone number, and mismatches between identity details and other available information. An email address tied to multiple unrelated accounts may indicate more risk than one with a consistent history. So it may be a disposable email address, or a phone number linked to unusual account activity.

Device, network, and location signals include device characteristics, browser information, IP reputation, approximate location, VPN or proxy use, and whether multiple accounts are accessed from the same device or network. These are typically more meaningful in combination. Some examples: 

🚩 An email address created just minutes before sign-up, paired with a phone number that has no history on any previously verified account

🚩 Several new accounts registering within the same hour from the same device fingerprint, each using a different name and address

🚩 A user completing an entire onboarding flow in under 1 second, far faster than a human would typically need, suggesting scripted or automated activity rather than manual input

🚩 A brand-new account, with no prior activity, immediately attempting a transaction well above the platform's typical first-transaction size

Behavioral, transaction, and account signals include unusual login patterns, rapid changes to account details, deviations from established behavior, transaction amounts and frequency, new withdrawal destinations, and unexpected payment activity. Links between accounts, such as shared devices, contact details, or payment instruments, can feed in as well. They matter most when they connect to previously identified suspicious activity.

No single signal necessarily means fraud. Signals can have legitimate explanations and can throw false positives when read in isolation. Fraud scoring works best when signals are evaluated in context and correlated according to the scoring methodology.

How fraud scores are calculated

Few platforms rely on one modeling approach; most combine several.

Rule-based scoring assigns a fixed number of points to specific conditions and adds them up. A condition might be a payment well above a customer's usual range, or a device previously linked to confirmed fraud. It's transparent and easy to audit. But each rule only flags what it was written to look for, so the rules need regular updates as fraud tactics change.

Logistic regression estimates fraud probability as a weighted combination of risk factors, with weights derived from historical outcomes. Each factor's contribution stays visible, so the score is relatively easy to explain.

Gradient-boosted trees and random forests merge the outcomes of many decision paths into one probability score. They capture non-linear relationships between signals that a single rule or a linear model would miss. These are among the most widely used approaches in production fraud systems today. It's harder, though, to trace a given score back to one specific input than it is with logistic regression.

Network or graph-based analysis weighs an account's relationships alongside its own signals: shared devices, contact details, or payment instruments with other accounts.

Neural networks estimate fraud probability from complex, non-linear combinations of signals across large volumes of data. That makes them well suited to fast-evolving fraud patterns.

Anomaly detection measures how far behavior strays from a user's own established pattern. There's no fixed rule to compare against.

In practice, the number comes out of one of two calculations.

In rule-based systems, each triggered condition adds or subtracts a fixed number of points, and the points are summed. A new device might add 15 points and an unusually large transaction another 25, for a score of 40.

In model-based systems, such as logistic regression or gradient boosting, each signal becomes a numeric input. The model combines those inputs using weights learned from historical data and outputs a probability, say 0.72. The platform then scales it to its own range, such as 72 out of 100.

More platforms now blend both approaches into ensemble models. These pair the interpretability of rules with the pattern recognition of machine learning. Your risk appetite and data volume shape the right mix. So does how much explainability you need.

Measuring fraud scoring accuracy

Evaluating a fraud scoring model isn't just about how many fraudsters it catches. Businesses should track a mix of metrics to understand true performance. These include:

• Precision: The proportion of flagged cases that are confirmed as fraudulent. Higher precision generally means fewer legitimate users or transactions are incorrectly flagged.
• Recall: The proportion of confirmed fraudulent cases that the system successfully identifies. Higher recall means fewer fraudulent cases are missed.
• False positives: The rate at which legitimate customers are wrongly flagged or blocked. Fewer false positives mean less friction and fewer lost transactions.
• False negatives: The rate at which fraudulent cases slip through undetected. Fewer false negatives mean lower fraud losses.
• F1 score: A single benchmark that balances precision and recall, used to compare models over time. A higher F1 score means a better balance between the two.

Companies should measure performance against confirmed outcomes over time, since fraud may only surface after a customer complaint, investigation, or payment dispute.

Fraud scoring should be evaluated based on both financial and operational outcomes, alongside any regulatory or compliance requirements that apply to the relevant processes. Relevant measures can include changes in fraud losses, manual review and verification costs, and conversion rates.

Financial impact should be measured against a clear baseline. For example, reduced fraud losses and lower operational costs can be quantified directly or estimated against the losses and costs expected without the scoring system. Conversion should be assessed relative to a defined alternative, such as a previous scoring model or a manual review process, rather than treated as an inherent benefit of fraud scoring.

Scoring rules, models, and thresholds should also be reviewed regularly. As fraud patterns and customer behavior change, businesses can use confirmed outcomes and current risk data to assess performance and adjust their approach.

Industries that benefit from fraud scoring

Fraud scoring is most useful where businesses rely on digital identities or process large transaction volumes. It's especially valuable for businesses automating decisions at scale, where manual review can't keep up.

Fraud scoring can also support AML/KYC compliance and strengthen user trust. On the operations side, it can reduce the resources spent on manual investigations.

The following industries benefit most from it:

• Banking
• Fintech
• iGaming
• E-commerce
• Crypto and blockchain platforms
• Educational services
• Transportation services
• Travel and hospitality
• Trading and brokerage platforms
• Insurance.

Implementing fraud scoring in your business

Choosing the right fraud scoring tool

Consumers lost an estimated $442 billion to scams worldwide in a single year, according to the Global Anti-Scam Alliance. Consequently, the fraud detection market is growing, resulting in a large number of fraud detection and fraud scoring tools. To narrow the field, ask:

• Does the software effectively use AI/ML? 
• Does it use the most up-to-date information for real-time monitoring?
• Does it have access to reliable data? 
• Does it provide enough fraud signals?
• Does it provide dynamic fraud scoring?
• Is it adaptable and user-friendly?
• Does it meet regulatory standards?   
• Does it meet the needs of my business? 

Integrating fraud scoring into your stack

Fraud scoring can plug into an existing fraud management stack through APIs. You send transaction or user data to a scoring engine and get a risk score back in real time. That score then triggers the next step: approve the transaction, request more verification, or send the case to manual review.

The other route is a platform that combines fraud scoring with identity verification. Having both in one solution can simplify implementation and ongoing maintenance.

Setting thresholds and fraud actions

Businesses can set fraud-score thresholds based on their fraud patterns, risk tolerance, and operational needs. Thresholds should be clearly defined, documented, and regularly reviewed as fraud patterns change. Depending on the score, businesses can allow an event, trigger additional verification, or send it for manual review.

Suggested listen: Fraud-as-a-Service: How $20 Can Cause Millions in Damage | “What The Fraud?” Podcast

Challenges and limitations of fraud scoring

Several limits affect how accurately fraud scoring judges individual events:

• Fraud is rare compared with legitimate activity.

• Fraud labels can be incomplete or arrive late.

• New users often generate little data.

• Models can lose effectiveness over time as fraud patterns change.

Evolving fraud tactics and AI threats

AI is making fraud harder to distinguish from legitimate activity through deepfakes and bots that mimic human behavior.

That can weaken existing models, especially ones built on outdated data or static rules. As patterns shift, scoring models need updating and retraining on relevant, recent data.

Suggested read: More Sophisticated and More AI-Driven Than Ever: Top Identity Fraud Trends to Watch

False positives and false negatives

Fraud scoring errors come in two kinds.

A false positive occurs when a legitimate event is incorrectly assigned a high risk score, potentially triggering additional verification or a decline. For example, a new device or VPN connection may contribute to a higher score even when the activity is legitimate. This can lead to unnecessary friction and lost transactions. Visa projects that global losses from false declines will exceed $264 billion by 2027.

A false negative occurs when fraudulent activity receives a low risk score and is allowed to proceed. This can happen when fraud closely resembles legitimate behavior.

To reduce both types of errors, businesses should regularly evaluate model performance and recalibrate models and thresholds as new data and fraud patterns emerge.

Regulatory considerations for fraud scoring

Fraud scoring does not have a standalone regulatory framework. Instead, the applicable requirements depend on how the score is used, what data is processed, and the jurisdiction in which the business operates.

For example, where fraud scores are based on personal data, businesses may need to comply with applicable data protection and privacy requirements. In the EU, the General Data Protection Regulation (GDPR) requires a lawful basis for processing personal data and gives individuals the right not to be subject to decisions based solely on automated processing that significantly affect them, including the right to obtain human intervention. Meanwhile, in the US, laws like the Gramm-Leach-Bliley Act (GLBA), Fair Credit Reporting Act (FCRA), and state-level privacy laws (e.g., the California Consumer Privacy Act) impose obligations around data use and consumer notification. 

In regulated industries, fraud scoring may also form part of broader compliance processes. For example, financial institutions need to ensure that their use of fraud detection tools aligns with applicable AML requirements.

Businesses should assess the legal requirements that apply to the overall decision-making process in which fraud scoring is used. Depending on those requirements, maintaining records of scoring inputs, decisions, thresholds, and resulting actions can help support transparency, auditing, and compliance.

Fraud scoring evolution: 2027 scenarios

Fraud scoring is evolving toward more adaptive, data-driven approaches that can respond to changing fraud patterns and improve the accuracy of risk assessments. Advances in data quality, model development, and real-time analysis are enabling businesses to refine how they score individual events and respond to emerging threats.

Here are a few trends that could shape the evolution of fraud scoring by 2027:

Enhanced behavioral analysis. Generative AI is making synthetic identities and deepfakes harder to distinguish from legitimate activity. In response, scoring models may take in a wider range of behavioral signals, such as typing patterns, mouse movements, navigation patterns, and device interactions. These add context about whether an event looks more like known legitimate behavior or known fraud. They go into the risk score alongside other data points and inform the same call: allow, verify, review, or block.

More intelligence sharing and standardization between platforms. Shared fraud intelligence networks could give businesses fraud signals identified across multiple platforms without directly sharing sensitive customer data. As those networks standardize, scoring models could take in shared signals through common data formats or risk indicators. Fraud intelligence would then be easier to compare and apply consistently across systems.

More advanced AI-powered fraud scoring. AI and machine learning can make scoring models more adaptive by finding complex patterns across large data volumes. Future systems may pair rules with models that update more often as new fraud patterns appear, moving beyond fixed rules and periodic retraining. That matters more as autonomous AI fraud agents generate high-volume, sophisticated activity. Scoring models will need to process more signals and adapt faster.

Greater reliance on hybrid models to meet regulatory requirements. Explainability is becoming a bigger factor in AI governance. Fraud scoring providers may put more weight on making model outputs understandable and auditable. If automated scores inform your fraud decisions, clear reasoning, documented model behavior, and appropriate human oversight help support review and compliance.

That leaves a tension: some want models that update constantly. Others need every output explainable and auditable after the fact. Hybrid models are the proposed bridge. Whether they hold up under both pressures at once is the open question heading into 2027.

Suggested read: Willing to Own It, Unable to Prove It: Research on AI Governance in APAC

Fraud scoring FAQ

• What is a fraud score?

  It's a number or category that indicates how likely an event, transaction, session, or account is to be associated with fraud, based on risk signals analyzed through rules or models. It can be calculated per event (this transaction, this login) or accumulated per account or profile over time. It's an input to a decision. It isn't the verdict, and it doesn't by itself fulfill AML obligations.

• What is fraud scoring?

  It's the process of generating fraud scores from multiple risk factors. Today it's usually done with AI algorithms and/or machine learning (AI/ML) models.

• What factors influence a fraud score?

  Common factors include device fingerprinting, IP address information (such as VPN use or links to a known Tor node), transaction history, behavior patterns, shipping and billing address details, and payment method (such as a card reported stolen).

• How do fraud scoring systems work?

  Methods vary. Generally, systems analyze data in real time using set rules and AI/ML algorithms, assign a score, and use it to guide the decision to approve, verify, or block.

• What are the limitations of fraud scoring?

  Fraud scoring may produce false positives or false negatives, which could frustrate users and cost you customers. Platforms may also struggle to keep pace with evolving fraud tactics.

• How to reduce false positives in fraud detection?

  Use advanced tools, such as AI algorithms, to continuously fine-tune and dynamically adjust scoring models and thresholds. That keeps each risk factor assessed in the context of others, such as user behavior. It also keeps scoring criteria from being applied too rigidly or harshly to low-risk users.

• What is the difference between fraud scoring and credit scoring?

  A fraud score measures how likely it is that a user, account, or transaction is connected to fraud. A credit score measures how financially trustworthy a person is and how likely they are to make agreed-upon payments.

• How does identity verification support fraud scoring?

  You can't meaningfully score someone's fraud risk until you're sure who they are. Identity verification confirms the person being scored is who they say they are, so the risk factors you're weighing actually match them. Without it, you might be scoring someone on factors tied to an identity they stole or created. That wouldn't give an accurate picture of their risk.

• How can businesses implement fraud scoring?

  Integrate a tool like Sumsub's Fraud Detection & Prevention Solution with your existing tech stack to build custom fraud scoring models. Then adjust thresholds and actions to suit your risk tolerance and existing protocols.