How a mid-size EU payments processor cut false declines without raising fraud

The client in this study is a mid-size payments processor operating in several EU markets. It has been anonymised at its request, and figures have been rounded. Nothing here should be read as describing any named company.

The problem

The processor's merchants, mostly online retailers and subscription businesses, had begun complaining about declined transactions. Internal analysis confirmed the problem: about 3.1 per cent of transactions were being declined by the processor's own risk engine, and a review of a sample found that most of those were legitimate. The industry benchmark for false declines was closer to half that.

Each false decline cost the merchant a sale and, often, a customer. Several larger merchants had begun routing part of their volume to a competing processor, citing the decline rate.

The risk engine had been tuned two years earlier, during a spike in card-testing fraud, and the thresholds had never been revisited. The fraud team was reluctant to loosen them without evidence that fraud would not rise.

What they did

The processor assembled a working group across risk, product and merchant services, with a mandate to reduce false declines while holding the fraud rate flat.

The first step was to label outcomes. The team went back six months and matched declined transactions against subsequent chargebacks, merchant feedback and, where available, retry behaviour. That produced a labelled dataset showing which declines had been correct and which had not.

The risk model was retrained on the labelled data, with the threshold set to hold the fraud rate at its existing level rather than to minimise fraud in isolation. The retrained model made greater use of signals that had been available but underweighted: device history, the customer's past relationship with the merchant and the match between shipping and billing details.

For transactions the model scored as uncertain, the team introduced a step-up path: rather than declining, the processor triggered strong customer authentication through the cardholder's bank, so that the bank confirmed the transaction. That shifted a marginal decision to the party with the most information about the cardholder.

Merchants were given a dashboard showing their decline rate, the reasons and the outcome of step-up challenges, and were allowed to adjust their own risk appetite within limits set by the processor.

Results

Over the nine months after the model went live, the false decline rate fell from 3.1 per cent to 1.4 per cent. The fraud rate, measured in basis points of transaction volume, was unchanged within the working group's tolerance.

Annualised merchant revenue recovered through approvals that would previously have been declined was estimated at 2.3 per cent of processed volume. Churn among merchants who had cited declines as a reason for leaving fell by about 40 per cent, and two of the larger merchants that had split their volume returned it.

What others can take from it

Fraud thresholds set in a crisis should be reviewed once the crisis has passed. The two-year-old settings were costing far more in lost sales than they were saving in fraud.

Label the outcomes before retraining. Without a record of which declines had been wrong, the model had nothing to learn from.

Route uncertain cases to whoever has the best information. Step-up authentication converted a binary decision into a question for the cardholder's bank.

Give merchants visibility. Much of the churn was driven by the feeling that declines were arbitrary; the dashboard changed that even before the rate fell.