The Cost of a False Decline

I led a small team through the case. I owned the analytical approach, directed the clustering and classification work, and built the strategy we presented. We worked under the team name NullFraud.

The bank in the case had a fraud cost problem, but not the one most people would reach for. Actual fraud accounted for an estimated 7% of total fraud-related losses. False positives accounted for 19%.

So the expensive failure was not missing fraud. It was declining real customers. And a false decline costs more than the transaction: it erodes trust, drives churn, and does brand damage that never appears in a fraud report. Our survey evidence backed that up, with consumers ranking trust and the security of their personal data among the most important factors in choosing a financial services provider.

Before trying to predict fraud more accurately, I wanted to know who was actually getting caught in the false positive net and why. We ran KMeans and KModes clustering across the transaction data.

That isolated a segment we called Cluster 0, with a materially elevated fraud rate and a clear shape: domestic rather than cross-border, card-not-present, concentrated in online and subscription payments, with no chip usage. The fraud was concentrated in specific merchant categories, cable and pay television, money orders and wire transfers, taxis and limousines, and bookstores. Chip usage told the same story from the other direction: transactions without it carried a visibly higher fraud rate than those with it.

Once the problem had a shape that specific, the solution could be targeted at it rather than applied to every transaction the bank processed.

Three parts. EMV payment tokenisation to protect primary account numbers at the system level. A binary classifier to replace the blunt legacy rules generating most of the false positives, selected by experimenting across several candidate models and using forward selection on the features. And a real-time SMS confirmation flow, so a suspicious transaction gets verified with the customer rather than declined on a guess.

That last piece is the one that addresses the actual loss. A rule that declines is making a final decision on incomplete information. A rule that asks is not.

We walked the judges through the strategy as a journey rather than an architecture, following a persona named Suzie from the moment a purchase looks suspicious to the moment it resolves, so each layer was visible as something a customer experiences.

Picking the right failure to optimise mattered more than the model did. Every team in the room could build a fraud classifier. The question worth answering first was which error was actually costing the bank money, and in this case it was the one nobody was looking at.