Last Updated: 29 September 2026
For merchants, fraud prevention has traditionally been a matter of identifying signals that a transaction may not be legitimate, whether that’s an unfamiliar IP address, an unusually large purchase, or behavior that resembles prior fraud. These controls are still useful for identifying well-known threats, but as fraudsters become much better at avoiding recognizable patterns, they become less effective as the primary way of assessing risk.
Now, 91% of decision-makers report an increase in sophisticated financial crime, reflecting how quickly fraud tactics have evolved and how hard they have become to detect. Attackers can change the devices, identities, and other behavioral signals they use with each attempt, making it harder for traditional systems to recognize that seemingly separate transactions are connected.
Most traditional rule engines rely on simple conditional logic. If a payment, for instance, originates from an unfamiliar location or exceeds a certain value, the system can flag it. This approach worked when fraudulent behavior was relatively consistent and could fit within predefined parameters. When a new threat surfaced, it often sufficed to identify the pattern and add another rule to account for it.
However, today's fraud operations can switch between devices and identities and test stolen credentials across multiple environments. This is particularly effective in synthetic identity fraud, in which fraudsters combine legitimate and fabricated information to create identities that appear credible during verification, while AI is used to automate the creation of supporting documents and identity profiles. The FortiBleed campaign, for example, involved 659 credential-harvesting pipelines that identified more than 110 million credentials in just over two weeks, demonstrating the scale at which automated attacks can now operate.
Introducing additional controls might seem like the obvious choice to counter such attacks, but more controls can also create more friction. Legitimate purchases can still be flagged, while stricter verification requirements can bring in additional friction without necessarily improving the assessment of risk.
The true success of a fraud strategy depends much on how accurately it distinguishes genuine customer activity from fraudulent activity. As AI makes fraudulent documents, synthetic identities, and manipulated biometric information increasingly convincing, verifying whether a single piece of information is legitimate may not provide enough confidence on its own.
It’s easy to underestimate how much information a transaction can provide when considered alongside the activity surrounding it. Looking at how a payment fits with a customer’s account behavior, device information, payment history, location, and other identity signals can help establish whether a payment is consistent with what is already known about them.
Predictive analytics makes it possible to look at these different signals together, allowing merchants to assess transactions in context rather than against a fixed set of rules. Machine learning fraud models can examine large numbers of variables simultaneously rather than evaluating each signal against a separate condition. Especially because individual signals can be easy to manipulate, the more useful indication of risk comes from how those signals relate to one another. Device identification and behavioral biometrics can provide a supplementary layer of signals, helping merchants assess whether the activity surrounding a transaction is consistent with the identity associated with it.
At the same time, not every indication of risk should lead to the same response. A transaction that represents several strong indicators of fraud may warrant a decline or additional verification, while a minor deviation from expected behavior may simply require further monitoring. The value of this approach is not just in identifying risk, but in determining how much intervention a transaction actually requires.
Segmentation, in this context, becomes crucial, considering that fraud thresholds should also vary by factors such as product category, customer tenure, and payment method. For example, a subscription payment may call for a different fraud threshold than a one-off purchase, even for the same customer, as the two types of transactions can carry different expectations around payment behavior and disruption. Rather than applying the same threshold across every payment, fraud controls need to be adjusted to the type of transaction and the level of risk it presents.
Putting these decisions into practice, however, depends on the information available at the point of payment.
Payment activity rarely exists within a single system. Cards, bank transfers, and other payment methods can generate different transaction data and rely on separate systems for assessing risk, making it harder to connect activity across the payment operation.
The information needed to understand a transaction may also have been generated before the transaction itself. An account may have been created earlier, accessed from a particular device, or used for previous payment attempts. When these interactions remain separate, merchants lose the ability to see how they connect and factor that context into a payment decision.
Connecting these signals across the payment lifecycle paints a broader view of activity. Information gathered during account creation, authentication, device activity, previous transactions, and earlier fraud events can contribute to the assessment of a new payment.
This also gives merchants a better way to respond as fraud patterns change. Rather than identifying a vulnerability in one payment method and addressing it only within that environment, businesses can look at whether similar activity is appearing elsewhere across the payment operation. Payment fraud research points to the growing use of AI-driven attacks and automated methods, making it important for merchants to recognize how activity develops across different payment environments.mands.
The same need for visibility extends beyond an individual merchant. No organization can see every emerging fraud technique, and a pattern that appears insignificant in one environment may become more meaningful when similar activity is observed elsewhere. Sharing intelligence across payment providers, fraud platforms, financial institutions, and merchants can provide a broader picture of how attacks are developing and help businesses identify patterns that may not yet be visible within their own transaction data.
As fraud patterns evolve, adding more controls may not be as effective as they are tempting. Connecting the information used to assess fraud with the payment decision itself allows fraud signals to directly inform that decision. In turn, when signals from across the payment lifecycle can be considered together, it creates a more enduring and reliable basis for understanding transaction risk and refining decisions.
