What is a risk-based decline? (fraud scoring explained)

A risk-based decline happens when a fraud detection system decides the transaction is too risky to approve. The card itself may be perfectly valid — not expired, not over limit, not reported stolen — but the transaction's characteristics raised a red flag. The issuer or processor's fraud model scored the risk above an acceptable threshold and refused the charge.

These systems analyze dozens of signals in real time: the transaction amount relative to the cardholder's history, the merchant's category and location, the device or IP address initiating the charge, the time of day, recent velocity (how many charges in the past hour), and more. A single unusual signal may not trigger a decline, but a combination can push the risk score over the threshold.

Fraud models are proprietary and issuers do not disclose them, but common risk signals include:

• Transaction amount — unusually high for this cardholder's spending history.
• Merchant category — some MCCs face elevated scrutiny (digital goods, gambling, crypto).
• Geographic mismatch — the transaction originates from a country or region far from the cardholder's known location.
• Device or IP anomaly — the device fingerprint or IP address is associated with prior fraud or proxies.
• Velocity — too many transactions in a short window, even if each is small.
• Time of day — late-night transactions in the cardholder's timezone can raise flags.
• First-time merchant — no prior relationship between this cardholder and this merchant.

Risk-based declines are a leading cause of false declines. The fraud model is designed to be cautious — it would rather block a legitimate transaction than let through a fraudulent one. But that caution has a cost: real customers get declined, abandon their purchase, and may never return.

The transaction looks suspicious to the algorithm, but the customer is real. They might be traveling (geographic mismatch), buying a large item (unusual amount), or using a new phone (device anomaly). The card is valid, the money is there, but the charge is refused.

Blind retries rarely work — if the same transaction data triggers the same fraud model, it will decline again. Recovery requires changing something: reaching the customer to verify legitimacy, trying at a different time, or having the customer call their bank to whitelist the merchant.

Revatto handles these recoveries: AI detects the decline pattern, reaches the customer via email and SMS under your brand, and a human follows up when needed. The customer verification conversation itself can change the risk profile for future attempts. You only pay when the payment is recovered — 20% of the first recovered payment, $0 monthly.