Risk Scoring Model

Audience: Fraud Operations, Data Science Last updated: March 2026 Version: 4.2

The FraudShield AI Engine risk scoring model produces a composite Risk Score (0–1000) for every transaction in real time. The score aggregates signals from over 200 Risk Indicators (RIs), behavioral profile data, and one or more ML detection models tuned for specific transaction channels and fraud typologies.

Score architecture

The composite risk score is built in three layers. Each layer feeds into the next before the final score is produced.

Layer 1: Risk Indicators (RIs)
  ─────────────────────────────────────────────────────────────────
  Raw transaction + enrichment data + behavioral profiles
  → 200+ RIs calculated (each RI returns a sub-score 0–100)
  Examples:
    RI_VELOCITY_TRANSFER_1H     : 78   (high velocity in last 1 hour)
    RI_NEW_PAYEE_FIRST_TXN      : 90   (new beneficiary, first transaction)
    RI_IP_COUNTRY_MISMATCH      : 65   (IP country ≠ account country)
    RI_DEVICE_FINGERPRINT_CHANGE: 55   (new device not seen before)
    RI_AMOUNT_SPIKE_3SD         : 82   (amount > 3 std deviations above mean)

Layer 2: Detection Models (channel-specific ML)
  ─────────────────────────────────────────────────────────────────
  RI sub-scores + raw features → XGBoost / Neural Network model
  → Model output: fraud probability (0.00–1.00)
  → Scaled to 0–950 within the composite score

Layer 3: Composite Risk Score
  ─────────────────────────────────────────────────────────────────
  Weighted combination of model output + policy rule boosts
  → Final Risk Score: 0–1000
  → Risk level: LOW / MEDIUM / HIGH / CRITICAL
  → Decision: APPROVE / STEP-UP / REVIEW / BLOCK

Risk Indicators (RIs)

A Risk Indicator is a calculated signal derived from the current transaction, historical behavioral profile data, or external enrichment. Each RI produces a numeric sub-score (0–100) that represents the degree of anomaly or risk for that specific signal.

RI categories

Detection models

Detection models are channel- and typology-specific ML models that transform RI values and raw transaction features into a fraud probability score. Each model is trained on labeled fraud data for its specific detection domain.

Available detection models

Score ranges and risk levels

The composite Risk Score maps to four risk levels. The default decision thresholds below apply out of the box. Your fraud operations team should tune these thresholds to match your institution's risk appetite.

Scoring workflow

1. Transaction received

   The core banking or payment system sends the transaction event to the FraudShield Scoring API (POST /api/v3/score) synchronously before authorization.

2. Enrichment

   The platform calls configured enrichment providers (IP intelligence, device fingerprinting, behavioral biometrics, identity verification) and appends enrichment data to the transaction object.

3. Profile lookup

   The behavioral profile store is queried for account-level and entity-level aggregates: rolling counts, amounts, payee lists, and session history.

4. RI calculation

   All applicable Risk Indicators are evaluated using the enriched transaction + profile data. Each RI returns a sub-score (0–100). High-value RIs are flagged for the explainability output.

5. ML model scoring

   The channel-specific detection model ingests RI values and raw features, returning a fraud probability that is scaled into the composite score range.

6. Policy rule evaluation

   Configurable policy rules in the Decisioning Engine can boost or suppress the score, or override the decision outright (for example, a regulatory hold or whitelist match).

7. Decision returned

   The scoring API returns the composite score, risk level, decision, top contributing RIs, and a correlation ID — typically within 80–150 ms end to end.

Multi-channel model coverage

FraudShield AI models are trained and calibrated per channel. The same transaction amount and beneficiary may carry very different risk scores depending on whether the transaction originated via mobile push payment, web banking, or a branch instruction. Channel context is always a first-class feature.