Skip to main content
Every event processed by AntifraudAI receives a risk score — an integer between 0 and 100 that represents the estimated likelihood of fraud. A score of 0 indicates the event looks completely benign; a score of 100 indicates the strongest possible fraud signal. The score is a continuous, comparable measure that lets you configure how aggressively AntifraudAI responds to different levels of risk across your product.

​
The Score Scale

Scores are mapped to decisions using configurable thresholds. The default ranges are: These thresholds are defaults, not fixed values. You can adjust them to match your business’s risk tolerance — for example, tightening the allow ceiling to 20 during a high-fraud period, or widening it to 40 for a low-value transaction category.

​
How Scores Are Calculated

Scores are produced in two stages: Stage 1 — ML Model Scoring. AntifraudAI’s machine learning models analyze the enriched event against patterns extracted from fraud data across the platform. Each model produces a component score, and the component scores are combined (via a weighted ensemble) into a single 0–100 value. Model weights and architectures are managed by AntifraudAI and update continuously as new fraud patterns emerge. Customers do not configure ML weights directly. Stage 2 — Rule Adjustments. After the ML score is produced, your customer-defined rules are evaluated. Rules can increase or decrease the score by a fixed number of points, or they can bypass the score entirely and force a specific decision. The final score reflected in the API response is the post-rule score.

​
Signals That Influence Scores

Signals are observable risk indicators detected during event enrichment. The ML models weight these signals when computing the score. Common signals include:
  • high_velocity — An unusually high number of events from this user or device in a short time window
  • new_device — The device fingerprint has not been seen for this user before
  • vpn_detected — The request originates from a known VPN, proxy, or anonymizing network
  • impossible_travel — The user’s apparent location is geographically inconsistent with recent activity
  • mismatch_billing_address — The billing address submitted does not match the address on file with the card issuer
  • unusual_amount — The transaction amount is outside the normal range for this user
  • known_fraud_fingerprint — The device or IP address is linked to confirmed fraud activity elsewhere on the platform
Detected signals are returned in the signals array of every API response so you can inspect what drove a given score.

​
Customizing Thresholds

Thresholds define how score ranges map to decisions. You can update your thresholds at any time without redeploying your integration:
  • Dashboard: Go to Settings → Risk Thresholds and drag the threshold sliders or enter values directly.
  • API: Use the thresholds configuration endpoint to update ranges programmatically — useful for automated threshold management or environment-specific configurations.
For full details on configuring thresholds via the API and dashboard, see Risk Thresholds Configuration.

​
Score vs. Decision

The risk_score is an advisory signal — the decision field is what your application should act on. A rule can force a block decision even when the score is 10, or force an allow even when the score is 90. Always read the decision field in the API response and treat the risk_score as supporting context, not the authoritative outcome.