"What Do You Use, Rules or Models?"
The most poorly framed question in modern fraud prevention. It's like asking a doctor, "what do you use, blood tests or X-rays?". The right answer is never one of the two.
And yet, entire teams debate that false choice. The problem isn't choosing. The problem is knowing how to compose.
There's No Swiss Army Knife, There's a Combined System
Every fraud prevention technique has terrain where it shines. None alone covers everything — and that's not a weakness, it's the nature of fraud: it has many faces, and each calls for a different tool. The power shows up when they run together, on the same data, feeding the same engine.
The ones that move the needle when combined well:
- Rules. Capture the explicit and the regulatory. The language of the analyst who knows the business.
- Lists (deny and allow). Operational memory: the fraudster already identified, the loyal customer of years.
- Velocities. Detect abuse by quantity: bursts, repeated attempts, massive behavior.
- Supervised models. Generalize patterns the human eye takes time to formulate as a rule.
- Anomaly detection. Flag the statistically rare without needing prior labels.
- Graphs and relationship analysis. Reveal networks between accounts, devices, and payment methods.
- External email or identity signal. Brings information from outside that your system couldn't infer on its own.
Each one captures a dimension of the problem. The question is how you combine them so they learn from each other and produce the quality data the engine needs to decide.
Combining Well Isn't Summing
The easy way to combine is the bad way: treat the techniques as voters — if two of three flag fraud, block. That turns each tool into a vote blind to context, and produces massive blocking on customers none of the techniques would have blocked alone.
Combination that works is something else: each technique contributes what it detects, and the system decides from the full picture. The same rule can be a strong signal on one channel and noise on another; the same model can be decisive for one segment and almost irrelevant for another. The combined system understands that context because it learns from the team's real decisions, not from a fixed formula that assigns weights.
What Makes the Combination Work
The obstacle is structural: each technique lives in a different team and a different system — rules in Operations, models in data science, lists in Excel. Composing them ends up being a six-month engineering project. And even with that solved, the engine needs data — the techniques have to have run on the same set of transactions with everything they detected stored. That's architecture, not goodwill.
Four conditions mark the difference between real composition and a stack held together with tape:
- A single platform over the same event. If the transaction jumps between four systems, you've lost latency, consistency, and the chance to learn from the whole.
- Every technique leaves a trace as data. What it detected, what it flagged, what it let through — everything gets recorded. That data feeds the next iteration of the system.
- Segment-level adjustments. What works for cards doesn't work the same for crypto. The combined system versions itself by channel or product.
- Explainability. When the system blocks, the analyst sees which techniques flagged and why. Without that, the team goes back to operating blind.
Closing
Modern fraud prevention isn't choosing between rules or models, between lists or graphs. It's knowing how to compose the techniques and letting the system learn to read them in context. When it works, every team decision becomes data that feeds the next one — you don't just decide better today, you adapt faster tomorrow.
Want to see how to combine all these tools and supercharge your team's decision-making? Come to Frauddi, book a demo and we'll show you what operating like that looks like.
Next in the series: For Every $1 of Fraud, You Lose Almost $4 (and You Only Measure the First) (Part 8/8).