AI fraud detection for ecommerce

Online fraud is growing by 14% a year, but blindly blocking suspicious transactions costs more than the fraud itself. AI can distinguish real buyers from fraudsters in milliseconds, with false-positive rates 10 times lower than static rules

If you manage an ecommerce business, fraud in online payments is not a hypothetical risk. It is an operational reality that affects every store, regardless of size. Global ecommerce fraud exceeds 48 billion dollars a year and is growing at a rate of 14% annually. But here is the paradox: most ecommerce businesses lose more money by rejecting legitimate sales (false positives) than to the fraud itself.

Traditional antifraud systems are based on static rules: if the card country does not match the shipping country, block it. If the amount exceeds a threshold, block it. If the IP comes from a VPN, block it. The problem is that these rules generate false-positive rates of 2–5%, which means that out of every 100 blocked transactions, between 2 and 5 were legitimate purchases from real customers who are unlikely to return.

Artificial intelligence changes the equation. Instead of binary rules, an ML model analyses dozens of variables simultaneously (browsing behaviour, device fingerprint, buyer history, typing speed and purchasing patterns) and generates a risk score in milliseconds. The result: detection rates 30–50% higher with false positives 10 times lower.

In this article, we explain how AI fraud detection works, how it differs from static rules, how to implement it progressively and how to balance security with the shopping experience.

Online fraud in figures: the real problem

To understand the scale of the problem, these are the key figures every ecommerce manager should know:

Global volume: Ecommerce fraud exceeded 48 billion dollars in 2023, and forecasts point to 91 billion dollars by 2028.
Average fraud rate: Between 1.5% and 3% of online transactions are fraudulent, depending on the sector. Electronics, fashion and digital products are the most affected.
Real cost of fraud: For every euro of completed fraud, ecommerce businesses lose €3.75 on average (including the product, shipping costs, processing fees, chargebacks and the administrative cost of disputing the transaction).
False positives: Static rules generate between 2% and 5% false positives. For an ecommerce business processing 10,000 transactions per month, that means 200–500 legitimate sales rejected. At an average order value of €80, this represents €16,000–€40,000 in lost monthly sales.

The figure many people ignore: the cost of false positives usually exceeds the cost of real fraud. An ecommerce business may have 1.5% fraud (150 out of 10,000 transactions) but 3% false positives (300 legitimate sales rejected). Fraud costs €45,000 (150 × 80 × 3.75), while false positives cost €24,000 in lost sales, plus the lifetime value of customers who will not return.

The greatest cost of fraud is not the fraud itself: it is the legitimate sales you reject out of fear.

AI vs static rules: why rules are no longer enough

Rule-based systems have one virtue: they are predictable and easy to audit. But they have three critical limitations:

They are binary. A rule says yes or no. There are no nuances. A legitimate customer buying from abroad through a VPN because they are travelling is treated in the same way as a fraudster. AI, on the other hand, generates a continuous risk score (0–100), allowing gradual decisions: approve, review or block.
They do not learn. When fraudsters change tactics (and they do so constantly), static rules become obsolete until someone updates them manually. An ML model is retrained with new data and detects emerging fraud patterns without human intervention.
They do not scale. A system with 50 rules is already difficult to maintain. A system with 200 rules is unmanageable: rules interact in unpredictable ways, create conflicts and nobody understands why a specific transaction was blocked. AI works with thousands of variables simultaneously without rule conflicts.

The most important practical difference is precision. A well-tuned rule system can detect 60–70% of fraud with 3–5% false positives. A well-trained ML model detects 90–95% of fraud with 0.3–0.5% false positives. That is an order-of-magnitude improvement in the signal-to-noise ratio.

Important: AI does not eliminate rules. It complements them. The best practice is a layered architecture: hard rules for obvious cases (cards on blacklists, embargoed countries) + an ML model for the rest. Rules act as a fast first filter; AI handles the grey area.

How AI fraud detection works

An AI fraud detection system analyses every transaction in real time by evaluating multiple signals simultaneously:

Behavioural signals

Browsing pattern: how long did the user spend in the store before buying? A legitimate buyer browses, compares and returns. A fraudster often goes straight to the most expensive product.
Checkout speed: how long did it take to complete the payment form? A human takes 30–90 seconds. A bot or a fraudster with stolen data takes 5–10 seconds.
Purchase history: is this a repeat customer with a clean history, or is it a first purchase with an unusually high amount?

Device signals

Device fingerprint: operating system, browser, screen resolution, installed plugins and time zone. A device that has previously generated chargebacks is a strong signal.
Use of VPNs, proxies or private browsing. This is not fraud per se, but combined with other signals it increases the risk score.
IP geolocation vs card country vs shipping address. Discrepancies are not necessarily fraud (travellers, expatriates), but the model learns which combinations are normal and which are not.

Transactional signals

Amount: is it within the typical range for this product, category or customer?
Frequency: how many transactions has this user, device or card attempted in the last few hours?
Card data: issuer BIN, country, type (debit/credit) and 3DS result.

The model combines all these signals and generates a risk score (0–100) for each transaction. You define the thresholds: below 30, approve automatically; between 30 and 70, review manually; above 70, block. Thresholds are adjusted according to your risk tolerance and your manual review capacity.

The balance between precision and recall: the central dilemma

Every antifraud system faces a fundamental trade-off:

Precision: Of all the transactions you flag as fraud, how many really are fraud? Low precision means many false positives (legitimate sales blocked).
Recall (sensitivity): Of all the transactions that are fraud, how many do you detect? Low recall means real fraud gets through.

You cannot maximise both at the same time. If you lower the blocking threshold (more aggressive), you improve recall but worsen precision. If you raise the threshold (more permissive), you improve precision but recall falls.

The key metric is the F1 score, which is the harmonic mean of precision and recall. But in antifraud, asymmetric cost matters: a false negative (undetected fraud) costs 3.75 times the transaction value, while a false positive (blocked sale) costs 1 times the value. This means that most ecommerce businesses should optimise slightly in favour of recall, accepting a few more false positives to detect more fraud.

GO/FIX/KILL traffic light for antifraud: Green: fraud rate < 1% and false positives < 0.5%. Amber: fraud 1–2% or false positives 0.5–1%. Red: fraud > 2% or false positives > 1%. If you are in the red for false positives, you are losing more to rejected sales than to fraud.

Progressive implementation with Gates

AI fraud detection is implemented gradually, like any high-impact system:

Gate 0: Assessment

Quantify your current problem: fraud rate, chargeback rate, false-positive rate (if you can measure it) and total cost.
Define the value hypothesis: reduce false positives by 50% while keeping the fraud rate stable, or reduce the fraud rate by 30% without increasing false positives.
Select the tool according to your transaction volume and technology stack.

Gate 1: Shadow-mode pilot

Deploy the system in shadow mode: analyse all transactions but block none. Compare its decisions with those of your current system for 4–8 weeks.
Measure precision, recall, F1 score and the new system’s false-positive rate against the current one.
Adjust the score thresholds according to your risk tolerance.

Gate 2: Production

Activate automatic blocking for extreme scores (>80) and manual review for the grey area (30–80).
Real-time dashboard: transactions analysed, approved, reviewed and blocked, plus chargebacks.
Weekly review of false positives: take a random sample of blocked transactions to verify that they really were fraud.
Retrain the model monthly with new data on confirmed fraud and legitimate transactions.

Tools available according to your scale

Stripe Radar: Natively integrated into Stripe. It uses ML trained with data from millions of businesses. Ideal for ecommerce businesses already using Stripe. Cost: included in the Stripe fee (+ €0.02 per additional transaction in Radar for Fraud Teams).
Signifyd / Riskified: Models with chargeback guarantees: if they approve a transaction that turns out to be fraud, they cover the loss. Ideal for medium-to-high-volume ecommerce businesses. Cost: 0.5–1.5% of transaction volume.
Sift / Forter: Enterprise platforms with advanced ML models and multichannel coverage (web, app and marketplaces). For operations with >50,000 transactions/month. Cost is negotiable.
Open-source solutions: For technical teams, libraries such as scikit-learn or XGBoost allow you to build your own models with historical transaction data. Greater control, but it requires expertise and ongoing maintenance.

Regulatory framework: PSD2, SCA and AI Act

AI fraud detection does not operate in a regulatory vacuum. There are three frameworks that directly affect how you implement your antifraud system:

PSD2 and SCA (Strong Customer Authentication): The European payments directive requires strong authentication (two factors) for online transactions. But it allows exemptions for low-risk transactions assessed through a Transaction Risk Analysis (TRA). A good AI antifraud system lets you use more SCA exemptions, reducing checkout friction and increasing conversion.
GDPR and automated profiling: An antifraud system that makes automated decisions (blocking a transaction) based on user profiling is subject to Article 22 of the GDPR. Users have the right not to be subject to decisions based solely on automated processing. This means you need a human review mechanism for blocked transactions and transparency about how your system works.
AI Act: Fraud detection is not classified as high risk in Annex III of the AI Act (unlike recruitment or credit scoring). But if your system makes decisions with a significant impact on consumer rights (systematically blocking certain demographic profiles), you could fall under transparency and non-discrimination obligations.

Practical advice: Document how your antifraud system works, what data it uses and how a customer can challenge a block. This is not only good practice: it is an obligation under PSD2 and GDPR. Having this documentation also prepares you for the AI Act’s transparency obligations.

Protect without paralysing: intelligent antifraud

AI fraud detection is not a luxury for large retailers. It is an operational necessity for any ecommerce business that wants to grow without fraud (or fear of fraud) costing more than growth itself.

The key is balance: a system that detects 95% of fraud but blocks 5% of legitimate sales is not better than one that detects 85% of fraud with 0.5% false positives. The metric that matters is not how much fraud you detect, but how much net margin you retain after subtracting fraud that gets through, rejected sales and the cost of the system.

If you want to assess your current fraud and false-positive levels, select the right tool for your transaction volume or run a pilot using the Gates model, Impulsa3 implements intelligent antifraud solutions and supports you from Gate 0.

The control of an antifraud system must also include AI ROI and an incident plan for AI systems.