Risk-Based Routing
Risk-based routing chooses a transaction's path by its assessed risk — a low-risk payment goes frictionless with an SCA exemption on the acquirer with the best approval rate; a medium-risk one through a 3-D Secure challenge; a high-risk one to review, to a stricter acquirer, or to a decline — so friction and cost are spent where the risk is. It is where the fraud engine and the routing engine meet.
- Also known as
- Risk-aware routing, Fraud-score routing, Adaptive routing
- Used at
- e-commerce checkouts, orchestration platforms, PSPs' risk products; anywhere SCA exemptions, 3-D Secure and multiple acquirers give a merchant paths to choose between
- Binding
- the SCA exemption rules (transaction risk analysis is itself risk-based routing written into regulation), scheme rules on 3-D Secure and liability, and the merchant's own fraud policy
- Typical inputs
- a fraud score from device, behavioural, historical and consortium signals; the transaction's amount and category; the issuer's known behaviour; the acquirer's fraud-rate headroom for TRA exemptions
- Typical outputs
- exemption requested and frictionless; challenge; manual review; decline; route to acquirer A or B; step-up to a different authentication; velocity or amount limits applied
- Parties
- the merchant's fraud and payments teams, the risk engine vendor, the orchestrator or PSP, the acquirers, the issuers (which make the final decision), and the customers who feel the friction or do not
How risk-based routing works in practice
Three transactions arrive at a checkout. The first: a returning customer, known device, typical basket, domestic card — score 5 out of 100. The engine requests a TRA exemption on the primary acquirer and the issuer approves without a challenge: two seconds, no friction. The second: a new customer, a €900 basket, a card from another country, an email created yesterday — score 60. The engine routes it through 3-D Secure with a challenge; the customer authenticates in her banking app; liability shifts to the issuer; the sale completes. The third: a device seen on four accounts this week, a shipping address flagged in the consortium — score 95. Declined, or held for review. Each path cost what the risk deserved: nothing for the first, a moment for the second, a sale for the third.
The design is a set of thresholds and their consequences, tuned against two curves: fraud losses and abandonment. Push the challenge threshold down and fraud falls while genuine customers abandon; push it up and the reverse. The engine's job is to find the frontier, and the merchant's to choose the point on it — a luxury retailer and a food-delivery app choose differently. Acquirer choice adds a dimension: a stricter acquirer with a lower fraud rate keeps the merchant's TRA exemption threshold available; a more permissive one approves more and risks the threshold.
For a payments company the risk-routing engine is a product with a measurable value: fraud rate, challenge rate, abandonment and approval, reported together.
Example
A marketplace challenges 100% of transactions above €100 and none below: fraud rate 0.12%, abandonment at challenge 11%, approval 85%. It implements risk-based routing with a scoring vendor: exemptions requested below a score of 20 regardless of amount; challenge between 20 and 70; review above 70; a second acquirer with a stricter fraud profile used for scores 40–70 to protect the primary's TRA threshold. Results after a quarter: fraud rate 0.09% (the score catches low-value fraud the amount rule ignored), challenge rate down from 38% to 17%, abandonment at challenge 8%, approval 91%. Additional sales: €2.8m a quarter; the vendor's fee €90,000. The fraud team's report now shows all four numbers on one page, which the CFO asked for and the fraud team resisted.
Common mistakes
- Routing on amount alone, which is not risk. - A single threshold for every category, country and customer segment. - Tuning for fraud rate and reporting abandonment nowhere. - Requesting exemptions on transactions the engine scored high, and losing the acquirer's TRA headroom. - Treating the engine's score as the decision; the issuer still decides, and the routing is a request.