False Positives Are One of the Biggest Hidden Costs in Risk Management

False positives are one of the biggest hidden costs in risk management.

According to Kipp, around 10% of all eCommerce payments are rejected by fraud detection systems, but up to 70% of these declined orders are from legitimate customers. So nine out of ten investigations don't lead to any meaningful action.

The obvious cost is operational — thousands of analyst hours, growing compliance teams, and longer investigation queues.

I think the bigger cost is that false positives change how people work. When analysts spend most of their day reviewing alerts that turn out to be nothing, every new alert starts to look the same. The challenge shifts from detecting risk to managing alert volume. That's a dangerous place to be.

More acts, more alerts — not necessarily more fraud found

We see the same pattern across fraud prevention. Every fraud act is introduced for a good reason. But over time, systems accumulate more acts, more controls, and more alerts. Eventually, they become very good at generating work — not necessarily at finding fraud.

The objective was never to create more alerts. It was to make better decisions. That's an important distinction.

Reducing false positives means better decisions

Reducing false positives is about improving the quality of every decision the system makes. It means asking questions like:

• Which alerts consistently turn out to be legitimate?
• Which signals actually predict risk?
• Which controls create protection?
• Which ones simply create noise?

Good fraud and compliance systems are the ones that maximise precision while keeping risk at an acceptable level — because in the end the goal is to investigate the right things.

If you want a clearer view of which controls protect you and which mostly create noise, book a walkthrough.

Originally shared on LinkedIn.