How to audit your fraud acts in ~30 minutes. Here's how I usually approach it.

Most fraud teams inherit a stack that grew over time — rules added after incidents, thresholds tweaked in spreadsheets, exceptions nobody remembers approving. A quick audit brings clarity. Here is how I usually approach it in about 30 minutes.

1. List your active acts

Don't analyse yet — just map them. Include thresholds, exceptions, and segments.

The goal here is visibility.

2. For each act, ask one question: what problem is this solving?

• If the answer isn't clear, flag it.
• If it's solving a problem that no longer exists, flag it.

You'll usually find a few acts that stayed for historical reasons.

3. Check impact (even roughly)

• How often does this act trigger?
• What % of transactions does it affect?
• What % of those are actually fraud?

You're looking for signals.

4. Look for overlap

• Multiple acts, features, or models triggering on the same behaviour
• Elements that contradict each other
• Models that create unnecessary complexity

This is quite common in systems that evolved over time.

5. Review false positives

• Which parts of the decision engine block legitimate users most often?
• Are there segments where the act is too strict?

In many cases, this is where the biggest opportunity sits.

6. Check if the act is still needed

• Would removing it increase risk materially?
• Or just reduce friction?

7. Look at what's missing

• Are there obvious gaps in coverage?
• Signals you're not using?
• Flows that aren't monitored?

This step is often overlooked.

What you should have at the end

At the end of this, you should have:

• A clearer understanding of what each act does
• A shortlist of acts to remove, adjust, or rebuild
• A better sense of where your system is over- or under-performing

Want help running this audit on your Stripe or Shopify data? Book a demo and we'll walk through it together.