Overfitting: The Most Common Mistake in eCommerce Fraud Prevention

One of the most common mistakes I see in eCommerce fraud prevention is overfitting.

A fraud pattern appears, losses increase, pressure builds internally, and the team reacts quickly to stop the attack. The problem is that many of these reactions become too specific.

How overfitting happens

Imagine a fraud pattern that includes stolen cards from a specific issuer, disposable email domains, a product priced at $110, and transactions coming from a certain geo. A common response is to build logic around the exact pattern itself.

So the rule becomes: block transactions matching this exact pattern.

At first, it works. But then the fraudster changes one thing — the product becomes $105 instead of $110 — and the entire pattern disappears from the system again.

This happens because many fraud decisions rely too heavily on signals that are easy to replace: specific products, checkout amounts, single email domains. These are weak anchors.

Fraudsters adapt very quickly once they understand what's being blocked.

What to focus on instead

The goal should be to understand the underlying behaviour behind the fraud pattern.

It's not about what happened once. It's about understanding what the fraudster is trying to achieve — and which parts of the pattern are difficult to change. The parts that are structural, repeatable, and harder to simply replace or adjust.

That's usually where the stronger logic sits.

This applies to every system

This challenge exists regardless of how decisions are being made. Whether you're using manual reviews, rules, machine learning models, or AI-based systems — if the logic becomes too dependent on highly specific signals, it becomes fragile.

Overfitting creates another problem: false confidence. The system looks effective because it successfully blocks the pattern it already knows, but it becomes blind to small variations around it.

Building resilience

More fraud systems should focus on signals and behaviour that are harder for fraudsters to manipulate quickly. That's what creates resilience.

Fraud prevention is not really about catching one attack. It's about building systems that continue working after the fraudster changes tactics.