#79 - The ML score cheat code almost no one uses in rules

Last week I wrote about how to set your ML score thresholds - choosing your goals, finding the right segments, and using AI to run the analysis. 

This piece picks up exactly where it left off.

Here's what we didn't cover: a score doesn't have to live only in your strategy layer.

In behavioral and trend rules - the ones that deal with specific fraud patterns rather than broad population thresholds - a score can play a completely different role. 

Side note: If you need a quick refresher on the difference between strategy, behavioral, and trend rules, I’ve got you.

How do you actually do it?

There are two ways to wire a score into a rule - one is intuitive, but the other one I rarely see used.

Let’s talk about it.

A quick reminder on how good rules are built

Before I get into where the score fits, a quick setup:

Every well-built fraud rule has three sections. I went deep on this framework in issue #25, but here’s the short version:

• Population: the segment you want the rule to fire on

• Detection: the core fraud pattern you're targeting

• Exclusion: the false positive patterns you want to exempt

Here’s how it would look like in a practice:

Now, here’s the thing: most teams write rules that only have a detection section. 

But the population and exclusion sections are often where the real accuracy gains come from.

Knowing which of these three sections your ML score belongs in changes how useful it ends up being.

Option 1 - Use the score to define your population

The population section narrows the scope of what a rule fires on. It's usually the first condition, and it's where a score fits most naturally.

But there are actually two versions of this.

The first is to use a low score as your population filter when you want to catch fraud that your model is missing.

Why? Well, it’s safe to assume what you’re writing a rule designed to catch fraud that is slipping through your model by getting low scores.

Starting your rule with something like “fraud_score < 20” tells the rule to only look at the population the model isn't already managing.

This is especially important if it’s difficult to simulate your rules on top of one another, and you want to avoid catching what your model already does.

Once you’ve defined the population that bypasses your model, the detection logic would then describes the specific pattern you're seeing in that group.

This is how you build rules that complement your model instead of duplicating it.

The second version is to use a high score as your population filter when you want to recover false positives.

Here's the scenario:

Your strategy rules are blocking events above a certain score threshold. 

But some of them are good customers.

You recognize them because they share specific behaviors that are generating friction unnecessarily.

For example, high-worth accounts that are showcasing high velocity, but are using the same old device they always used.

When you want to exclude these customers from being blocked by your model, you set the population condition to match your strategy rule.

For example - “fraud_score > 75”.

Then your detection section describes the false positive patterns.

The output is an approval rule - events that score high but match these specific behaviors get approved instead of blocked.

Either way, the score appears early in the rule - as the first or second condition.

Option 2 - Use the score as an exclusion

This one is almost never used but it's my favorite.

It’s basically a free cheat code any rule writer can use for every rule.

Here's the scenario: 

You've written a behavioral rule based on a pattern you're seeing in your data.

But when you run the simulation, the false positive rate is too high.

You add some exclusion conditions based on the usual data points - account age, device history, payment method. Better, but still not clean enough.

You're running out of obvious levers.

This is where you add the score as a final exclusion condition. For example - “fraud score > 10”.

The logic behind it is simple - low fraud scores always have higher false positive rates. So by excluding them, you’re likely excluding mainly false positives.

Notice that the threshold here is much lower than anything you'd use for a strategy rule.

But such a low score is often enough because your detection logic is already doing the heavy lifting on the fraud side.

You're just using the model to clean up false positives.

The reason this goes unused is simple: teams often think of a score as fraud indicator. They don't think of using it as a safety net instead.

Bottom line

So now you have the full picture of how to practically start utilizing your ML scores - in strategy, behavioral, and trends rules.

Hopefully, this would lead to extracting more value from your fraud models, and as an extension - better ROI from your vendors.

The main takeaway is this: you don’t need to be a data scientist to use ML models.

Especially not in 2026, when AI can do all the heavy lifting.

Try it out, it’s not that scary.

Are you currently using ML scores anywhere inside your behavioral or trend rules - or only in your strategy layer? Hit reply, I'd genuinely like to know how common this is.

In the meantime, that’s all for this week.

See you next Saturday.

P.S. If you feel like you're running out of time and need some expert advice with getting your fraud strategy on track, here's how I can help you:

Free Discovery Call - Unsure where to start or have a specific need? Schedule a 15-min call with me to assess if and how I can be of value.
​Schedule a Discovery Call Now »​

Consultation Call - Need expert advice on fraud? Meet with me for a 1-hour consultation call to gain the clarity you need. Guaranteed.
​Book a Consultation Call Now »​

Fraud Strategy Action Plan - Is your Fintech struggling with balancing fraud prevention and growth? Are you thinking about adding new fraud vendors or even offering your own fraud product? Sign up for this 2-week program to get your tailored, high-ROI fraud strategy action plan so that you know exactly what to do next. ​
Sign-up Now »

Enjoyed this and want to read more? Sign up to my newsletter to get fresh, practical insights weekly!

<