Fraud risk scoring helps banks, digital banks, e-wallet providers, and payment businesses assess whether a transaction, account, or session may be linked to fraudulent activity. A fraud risk scoring model combines signals, such as unusual transfer velocity, device changes, recipient history and deviations from established customer behaviour, into a score that supports decisions to approve activity, request additional verification, hold a transaction where permitted, or refer it for investigation.

For financial institutions in the Philippines, fraud risk scoring can support controls across digital payments, onboarding and account protection. It should be designed around the institution’s risk exposure and applicable requirements from the Bangko Sentral ng Pilipinas (BSP), while remaining distinct from anti-money laundering (AML) risk assessment and statutory reporting obligations.

What Is Fraud Risk Scoring?

Fraud risk scoring is a method of assigning a numerical risk indicator to a transaction, account, customer or digital session based on signals associated with potential fraud. A higher score normally means that the activity warrants greater scrutiny, but the interpretation depends on the model. A score of 80 is not automatically an 80% probability of fraud unless the model has been calibrated and validated to support that interpretation.

Fraud risk scoring is a decision-support mechanism, not proof that a customer has committed fraud. It helps teams prioritise risk, apply proportional controls, and focus manual review on activity that needs more context.

Fraud Risk Scoring vs. Fraud Risk Assessment

Fraud risk scoring usually evaluates a particular event, account, or customer using a scoring method. A broader fraud risk assessment process identifies the organisation’s internal and external fraud risks, including fraud risk events, scenarios, vulnerabilities, likelihood, potential impact and control gaps across the organization. The fraud risk assessment also supports risk management by helping teams prioritise anti-fraud controls based on the likelihood and impact of each risk. This prioritisation, supported by regular fraud risk assessments, helps identify internal risks and external and internal risks as conditions change. The assessment informs which signals matter and how scores should be used, and its output can support risk assessments by documenting findings in a way used to enable ongoing monitoring of fraud risks while reflecting the organisation’s risk environment.

Why Fraud Risk Scoring Matters in the Philippines

Digital banking, e-wallets, remittances and electronic payment channels create convenient ways to move funds, but they also give fraudsters opportunities to exploit compromised accounts, social engineering, fraudulent recipients and abnormal payment patterns, increasing the risk of financial loss for institutions and customers. Fraud risk scoring can help Philippine financial institutions evaluate these signals consistently and prioritise their response. In its published assessment of suspicious transaction reports for 1 January 2021 to 30 June 2024, the Anti-Money Laundering Council reported swindling at 39.49% and cyber-enabled crimes at 22.86% of the predicate-crime categories analysed (AMLC assessment). These are findings from that report’s dataset, not a complete measure of all fraud in the Philippines, and such threats can also create civil liability alongside reputational harm.

Local controls should be considered in light of the institution’s actual services and licensing status. BSP Circular No. 1213 addresses fraud-risk controls for electronic products and services, including monitoring approaches such as transaction velocity, changes to account or device information, geolocation and behavioural anomalies. Review the full text of BSP Circular No. 1213, Series of 2025 to confirm the provisions applicable to your institution and support regulatory compliance with applicable BSP requirements.

The Anti-Financial Account Scamming Act (AFASA), Republic Act No. 12010, also forms part of the Philippine framework for protecting financial accounts. Institutions should review the law and applicable BSP issuances directly rather than assume that one particular fraud-scoring algorithm is universally mandated. See the full text of Republic Act No. 12010 in the Supreme Court E-Library and the BSP’s Memorandum No. M-2024-029.

What Factors Influence a Fraud Risk Score?

A fraud risk scoring model combines relevant data points to estimate a risk level for suspicious activity rather than relying on one unusual attribute in isolation.

Signals are indicators, not definitive evidence. A new device or unusual location can also reflect legitimate customer behaviour. The system should consider context, data quality, and the combined pattern, because the quality and breadth of data affect how accurately risk scores are calculated. Weighing multiple risk signals together also helps institutions to detect suspicious patterns and assess the risk of fraudulent activity more consistently.

Philippine Payment Context: InstaPay, PESONet and E-Wallets

A fraud scoring approach can be adapted to different payment journeys, and the process of scoring may differ based on the payment flow and available signals. For example, the timing of risk decisions and the available information for financial transactions may differ across different payment flows, such as an instant payment flow versus a batch-oriented payment process, and some providers evaluate signals in real time during the payment journey where their systems allow it. E-wallet providers may also assess new beneficiaries, rapid transfers, repeated failed authentication attempts or account changes, including threats such as identity theft.

These are use-case examples, not claims that all payment providers use identical controls. The score should fit the product, transaction lifecycle, data availability and rules that apply to the provider. BSP Circular No. 1213 calls for automated and real-time fraud monitoring and detection for BSP-supervised financial institutions within the applicable scope, and describes mechanisms including velocity checks, account/device changes, geolocation, blacklist screening and behavioural anomaly detection (official circular).

How Does a Fraud Risk Scoring Model Work?

Most scoring workflows have five stages:

Collect data: Gather relevant transaction, device, session, recipient, customer and investigation information.
Create features: Turn raw data into useful indicators, such as transaction velocity or deviation from usual behaviour.
Calculate a score: Here, scores are calculated using rules, statistical methods, machine learning or a hybrid approach, with the output expressed as a numerical value representing relative fraud risk.
Choose an action: Map the score to a proportionate response, with the next action based on the resulting score and the institution’s predefined rules, such as approval, step-up authentication, a hold where permitted or analyst review.
Learn from outcomes: Use confirmed cases and investigation findings to review rules, thresholds and model performance.

In production, fraud prevention software often operationalises this workflow across live decisioning environments.

A good fraud risk scoring system documents why a signal is used, how the score is interpreted and who is accountable for the resulting decision; the fraud risk score is the output that supports a consistent decision path.

Rule-Based Systems vs. Machine Learning for Fraud Detection

Rule-Based Fraud Scoring

Rule-based systems are used to evaluate defined scenarios and assign points or actions when conditions are met. For instance, a recent account-detail change combined with unusually rapid outgoing transfers may trigger a higher risk score.

Strengths: Rules are comparatively transparent, easy to explain and useful for known scenarios or when labelled training data is limited.

Limitations: Rules require ongoing maintenance and may miss complex relationships between signals. Fixed rules may also struggle to keep up with evolving patterns and new fraud tactics, so rigid rules can become less effective over time.

Machine Learning Models

AI and machine learning models use historical examples or behavioural patterns to rank activity or estimate fraud risk. Depending on the available data and use case, an institution may use supervised classification, anomaly detection, or graph-based analysis.

Strengths: Models can identify interactions among signals that fixed rules may not capture, and machine learning can surface fraud patterns from data that static logic may miss.

Limitations: Performance depends on data quality, representative labels, validation, monitoring, and ongoing recalibration of scoring models to reflect updated rules and new signals. Model outputs may also be harder to explain, especially when the model is complex.

Hybrid Fraud Risk Scoring

A hybrid model combines explicit rules with machine learning or statistical scoring, pairing transparent rules with model-driven outputs whose design reflects the institution’s risk appetite for automation and control trade-offs, for more adaptable fraud prevention. Rules may address well-understood high-risk scenarios, while models capture broader or less obvious patterns, and this approach can be aligned with the institution’s appetite for automation, explainability, and operational review. This can offer a practical balance between flexibility and explainability, but the best design depends on the institution’s own risk profile and technical maturity.

Fraud Risk Scoring Use Cases

1. Digital Payment Fraud Detection

A model can assess transfer frequency, amount, beneficiary history, device signals, and deviations from customer behaviour, applying fraud scoring to prevent payment fraud. Where systems support pre-authorisation scoring, separate scores can guide approval, review, or intervention. Where scoring occurs later, it may instead prioritise investigation or follow-up controls.

2. Account Takeover Detection

Account takeover occurs when an unauthorised person gains access to a customer’s account. A new device, unusual authentication, recent contact-detail changes and immediate transfers to a new recipient may collectively indicate elevated risk. The appropriate response could include stronger authentication, a temporary restriction or analyst review, depending on the evidence and the institution’s approved controls.

3. Onboarding and Identity Fraud

During onboarding, scoring can help flag inconsistent identity information, repeated attempts, suspicious device patterns or links to previously confirmed fraud. Identity verification results may be used as one input, but a fraud score should not replace required customer due diligence.

4. Transaction Monitoring and AML Investigations

Fraud signals can help investigators prioritise activity, understand suspicious account relationships, and support fraud-risk assessments in account relationships and transaction activity, but they do not replace AML analysis. However, this distinction matters because AML monitoring and fraud risk management have different objectives. A high fraud score does not automatically mean that a transaction is suspicious under the Anti-Money Laundering Act (AMLA), and a low fraud score does not establish that AML risk is absent.

For obligations and guidance, use official resources from the Anti-Money Laundering Council (AMLC), BSP and the Official Gazette. Confirm the rules applicable to the entity and activity in question.

How Should Institutions Set Fraud Risk Thresholds?

Thresholds connect a score to a response. A low-risk range might allow the activity to proceed, a middle range might prompt additional verification, and a high-risk range might trigger a hold where permitted or escalation to an investigator, with thresholds reflecting the risk of loss, customer friction, and investigation capacity rather than a fixed vendor score. These ranges are organisation-specific: there is no universal numeric score that means the same thing across all vendors and models, and the fraud risk should be reviewed regularly as products, channels, and fraud patterns change.

Threshold design should account for the cost of missed fraud, customer friction, investigation capacity, transaction speed, transaction volume and relevant regulatory requirements. Institutions should test thresholds against historical outcomes and document why the chosen actions are proportionate.

How to Reduce False Positives and False Negatives

A false positive occurs when legitimate activity is flagged as suspicious. A false negative occurs when fraudulent activity is not identified by the control.

To improve performance:

Combine several relevant signals instead of blocking activity based on one attribute alone.
Compare activity with the right customer and account context.
Use stronger authentication or manual review where proportionate, rather than treating every alert as a confirmed fraud case.
Evaluate thresholds using confirmed outcomes and representative historical data.
Monitor alert volumes, missed fraud, investigation turnaround times and customer impact.
Review model and rule changes through a documented approval process.

The objective is to improve the quality of risk decisions—not simply to reduce the number of alerts.

When Is Manual Review Necessary?

Manual review is valuable when a score is high-impact, the evidence is conflicting or the decision could materially affect a legitimate customer. Investigators should see the main contributing signals, relevant transaction context, previous case information and the reason for escalation.

The review process should record the evidence considered, the analyst’s rationale and the final disposition. Human review does not mean ignoring the model; it means combining model output with context and accountable judgement.

Fraud Risk Scoring vs. AML Risk Scoring

Signal category	Example	Why it matters
Transaction velocity	Several transfers made in a short period	May identify rapid movement of funds
Amount deviation	A transfer far outside the customer’s usual pattern	Adds context to transaction value
Device and session	A new device followed by sensitive account changes	May indicate account takeover
Recipient behaviour	Payments to a new or previously flagged beneficiary	Helps assess destination risk
Account changes	Recent phone number, email or credential changes	May indicate unauthorised access
Geographic context	An unfamiliar login location combined with other anomalies	Supports contextual risk assessment
Customer behaviour	A sharp departure from established account activity	Helps identify unusual activity
Known indicators	A link to a confirmed fraud account or device	Adds intelligence from previous cases

Capability	Primary purpose
Fraud risk scoring	Assess the likelihood that an event, account or activity is associated with fraud
Customer AML risk assessment	Assess a customer’s money-laundering and related financial-crime exposure
Transaction monitoring	Identify activity that warrants review under the institution’s monitoring framework
Sanctions screening	Detect potential matches against applicable sanctions or designation lists
Investigation and reporting	Examine evidence and fulfil applicable internal and legal obligations
These capabilities can share relevant data, but they are not interchangeable. A financial institution should connect them where useful while retaining the distinct decision criteria and obligations for each control.

Fraud Risk Assessment Process: Identifying Fraud Risks

A fraud risk assessment process should sit alongside fraud risk scoring. It identifies the fraud risks that matter to the organisation, evaluates how likely each risk event is to occur, considers the potential financial and customer consequences, and documents the existing controls and remaining exposure. The assessment should cover both external and internal risks across onboarding, account access, payments, customer support and investigation workflows.

For each material risk, record the scenario, likelihood, impact, risk owner, existing controls, residual risk, risk appetite and the planned fraud risk response. Regular fraud risk assessments should reflect confirmed fraud incidents, changes in fraud tactics, new products and changes to transaction volumes. This work helps teams prioritise which risk signals need scoring and which require preventive or detective controls.

Internal Fraud and Asset Misappropriation

Internal fraud can include employee misconduct, collusion or asset misappropriation; external fraud can include account takeover, identity theft, social engineering and fraudulent payment instructions. These scenarios may require different data, controls and escalation paths. Documenting them separately helps the institution identify fraud risks without treating every unusual transaction as the same type of event.

A Step-by-Step Implementation Framework

Define the target fraud scenarios. Specify whether the goal is account takeover detection, payment fraud, onboarding abuse or another concrete risk; these are the specific fraud events or behaviours the institution wants to prioritise, and may include internal fraud where relevant to the institution.
Map available data. Assess transaction history, devices, authentication, customer profiles, confirmed fraud labels and case outcomes, since the quality and completeness of data affect how well the model can score and detect suspicious activity.
Build a baseline. Document existing rule performance, losses, alerts, false positives and investigation workload.
Choose the method. Start with rules, machine learning or a hybrid approach based on evidence, complexity and data maturity; the chosen method should reflect available data, internal expertise, and the level of automation that can be supported.
Set decision thresholds. Map risk bands to approved actions, escalation criteria and operational owners.
Test before production. Validate on historical cases, examine missed fraud and false positives, and test how thresholds affect customers.
Integrate workflows. Connect scoring to payment decisions, authentication, transaction monitoring and case management as appropriate.
Monitor and improve. Review outcomes, emerging fraud patterns, data drift, access controls and change approvals on an ongoing basis, because ongoing reviews help update scoring models as fraud patterns and operating conditions change and support actions that can reduce avoidable losses.

The overall implementation should feed into a mitigation strategy with clear owners and review points.

A phased deployment can make it easier to compare results with the baseline, identify unexpected effects and adjust controls before expanding to additional channels.

Model Governance, Explainability and Privacy

Fraud scoring uses sensitive financial and behavioural information, so model governance must be part of the design—not an afterthought—and should support efforts to prevent fraud as threats and controls evolve.

Institutions should assign a clear model owner, document the purpose and limits of the score, maintain version control, validate performance before deployment and define how material changes are approved. For machine learning, monitoring should address data drift, label quality and performance across relevant customer groups.

Explainability is especially important for high-impact actions. An investigator should be able to understand the main signals behind an alert, the applicable score version and the reason an action was taken. A score should not become an opaque substitute for evidence.

Data collection should be limited to appropriate purposes, access should be controlled, and retention and security should follow applicable requirements. Institutions should assess Philippine privacy obligations and obtain appropriate legal or compliance review for their specific processing activities.

How to Measure Fraud Risk Scoring Performance

A model should be evaluated with several measures rather than a single headline score. Relevant metrics include:

Fraud detection rate: How much confirmed fraud the system identifies, using a clearly defined denominator.
False-positive rate: How often legitimate activity is incorrectly flagged.
Fraud losses: Losses associated with the targeted scenarios, interpreted alongside changes in exposure and volume.
Alert quality: The proportion of alerts that lead to substantiated concerns or useful action.
Investigation efficiency: Case volumes, review time and analyst workload.
Customer impact: Authentication friction, delays, complaints and unintended declines.

Track metrics over time and review them when fraud tactics, customer behaviour, products or data sources change. A system that performs well on historical data may degrade as the environment evolves.

Practical Example: An E-Wallet Transfer

Consider a hypothetical customer who usually sends occasional transfers to known recipients. The account is suddenly accessed from a new device, the registered contact information has recently changed and several rapid transfers are initiated to a new beneficiary.

The system combines these signals and assigns a higher fraud risk score. Depending on the provider’s approved controls, it may request stronger authentication, temporarily hold the activity where permitted or send the case to an analyst. The analyst reviews the evidence and records a decision.

This is an illustrative scenario, not a real customer case or a claim about a particular Philippine provider. A new device alone would not prove fraud; the strength of the assessment comes from the context and combination of indicators.

Frequently Asked Questions

What is fraud risk scoring?

What is a fraud risk scoring? Fraud risk scoring assigns a numerical indicator to a transaction, account or activity based on signals associated with potential fraud. It helps teams prioritise controls and investigation; it does not prove fraud by itself.

How is a fraud risk score calculated?

The system evaluates multiple inputs rather than one data point, including transaction velocity, amount deviations, device changes, recipient history and customer behaviour, to generate fraud risk scores. Those scores are typically produced using rules, statistical methods, machine learning, or combinations of these approaches, then combined into a score that informs the next action.

What is a good fraud risk score?

There is no universal good or bad numeric score. Each system has its own scale and thresholds. Institutions should understand how the score is calculated, validate its meaning and map it to documented actions.

Is fraud risk scoring mandatory in the Philippines?

The requirements depend on the institution, its products and the regulations that apply. Philippine institutions should review relevant BSP issuances, AFASA and other applicable laws. They should not assume a single scoring formula is universally required.

Does fraud risk scoring replace AML monitoring?

No. Fraud risk scoring focuses on possible fraudulent activity. AML controls assess and monitor money-laundering and related financial-crime risks and support applicable obligations. The systems can complement each other, but one does not replace the other.

Can machine learning prevent all fraud?

No. Machine learning can help detect complex patterns, but results depend on data quality, model design, monitoring and the effectiveness of response workflows. Fraud controls need ongoing testing and human oversight.

How Fraud Scoring Fits into a Broader Financial Crime Stack

Fraud prevention usually depends on several connected controls rather than a score in isolation. Customer onboarding and identity verification can help establish who is being served; name screening can identify potential sanctions or other third-party risk; transaction monitoring can surface unusual movement of funds; and investigation workflows can document the evidence behind a decision. These controls have distinct purposes and should not be treated as interchangeable.

For organisations reviewing how these capabilities fit together, ZIGRAM’s Complete AML System brings together screening, transaction monitoring, entity risk management and investigation workflows. Transact Comply supports transaction monitoring and payment-screening risk workflows, while PreScreening.io supports name and third-party risk screening. These products may complement a wider fraud prevention programme; no single product or score should be represented as a stand-alone guarantee of compliance or fraud prevention.

Conclusion: Make Fraud Risk Actionable

Fraud risk scoring gives Philippine financial institutions a structured way to evaluate suspicious activity, prioritise reviews and apply proportionate controls, helping teams focus resources where the likelihood of fraud is higher rather than concluding that a customer did commit fraud. Its effectiveness depends on relevant data, well-designed rules or models, calibrated thresholds, accountable human review and continuous monitoring.

For institutions looking to strengthen financial crime workflows, fraud scoring should be connected carefully with identity controls, transaction monitoring and investigations while preserving the distinct purposes of AML and sanctions controls. ZIGRAM’s expertise across financial crime compliance and risk workflows can help organisations assess how these capabilities fit into their wider control environment as part of broader fraud risk assessment work.

This article is for general information only and is not legal advice. Confirm the latest official requirements and their applicability to your institution before making compliance decisions.

The Risk Application Ecosystem

Interested in

ZIGRAM's Products?

Our Complete AML system

Table of Contents