---
title: "Machine learning rules"
description: "Benefit from machine learning rules to evaluate the risk of transactions."
url: "https://docs.adyen.com/risk-management/configure-your-risk-profile/machine-learning-rules"
source_url: "https://docs.adyen.com/risk-management/configure-your-risk-profile/machine-learning-rules.md"
canonical: "https://docs.adyen.com/risk-management/configure-your-risk-profile/machine-learning-rules"
last_modified: "2023-01-20T10:19:00+01:00"
language: "en"
---

# Machine learning rules

Benefit from machine learning rules to evaluate the risk of transactions.

[View source](/risk-management/configure-your-risk-profile/machine-learning-rules.md)

Our risk engine uses machine learning and Adyen's global transaction data to evaluate the fraud risk of transactions. Protect your business and benefit from more protection.

## Requirements

Before you begin, take into account the following requirements and limitations.

| Requirement                                          | Description                                                                                                                                                                                                          |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Integration type**                                 | Make sure that you have built an [online payments integration](/online-payments/build-your-integration/) and that [risk management is enabled](/risk-management/configure-risk-settings/).                           |
| **[Customer Area roles](/account/user-roles/#risk)** | To change the settings for the rule **Machine learning: fraud risk**, make sure that you have one of the following role(s):- **Merchant change risk settings**
- **Risk admin**                                      |
| **Limitations**                                      | You can only use the rule **Machine learning: fraud risk** when you have enabled [premium features](/risk-management#risk-engine). There are no configuration options for the rule **Machine learning: bot attack**. |

## How it works

Machine learning assesses the properties of each incoming payment request and gives the transaction a risk classification. Protect will block the transaction when it is likely part of an enumeration attack, or when the risk classification exceeds your selected block threshold.

Protect offers the following machine learning rules:

* **Machine learning: bot attack risk** (basic and premium)\
  This rule detects and blocks transactions that come in at an unusually fast rate with suspicious payment properties. This can indicate scripted attacks like card testing and bot attacks. This rule mostly prevents large scale attacks.

  We recommend that you enable premium and set up [custom rules](/risk-management/configure-your-risk-profile/custom-rules) to add logic for customer behavior that you consider anomalous. For example, more than three top-ups in an hour, or more than three retail purchases per hour.

* **Machine learning: fraud risk** (premium)\
  This rule evaluates the payment fraud risk of transactions and classifies them with a distinct risk level. This risk level indicates the likelihood that a transaction will result in a fraudulent dispute. When a transaction is classified as riskier than the [risk threshold](#new-profile-threshold) that you define, the transaction is blocked before it is sent to authorization.

  Currently, this rule runs on transactions that can be disputed, such as payments made with credit and debit cards. We recommend that you add [custom rules](/risk-management/configure-your-risk-profile/custom-rules) to complement your risk profile.

Before the transaction is sent to authorization, each transaction is assigned a risk level ranging from **Very Low** to **Very High**. This risk level is based on the properties from the payment request as well as historical data connected to the transaction.

Most transactions get a **Very Low** classification, meaning that they have little to no fraud chargeback risk. Some transactions get an evaluation between **Low** and **Very High**, which means they have an elevated risk level.

The optimal blocking threshold, the risk level from which to start blocking transactions, depends on your business model and the difference in cost between a fraud case and a false decline. For example, we recommend retailers with thin margins and high operational costs of fraud to set a **Low** or **Medium** threshold. This because the cost of a fraud case (the loss of goods, the operational effort, and potential dispute fees) largely outweighs the cost of a false decline. In contrast, we recommend businesses that sell mostly digital goods to set a **High** or **Very High** threshold. This because the cost of a false decline (potential loss of lifetime value) mostly outweighs the cost of a fraud case (low cost of goods, low operational fees).

## View or change your risk threshold

When you enable premium features, the rule **Machine learning: fraud risk** is added to your **Block** rules. This rule will block transactions that are likely to be fraudulent, unless the transaction triggered an **Allow** rule [before authorization](/risk-management/configure-your-risk-profile#new-profile-risk-rules).

By default, the block threshold for this rule is set to high risk and above. This threshold setting has a balanced approach because it avoids blocking genuine shoppers while keeping fraud at acceptable levels by blocking high risk transactions. You can change the risk threshold if you think this setting does not fit your business, for example if you want to block more transactions.

It is important to understand that not all fraud cases can be detected by the **Machine learning: fraud risk** rule. We recommend that you add [custom rules](/risk-management/configure-your-risk-profile/custom-rules) to complement your risk profile.

To view or change the risk threshold for your risk profile, in your [Customer Area](https://ca-test.adyen.com/):

1. Go to **Revenue & risk** > **Risk profiles**.
2. Select a risk profile.
3. Select **Risk rules**.
4. Select **Block**.
5. Select **Machine learning: fraud risk** > **Adjust blocking threshold**.
6. View the current block threshold, or adjust it using the slider and select **Save**.

## Analyze signals

Many signals impact the machine learning fraud risk evaluation for a transaction, some stronger than others. On the **Risk results** page, we show the most influential signals that contributed to the risk evaluation. These signals are derived from your company's transaction data, [data collected](/risk-management/fraud-data-collection/) on your checkout or other pages for web integrations, and Adyen's global transaction data. Signals are used to identify legitimate shoppers and fraudsters, and can help you to understand high and low risk characteristics associated with transactions. This understanding can then, for example, help you build custom risk rules.

Some examples of signals include:

* The number of days since this email address first appeared in Adyen global transaction data.
* The authorization rate of transactions that include this email address as seen in Adyen global transaction data.
* The number of days since an authorized payment that included this email address was first seen in Adyen global transaction data.
* The fraud rate of transactions that originate from this IP address based on Adyen global transaction data.
* The time spent entering the card number on the checkout page.
* The number of previously authorized payments for this card on your company or merchant account.
* The email address contains the shopper name.

Signals can impact the overall risk evaluation positively or negatively, and each signal can have a different strength.

You can analyze how signals impacted the **Machine learning: fraud risk** rule evaluation on the **Risk results** page. You can see if the signal indicated fraud or not, and how strong the signal was. For example, three arrows indicate a strong contribution, one arrow indicates a weaker contribution.

To review signals in your [live Customer Area](https://ca-live.adyen.com/):

1. Switch to a merchant account using the latest version of the risk profile.
2. Go to **Transactions** > **Payments**.
3. Select the **Risk score** for a payment from the payments overview to open the **Risk results** page.
4. Select **Show signals** in the **Machine learning: fraud evaluation** section.

A signal breakdown view opens that you can use to analyze the risk signals for this transaction. It can take up to two hours before the breakdown is available, but often it is available within 15 minutes.

## See also

* [Risk lists](/risk-management/configure-your-risk-profile/risk-lists)
* [Custom rules](/risk-management/configure-your-risk-profile/custom-rules)
* [Post-authorization rules](/risk-management/configure-your-risk-profile/post-auth-rules)
* [Data quality and risk field reference](/risk-management/configure-your-risk-profile/risk-field-reference)
