In 2025, businesses worldwide lost an estimated $534 billion to fraud, averaging 7.7% of annual revenue. For a business turning over $50M, that figure translates to $3.85M disappearing each year to fraud, chargebacks, and the operational cost of managing them. It is not an edge-case risk. It is a recurring line item.

Most enterprise CFOs are aware that fraud is a cost. Fewer understand that the cost is not fixed. It is a direct function of the quality of the fraud infrastructure the business is running on. A company relying on outdated detection methods is not just exposed to more fraud; it is also declining legitimate customers and absorbing chargeback losses that a better infrastructure would have prevented. In 2026, the quality of that infrastructure is increasingly defined by how well it uses machine learning.

This article is written for the CFO who wants to understand what machine learning fraud detection actually does, what questions to put to any vendor selling it, and how to evaluate whether their current fraud infrastructure is adequate for the scale they are operating at.

Rule-based systems block transactions based on fixed criteria: a card originating from a high-risk country, a transaction exceeding a certain value threshold, or a newly created account placing a high-value order. These rules are legible, auditable, and straightforward to explain to a compliance team. They are also straightforward to circumvent once a fraudster understands them.

Sophisticated fraud operations study detection patterns. They test thresholds, rotate accounts, and adjust transaction amounts to stay beneath rule triggers. A static ruleset is, by definition, reactive: it encodes yesterday's fraud behaviour and has no mechanism to adapt when that behaviour changes.

The deeper and often underdiscussed problem is the false positive rate. Rigid rules decline legitimate transactions because their pattern superficially resembles fraud. The industry average false positive rate for rule-based systems sits at 3 to 4%. That means 3 to 4% of legitimate transactions are being declined unnecessarily. For a business processing $50M GTV annually, that is $1.5M to $2M of real revenue turned away every year, not because the customer was fraudulent, but because the detection system could not tell the difference. In many enterprises, the revenue cost of false positives exceeds the value of the fraud the system actually prevents.

Machine learning fraud detection replaces fixed rules with models trained to distinguish fraudulent from legitimate transactions at a level of precision no human-authored ruleset can replicate. The capabilities break across three areas.

ML models are trained on millions of labelled historical transactions, learning to identify signal combinations that human analysts cannot readily see. A single transaction might look clean on any individual dimension. But the combination of typing speed on the checkout form, device fingerprint, session duration, time between page loads, and a billing address mismatch can collectively create a pattern that predicts fraud with high confidence.

This is the structural difference from rules. A rule checks one variable at a time. An ML model evaluates dozens of contextual signals simultaneously and weights them against each other. More importantly, ML models generalise: they identify new card not present fraud patterns even when those patterns do not match anything in the training data exactly. The model learns the shape of fraud, not just its most recent instances.

Every transaction is assigned a risk score in real time, typically within 50 milliseconds of the transaction request. That score is calculated from dozens of contextual signals evaluated simultaneously, and it determines the system's response.

The commercial advantage lies in the three-tier output. High-risk transactions are automatically declined or flagged for human review. Low-risk transactions are approved without additional friction for the customer. Medium-risk transactions can trigger step-up authentication via 3DS rather than a binary approve or decline decision. A system that only approves or declines leaves money on the table. Step-up authentication recovers borderline transactions from legitimate customers while maintaining fraud controls.

Every confirmed chargeback, every successful dispute resolution, and every fraud report feeds back into the model. The system improves continuously, adapting to new fraud vectors without manual rule updates. This is why chargeback prevention tools built on ML outperform rule-based systems over time rather than degrading as fraud patterns evolve. Fraudsters can learn to circumvent a static ruleset. They cannot easily crack a model that updates continuously from real outcomes.

Most vendors selling fraud detection use the same language: real-time, AI-powered, multi-signal. The questions below cut through the terminology and focus on what is measurable.

What is your current false positive rate, and how is it measured? A vendor who cannot answer this precisely is not tracking outcomes. This single figure determines the commercial impact of their system on your revenue. A rate above the 3 to 4% industry average means the system is costing you money even when it is working as designed.

How many data signals do you evaluate per transaction? More signals produce greater precision. A system evaluating fewer than 20 signals per transaction is a basic implementation. Enterprise-grade ML systems evaluate significantly more, combining behavioural, device, network, and transaction-history signals into a single risk score.

How quickly does your model update to new fraud patterns? The correct answer is continuously. Quarterly rule reviews indicate a rule-based or semi-manual system. That cadence means every new fraud vector has at minimum one quarter to operate before the system responds.

How do you handle friendly fraud? Friendly fraud, where a customer disputes a legitimate purchase, cannot be resolved by detection ML alone. Ask specifically about the evidence collection and dispute management workflow. This is where many vendors fall short, and where unmanaged chargeback rates compound.

What is the SLA for fraud query resolution, and who do I contact when a legitimate transaction is blocked? A named escalation path and a defined SLA are signs of a mature operation. A ticket queue with a 72-hour response window is not adequate for an enterprise processing high-volume card-not-present transactions.

Onerway's OnerShield is an ML-driven fraud intelligence layer built to answer all five questions clearly. It analyses multiple data points per transaction in real time, maintains false positive rates below the 3 to 4% industry average, and provides direct expert access for fraud query resolution rather than a generic support queue. For enterprises running high-volume payment fraud prevention across card-not-present transaction flows, that combination of precision and operational accountability is the relevant benchmark.

The cost of fraud is not fixed. It is determined by the quality of the detection infrastructure a business runs, and in 2026, the gap between ML-based systems and legacy rule-based approaches is measurable in both chargeback rates and lost legitimate revenue.

Onerway is built for enterprises that need payment infrastructure with institutional depth: direct regulatory licences, a unified API, and dedicated support that treats payment issues as operational priorities. OnerShield is the fraud intelligence layer at the core of that infrastructure, combining real-time ML scoring with the dispute management workflow needed to address both true fraud and friendly fraud.

If any of this resonates with a challenge your business is navigating, our team welcomes a direct conversation.

Onerway's OnerShield fraud intelligence uses machine learning to protect enterprise merchants, with real-time transaction scoring, chargeback intelligence, and false positive rates below the 3 to 4% industry average.

If your current fraud infrastructure is producing high false positives or unexplained chargeback spikes, our risk team can run a fraud performance assessment.

Get in touch to arrange one.

Rule-based systems apply fixed criteria that sophisticated fraudsters learn to circumvent over time. ML models evaluate dozens of behavioural and contextual signals simultaneously and update continuously from real transaction outcomes, identifying new fraud patterns without requiring manual rule changes. The result is a higher fraud catch rate, fewer false positives, and less friction for legitimate customers.

A false positive occurs when a fraud detection system incorrectly declines a legitimate transaction. At the industry average false positive rate of 3 to 4%, a business processing $50M annually is declining between $1.5M and $2M of real revenue each year, not because of fraud, but because the system cannot distinguish the customer from a fraudster. For many enterprises, the revenue cost of false positives exceeds the value of fraud the system actually prevents.

ML-based fraud detection significantly reduces chargebacks caused by genuine fraud by identifying and blocking fraudulent transactions before they complete. However, friendly fraud, where a customer disputes a legitimate purchase, requires a separate workflow covering evidence collection and dispute management. A complete fraud solution addresses both attack types, not just transaction-level detection.

Enterprise-grade ML fraud models update continuously, incorporating data from every confirmed fraud outcome, chargeback, and dispute in real time. Systems that rely on periodic rule reviews are structurally reactive: by the time the rules are updated, the fraud vector has already caused measurable loss. Continuous learning is the operational standard for fraud infrastructure at enterprise scale.

The most important questions target measurable outcomes: What is your current false positive rate and how is it measured? How many data signals do you evaluate per transaction? How quickly does your model adapt to new fraud patterns? How do you handle friendly fraud disputes? What is the SLA for resolving incorrectly blocked transactions? A vendor who cannot answer all five questions precisely is not operating at enterprise standard.