Fraud propensity scores

Detects fraud propensity score outputs: a fraud score / fraud risk score phrase combined with populated scoring data - rows keyed by a transaction or account identifier, labelled fraud scores, decisions or reason codes, or labelled account/transaction identifiers. Phrase-only mentions stay discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Enforce tiers require populated dataset structure (a data row keyed by a customer/record identifier, a labelled value or a labelled identifier) beside the topic phrase; a column header on its own only counts toward 85, so blank extracts stay at 65. Help pages, policies, product copy and news that only name the topic stay at 65. Medium because fraud-operations runbooks and internal analytics documentation with worked examples can still reach 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
Frameworks: ISO 27001, ISO 27701
Data categories: pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:fraud\s+(?:propensity|risk|probability|model)\s+scores?|fraud\s+scores?|fraud\s+scoring\s+(?:outputs?|results?|exports?)|risk[\s-]scored\s+transactions?|transaction\s+risk\s+scores?)\b

Corroborative evidence keywords

device fingerprint, velocity, mule account, account takeover, chargeback, card not present, geolocation mismatch, new payee, rule hit, step-up authentication

Proximity: 300 characters

Should match

Fraud risk scores - card-not-present queue 12/09/2026 txn_id,account_id,amount,fraud_score,decision,reason_codes T88120441,A4471820,1890.00,0.94,decline,R07|R12 T88120452,A4471820,15.00,0.31,approve, Device fingerprint mismatch and velocity rule hit on new payee. — Scoring extract - header, transaction rows and fraud-signal evidence (85)
Fraud score review Customer ID: A4471820 Held pending call with the customer. — Single labelled customer identifier (75)
Fraud case note - transaction risk score alert Transaction ID: PAY-20260915-77812 Account number: 30418826 Fraud score: 912 Decision: step-up Reason code: R14 Analyst note: login from new device with geolocation mismatch, followed by a new payee added 4 minutes before a $9,800 transfer. Suspected account takeover; customer contacted. — Analyst case note with labelled transaction/account IDs, fraud score, decision and reason code plus account-takeover evidence (85)

Should not match

Policy guidance: fraud scores range from 0 to 1000 and transactions above the threshold go to manual review. Analysts must document the reason for every override. — Fraud-operations guidance
Fraud scoring output txn_id,account_id,amount,fraud_score,decision — Blank extract - column header only (65)
Banks said fraud scores now flag 30% more scams before payment, according to a news report. — News item
unrelated generic text without domain phrases — Unrelated
customer invoice — Generic word pair

Known false positives

Privacy notices, help-centre articles, product pages and policies describing fraud scoring. Mitigation: They name the topic without populated rows, labelled values or identifiers, and guidance/help framing is excluded, so they stay at 65.
Analytics training material and documentation with worked examples of fraud scoring. Mitigation: Training and template framing is excluded; unframed worked examples with realistic rows can still reach 75.
News and industry commentary with aggregate statistics. Mitigation: Aggregate percentages are not keyed to a record identifier, so they do not satisfy the row or labelled-value structures.