"What threshold should I set?" gets answered with a number far too often. Any number given without knowing the flow is someone guessing on your behalf.
The score is identical everywhere in your product. What changes is what a mistake costs.
Wrongly blocking a newsletter signup costs you an email address. Wrongly blocking a password reset costs you a customer who already pays you, cannot get into their account, and now needs support. Same score, completely different arithmetic — and any single cutoff is wrong for one of them by construction.
Two things I would argue for:
Work out the exchange rate before the number. How many real customers will you turn away to stop one bad signup? You do not need precision, but you need to know which way it leans, and that falls out of the two costs rather than out of a vendor's docs.
Three bands, not two. One line forces every borderline case into one of two wrong answers, and borderline is exactly where real customers and attackers overlap. A middle band routes ambiguity to a step-up — an emailed code, an SMS — which is cheap when you are right and recoverable when you are wrong.
The part I find most people have not solved: how do you measure the mistake you cannot see? Fraud that gets through arrives as a chargeback. A customer wrongly refused closes the tab, and nothing in your dashboard records they existed.
How are you counting that one?
Top comments (0)