Fraud Screening Tools: Build In House or Buy One?

Choosing between in-house fraud screening and a third-party tool like Sift or Kount usually gets argued on detection rates. That's the wrong axis. The question that decides it is whether your setup can still produce the evidence you need to win a dispute six months later, and most teams find out the answer too late.

We're not going to compare vendor feature lists. We can't verify those claims, and they change. What we can do is set out the rules both options have to satisfy.

Blocking Fraud and Winning Disputes Are Different Jobs#

A fraud tool decides whether to accept a transaction. A dispute decides whether you keep the money months afterwards. Those run on different data, and a system optimised only for the first can quietly ruin the second.

Under Visa's Acquirer Monitoring Program the ratio that matters combines fraud and disputes into one count-based measure over card-absent volume (Visa). Blocking more transactions lowers the fraud half. It does nothing for the dispute half, and if your screening is aggressive enough to annoy real customers it can raise it.

Our guide to calculating your true chargeback ratio covers how that measure actually works.

The Requirement That Should Drive the Decision#

Visa's Compelling Evidence 3.0 remedy lets you defeat a friendly fraud dispute by showing the same card made two previous undisputed purchases from you more than 120 calendar days earlier, matched by device or network identifiers.

The rules are unusually specific about the form that evidence takes (Visa Core Rules, 18 April 2026). A customer account or login ID "must be a unique identifier that the Cardholder uses to authenticate on the Merchant's e-commerce site or application at the time of the Transaction, and must be a value that the Cardholder recognizes in clear text and not hashed." A device ID "must be at least 15 characters, in clear text, and not hashed." A full delivery address must carry street, city, state or province, postal code and country, also in clear text.

Clear text and not hashed, stated three times.

Now hold that against how fraud systems normally work. Hashing identifiers is standard, sensible engineering. Many third-party services are designed to minimise the personal data they retain, which is good privacy practice and often a contractual commitment. Both instincts can leave you unable to produce qualifying evidence.

So the real build-versus-buy question is: who holds the raw identifiers, in clear text, for at least the retention window a dispute needs? Ask that before you ask about detection rates.

What Each Option Is Actually Good At#

In-house screening gives you the data. You keep the raw identifiers, you decide retention, and you can assemble a CE3.0 file without asking permission. You also own the whole burden: rule writing, tuning, keeping up with attack patterns, and the PCI scope that comes with handling more data yourself. Our PCI DSS guide covers what that scope means.

Third-party tools give you pattern data across many merchants, which is genuinely something you cannot reproduce alone. A network that has seen a card testing campaign at other merchants can stop it at yours on first contact. What you give up is control over what's stored and in what form, and sometimes the ability to export it in a usable state.

Most sensible setups are both. Buy the detection, keep your own record of the identifiers Visa names. Those aren't in conflict, but it only happens if someone decides it deliberately.

Questions to Ask a Vendor#

Five that get past the demo:

1. Which identifiers do you store in clear text rather than hashed?
2. Can I export device ID, device fingerprint, IP address, login ID and delivery address for a specific past transaction, in a form I can submit as dispute evidence?
3. How long is that retained? Disputes arrive months after the sale, and CE3.0 depends on transactions more than 120 days old.
4. Do you support Visa Secure with ECI 7 and CAVV, since that route allows a purchase order number instead of a full description?
5. What happens to my data if I leave?

Question two is the one that separates a fraud product from a dispute-capable one.

What Actually Moves the Ratio#

Whichever way you go, the same controls do the work, and several aren't fraud tools at all.

3-D Secure shifts fraud liability on qualifying card-absent transactions and produces the ECI and CAVV values that matter later.

Address and card verification checks are cheap and remain the baseline for card-absent sales.

Velocity limits catch card testing, which targets low-priced items precisely because small charges attract less attention.

A recognisable billing descriptor prevents disputes outright. Visa requires the merchant name to be used consistently across receipts, authorizations, clearing records and dispute records, and it prevents more disputes per dollar than any screening rule.

Pre-dispute alerts let you refund before a chargeback is recorded, which keeps the event out of the ratio rather than merely winning it later.

The layered approach is in ecommerce fraud prevention.

The Cost Nobody Models#

False positives don't appear on any dashboard as a loss, which is why over-tuned screening survives so long.

A declined good customer costs you the margin on that sale, quite possibly the customer, and nothing in your fraud reporting records it. Meanwhile the fraud number looks excellent, so the system appears to be working.

If you're in a category where approval rates are already under pressure, that trade is worse than it looks. High risk merchants usually cannot afford to buy a lower fraud rate with a lower approval rate.