Binary decisions are brittle. For payments that are neither clearly safe nor clearly fraudulent, Stripe uses a "soft block." This triggers a 3DS authentication step, allowing legitimate users to proceed while stopping fraudsters, resolving ambiguity without losing revenue.

Major retailers use third-party program managers for their gift cards. When a customer is scammed, the retailer deflects responsibility, stating they don't issue the cards. This structure, combined with weak regulation, leaves fraud victims with little recourse, creating an "accountability sink."

Regulation E, a 1979 law, legally mandates that financial institutions bear liability for unauthorized electronic fund transfers. This forces banks to create robust, consumer-friendly dispute systems like chargebacks, making them appear responsive when they are simply complying with strict federal rules that protect consumers.

Regulation E mandates that if a bank denies a fraud claim, it must provide a written explanation and supporting documents. This procedural rule is a powerful tool for consumer advocates, effectively forcing the bank's own staff to build the case file for consumers who lack their own records.

Unlike other tech verticals, fintech platforms cannot claim neutrality and abdicate responsibility for risk. Providing robust consumer protections, like the chargeback process for credit cards, is essential for building the user trust required for mass adoption. Without that trust, there is no incentive for consumers to use the product.

Affirm's CEO argues the core flaw of credit cards is not high APRs, but a business model that profits from consumer mistakes. Lenders are incentivized by compounding interest and late fees, meaning they benefit when customers take longer to pay and stumble.

Unlike debit cards protected by Regulation E, gift cards are intentionally exempted from strong consumer protection laws. This carve-out, lobbied for by retailers to ease commerce, removes the legal requirement for financial institutions to investigate fraud and reimburse victims, shifting the entire loss to the consumer.

Purely model-based or rule-based systems have flaws. Stripe combines them for better results. For instance, a transaction with a CVC code mismatch (a rule) is only blocked if its model-generated risk score is also elevated, preventing rejection of good customers who make simple mistakes.

While 10% of Meta's revenue comes from fraud, the company's anti-fraud team was blocked from taking any action that would impact more than 0.15% of total revenue. This minuscule 'revenue guardrail' was an explicit internal directive to ensure anti-fraud efforts would not succeed.