Risk-based routing is a payment routing method that uses each transaction's fraud risk score to decide which acquirer processes it, whether 3-D Secure is requested and whether an SCA exemption is claimed. Low-risk payments take the cheapest path, high-risk ones the most protective. A fraud engine scores device, IP and billing mismatch, BIN, basket value, account age and velocity before authorization, and the routing engine applies bands: exemption below 20, full 3DS between 20 and 70, decline or manual review above 70. Exempted fraud stays with merchant or acquirer, and PSD2 standards allow transaction risk analysis exemptions only while an acquirer's fraud rate stays under 0.13% up to €100, 0.06% up to €250 and 0.01% up to €500.
What is risk-based routing, compared with other routing
Most routing logic optimises for approval rate or cost. Cost-aware routing picks the cheapest acquirer, and geo routing picks a local one. Risk-based routing adds a third axis. It does not replace the others, it sets constraints on them, so a high-risk transaction may never be offered to an acquirer with a thin fraud tolerance even if that acquirer is cheapest.
How does risk based payment routing work
A fraud engine scores the transaction before authorization, using device fingerprint, IP and billing country mismatch, card BIN, basket value, account age and velocity of attempts. The routing engine then reads the score against thresholds.
A typical three-band setup for an EEA merchant:
- Score below 20: request an SCA exemption under transaction risk analysis and route to the primary acquirer for a frictionless authorization.
- Score 20 to 70: request full 3DS authentication, accepting a possible challenge, to move chargeback liability to the issuer.
- Score above 70: decline outright, or send to manual review before any authorization.
Payment routing by transaction risk, with numbers
Take 100,000 monthly transactions. If 70% fall in the low band, and exemption requests raise their approval rate from 88% to 92%, the merchant recovers 2,800 sales a month. The trade-off is liability: exempted transactions that turn out fraudulent stay with the merchant or acquirer, so the low band must be tuned to keep fraud within limits.
Those limits are not only internal. Under the PSD2 technical standards, an acquirer can grant transaction risk analysis exemptions only if its own card fraud rate stays under 0.13% for payments up to €100, 0.06% up to €250 and 0.01% up to €500. Route too many risky payments to the exemption path and the acquirer loses the right to use it.
Risks and design choices
Scores drift. A model trained before a new fraud pattern will pass bad traffic into the low band, so routing thresholds need a feedback loop from chargeback data, which arrives weeks later. Most teams run new thresholds on a slice of traffic first, the same method used in A/B routing.
Risk-based routing is usually one rule set inside a broader routing rules engine, alongside cost and capability rules.