The calibration pass: relax the seasonal false-positive generators (address mismatch in gift season, first-order flags when first-orders are the majority), tighten the genuine peak threats (card-testing velocity, gift-card rules, reshipper destinations), and size the review queue against forecast flag volume — because a queue that overflows gets bypassed, and a bypassed queue is no queue. Calibrate now, freeze by mid-November, touch nothing during the event.
What to relax
Seasonal false-positive generators:
- Billing≠shipping flags: gift season makes mismatch the majority pattern. Demote to near-zero weight unless combined with billing-side failures.
- First-order weighting: when ad scaling makes first-orders 80% of volume, 'new customer' can't carry standalone flag weight — the queue drowns.
- Value-threshold reviews: holiday AOVs run higher (gifts, bundles); a static dollar threshold flags normal December carts. Index to seasonal AOV.
Relaxing means reweighting within combinations — not deleting. Mismatch + AVS-fail still fires; mismatch alone stands down for the season.
What to tighten
Genuine peak threats:
- Card-testing velocity: attackers ride peak cover. Lower burst thresholds, pre-arm the response runbook.
- Gift-card rules: peak gift-card demand is peak gift-card fraud. Velocity caps down, delivery delays on flags up.
- Reshipper/forwarder destinations: resale-fraud season for electronics and luxury — full weight, no seasonal discount.
- Post-order reroute requests: the upgrade-attempt pattern spikes at peak. Standing policy: no address changes on flagged orders, period.
The freeze discipline
Complete calibration by mid-November, then freeze. Mid-event rule edits under pressure — loosening because the queue is full, tightening because something got through — are how both failure modes happen at once.
The queue-capacity math drives the freeze: forecast flag volume = expected orders × flag rate; review capacity = staff-hours × 90 seconds per order. If those numbers don't meet, fix it now — with calibration or capacity, not with a November bypass. Aurai Prevent runs outcome-trained scoring that doesn't need seasonal hand-tuning — the model sees December's context in the data — which is the durable answer to the annual recalibration ritual.
Frequently asked questions
Should fraud rules be looser or tighter during BFCM?
Both, surgically: relax seasonal false-positive generators (gift-pattern mismatches), tighten peak threats (card testing, gift cards, reshippers). Blanket moves in either direction fail.
When should BFCM fraud rules be finalized?
Mid-November, then frozen. Mid-event edits under pressure produce the worst of both failure modes — plan the calibration, then trust it.
Post reflects public documentation and industry surveys as of the publish date. Win rates and other figures are indicative ranges, not guarantees and not Aurai results; outcomes vary by merchant, evidence, and issuer. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.