Does machine learning replace fraud rules entirely?

No. Machine learning scores each transaction on many signals and adapts as patterns move, but rules still catch the obvious cases and express the operator's own policy. The large PSPs that set the standard run models trained across their merchant base with policies on top, not instead. Human review also remains, with the models deciding which cases reach it.

Models and rules, together

Machine learning scores each transaction on hundreds of signals, device, behavior, history, network patterns, and adapts as fraud moves. Rules express things a model should not learn: the operator's policy, scheme requirements, a merchant's own constraints, a known attack to block right now. The large PSPs that set the standard run models trained across their merchant base with policies on top.

What each does well

• Models: subtle patterns, changing behavior, scoring at scale.
• Rules: clear cases, policy enforcement, immediate response to a new attack, explainability to merchants and auditors.
• People: review of borderline cases, with the model deciding which cases reach them.

For operators

Most operators do not train their own models; they use the scoring their providers and fraud tools offer, and add rules per merchant: velocity limits, BIN filters, amount thresholds, authentication policies. The platform's role is to apply those rules before routing, to feed cross-provider data back into them, and to report outcomes so rules can be tuned. The question is not model or rules, but where each sits in the flow and who maintains it.