Why Indian merchants are being told to look beyond blunt fraud declines

Razorpay is urging online businesses to separate rules, risk scores and fraud detection as India’s digital fraud exposure rises and new authentication requirements approach.

Indian online businesses weighing fraud controls at checkout are being urged to look beyond simple decline rules and examine how risk is actually judged inside a payment flow. Razorpay’s blog says built-in fraud detection should be assessed separately from rule engines and risk models, because each does a different job: spotting suspicious patterns, applying explicit conditions and combining signals into a risk score or tier. The company also points merchants towards three separate product areas: Shield Risk Engine for cross-border payment risk, Risk Analytics Dashboard block rules for exporters and Magic Checkout for cash-on-delivery, or COD, and return-to-origin, or RTO, controls.

That distinction matters because a single blunt rule can miss fraud that arrives in bursts, while an over-sensitive one can push away legitimate buyers. Razorpay’s guidance argues that merchants should check which signals are visible, which actions are configurable and whether they can see the reason behind a decline. The checklist also stresses that account enablement and payment-method coverage need to be confirmed for each merchant, rather than assumed from a general product description. Similar concerns about combining rules, behavioural signals and machine learning are echoed by other fraud platforms, including MomentPay Shield and InferX, both of which position real-time scoring and behavioural analysis as central to payment risk decisions.

The broader market data suggests the problem is not theoretical. TransUnion’s H1 2026 report said India recorded a suspected digital fraud attempt rate of 7.1% in 2025, compared with 3.8% globally, although that measure covers attempted digital activity seen through the company’s intelligence network rather than confirmed payment losses. That makes the quality of a merchant’s controls crucial: businesses need to know whether they are detecting true fraud, reducing false declines or merely adding friction. DRISKO.ai, which focuses on COD commerce, makes a similar case for evaluating buyer, address, device, payment and returns behaviour together, rather than treating any single signal as decisive.

Razorpay draws a sharp line between a rule engine and a risk score. A rule engine checks for explicit conditions, such as repeated failed payments inside a set time window, while a risk model weighs available signals and produces a score or tier. The company says merchants should verify whether they can configure block rules, inspect risk levels and understand decision reasons. It also advises testing rules against labelled outcomes, approval rates and review capacity, because a high score does not by itself prove fraud and a decline is not automatically evidence of wrongdoing.

For exporters handling international payments, Razorpay says its Shield Risk Engine uses AI and machine learning to assess cross-border risk, while the Risk Analytics Dashboard allows merchant-created block rules and exposes fraud, dispute and risk-decline metrics. The company also distinguishes those tools from its Shield chargeback programme, which requires enrolment and applies only to qualifying cross-border export payments under its own conditions. That separation is important, because merchants should not assume that every product name, dashboard or score works across all payment types in the same way.

The article also places payment fraud controls within India’s regulatory framework. According to the Reserve Bank of India’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025, domestic digital payments generally require at least two distinct authentication factors from 1 April 2026, with at least one dynamic factor in cases other than card-present transactions. Separate provisions due to take effect on 1 October 2026 cover certain cross-border card transactions and add risk-based validation requirements, but they do not replace the authentication minimums. Razorpay likewise notes that additional risk checks are not a substitute for the authentication rules that apply.

COD and RTO controls need a different lens from card or UPI fraud. Razorpay says Magic Checkout can support COD allow and block rules, along with approve, hold or cancel workflows based on RTO risk levels, while its on-demand RTO Intelligence offering provides order-risk information and reasons. The company recommends keeping these controls separate from prepaid payment fraud, since an RTO event may reflect fulfilment risk rather than fraudulent intent. For merchants, the practical takeaway is to document each rule, identify who owns it, test it before enforcement where possible and review the effect on both confirmed fraud and genuine customer approvals.