Library · Chargebacks · How to run this
Sift payment-abuse block is not watchlist hit
From one Sift prevention cut, divide payment-abuse blocks by auth attempts. That ratio is abuse %.
Pair: Payment-abuse share on Chargebacks. Watchlist twin: watchlist-hit share. Other stack: Forter velocity-block.
What you type
Payment-abuse blocks — Sift hard blocks tagged to payment-abuse decisions in the cut.
Auth attempts — Auth attempts in that same Sift cut.
Abuse % = payment-abuse blocks ÷ auth attempts × 100. Fat abuse % usually means a hot payment-abuse rule — tune that path; never invent an abuse chip.
What not to do
Never invent abuse %. Never fold watchlist hits into payment-abuse counts. Never paste a Forter velocity export into Sift fields. Never blend MIDs when one seat owns the spike.
Related: Chargebacks, watchlist-hit share, abuse–CB overlap, Forter velocity-block.
Procedure
- Type payment-abuse blocks and auth attempts.
- Read abuse %.
- Tune payment-abuse rules when abuse % is material.
Failure modes
- Inventing abuse %.
- Folding watchlist hits into payment-abuse counts.
- Pasting a Forter velocity export into Sift fields.
Worked example
None on this page yet. When one lands it will be a real case: what broke, the number, and what changed. Not a composite.
Glossary
- Payment-abuse share %
- Payment-abuse blocks ÷ Auth attempts × 100.
Work with us — We run this job on your accounts. Services
FAQ
- Is this watchlist-hit share?
- Sibling Sift door. [Watchlist-hit share](/manuals/sift-watchlist-hit-share) is watchlist flags. This page is payment-abuse hard blocks ÷ auth attempts.
- Is this Forter velocity-block share?
- Different prevention stack. [Velocity-block share](/manuals/forter-velocity-block-share) reads Forter. Here you only count Sift payment-abuse blocks.
- What abuse % should I invent?
- None. Use payment-abuse blocks and auth attempts from the same Sift cut.