{
  "id": 8012576,
  "title": "Why a Security Risk/Fraud Score of 800 Can Mean Two Completely Different Things",
  "url": "https://urgent.news/2026/09/17/why-a-security-risk-fraud-score-of-800-can-mean-two-completely",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-17T06:21:26.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/why-a-security-riskfraud-score-of-800-can-mean-two-completely-different-things?source=rss"
  },
  "original_language": "en",
  "account": "A security risk or fraud score of 800 can have two very different meanings depending on the context. During normal operations, a score of 800 may be at the 95th percentile, indicating it is highly anomalous and potentially very risky. However, during a fraud attack where many engineered transactions are being sent to the system, the score distribution shifts upward. A score of 800 during an attack might now be at the 60th percentile, making it less anomalous and closer to average for the current environment. This is known as a \"score distribution shift,\" a well-documented issue in production machine learning systems where the inference distribution diverges from the training distribution, but here it's intentionally created by attackers. The problem arises because raw scores are only meaningful relative to the population they come from. An 85 exam score, for instance, is impressive if the class average is 60, but not if the average is 90. The grade remains the same, but the meaning changes. To address this, fraud systems should maintain a running estimate of the score distribution in real-time. Instead of blocking everything above a static threshold, a percentile-based approach asks \"where does this score rank within the current population?\" A risk score indicates how risky a transaction looks to the model, but it doesn't tell you how that transaction compares to everything else happening right now. For instance, instead of blocking everything above 800, the system could block the riskiest 2% of current traffic. This approach automatically adjusts as fraud activity inflates the score distribution, keeping false positive rates manageable without manual recalibration.",
  "summary": "Static fraud thresholds can fail when score distributions shift. Here's how percentile ranking keeps risk decisions aligned with current traffic.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}