Fail open: why a fraud system's outage should never decline a card
An anti-fraud layer that sits inside card authorisation needs a rule for when it fails. Why 0Fraud fails open, and how issuers keep visibility when it does.
Your processor asks 0Fraud before it answers the card network. That is what lets us stop a fraudulent payment before it moves. It also means that if we are slow, broken or unreachable, a genuine cardholder is standing at a till waiting on us.
Our answer is a rule with no exceptions: when 0Fraud can't decide in time, the payment is approved.
What fails open
Every decision runs against a hard deadline. If it isn't finished, the adapter answers approve. The same happens on an internal error, on a message we can't parse, and on a call we can't verify. In each case the payment goes through exactly as it would have without 0Fraud.
Nothing is lost quietly
An approval we gave without deciding is still recorded, with the reason. Issuers can read a live count of these by processor and reason, and we alert on any of them. Protection pauses, never the card, and you always know when it paused.
Why not the other way
Many systems decline when a decisioning service times out. For an anti-fraud layer, that is the wrong default. A declined genuine payment costs the issuer a customer's trust and costs the cardholder their afternoon. We would rather miss one fraud attempt during an outage than decline thousands of real people.