Most fraud management programs do a reasonable job answering one question: where is fraud happening right now? Transaction dashboards can point to the merchant categories where losses are concentrated, the channels where chargebacks are climbing, and the geographies that keep showing up in postmortems.

But that picture, on its own, leaves a much harder question unanswered: which specific cards in your portfolio are most likely to go fraudulent next?

Without an answer, fraud teams are stuck dealing with multiple issues simultaneously. They reissue entire batches of cards after a suspected compromise, tighten rules in ways that frustrate good cardholders, and open investigations only after losses have already started to clear

Card-level risk scoring is what changes that. It shifts the unit of analysis from the merchant or category to the individual card, so your team can focus on the cards most likely to be involved in fraud.

What Does Card-Level Risk Scoring Mean?

A card-level risk score is a probability assigned to a single payment card that shows how likely it is to experience fraud within a defined forward-looking window. It is not the same as a transaction score, which evaluates a single purchase as it happens. It is also not a merchant score, which tells you about the seller rather than the cardholders in your portfolio.

A well-built card-level score draws on several signals at once:

• Compromise Exposure. Has the card been used at a merchant known to have been breached? If so, how many times, and did those purchases happen while the breach was still active?
• Behavioral Patterns. Does the card show transaction monitoring patterns associated with cards that later experienced fraud, such as unusual velocity, geographic changes, or an unusual mix of merchants?
• Network-level Signals. Has the card shown up on cross-institutional indicators that no single institution could detect on its own, such as appearance in a fraud ring's known transaction footprint?
• Historical Risk. Has this card been previously compromised, and how does its post-event behavior compare with other recovered cards?

The output is a score that the fraud management team can act on directly: a prioritized view of the portfolio, ranked by forward-looking fraud probability.

Why Merchant Signals Alone Are Not Enough

Identifying a compromised merchant is essential, but it is only half the work. When a compromise is confirmed, an institution is often left looking at a large list of cards that transacted there, and treating all of them the same way has real costs.

Mass reissuance is an operationally expensive process that generates call-center volume and creates cardholder friction at the moments when retention matters most. Doing nothing risks letting fraud run at scale. 

Card-level risk scoring resolves this by adding a second dimension to the decision. Of the cards that transacted at the compromised merchant, which ones also show elevated risk signals? Those are the cards that justify the strongest action, whether that is reissue, step-up authentication, tighter rule thresholds, or proactive outreach. The rest can be monitored with lighter-touch controls, which keep cardholder disruption to a minimum.

This is the layered approach Rippleshot’s Sonar solution was built around. First, merchant compromise signals identify the cards that have been exposed. Then the card-level fraud forecast score ranks those cards by how likely each one is to experience fraud over the next 90 days. When used together, the two signals enable fraud teams to act with a precision that neither can deliver on its own.

The 90-Day Forward Window Matters

A score that tells you a card is risky today is useful. A score indicating a card is likely to become fraudulent within the next 90 days is preferable because it allows the institution to plan ahead.

Ninety days is a meaningful window for a few reasons:

1. It Gives Teams Room to Choose the Right Response. It gives teams room to choose the right response. A short-horizon score forces a binary decision: block or allow. A 90-day score opens up a wider set of options. The highest-risk cards can be reissued or stepped up immediately. Medium-risk cards can be flagged for closer transaction monitoring, while lower-risk cards can remain under standard controls and be revisited if conditions change.
2. It Aligns With Portfolio Planning Cycles. Fraud teams report up through risk management and internal compliance leadership on a quarterly basis. A forward-looking score that aligns with that makes it easier to communicate exposure, justify intervention budgets, and measure the impact of the actions taken.

How to Operationalize Card-Level Scoring

Adopting a card-level risk score is a significant capability shift, and the institutions that get value from it tend to follow a similar pattern.

Start With the High-Confidence Segment

Begin with the top tier of cards by forecast score. This is the segment where the model is most certain, and it is the right place to define your first playbook. Decide what happens to a card that lands there (reissue, proactive notification, or step-up authentication on certain transaction types) and apply those actions consistently. Writing the playbook down also gives internal compliance partners a clear record of how risk decisions are made.

Tier your Responses

The whole point of a score is gradation. Decide what happens at the top decile, the next two deciles, and everything below. Match the response intensity to the score level. Document the reasoning so the fraud management policy can be defended internally and refined as you learn more.

Pair the Score With Merchant Intelligence

A high-score card that has also transacted at a freshly identified compromised merchant is a different priority than one with no recent merchant exposure. Use both signals together. This is where Sonar’s combination of merchant compromise data and card-level scoring is most effective for fraud detection.

Measure What Changes

Track fraud losses, false-positive rates, reissuance costs, and call-center volume in the segments where the score is driving action versus where it is not. The case for card-level scoring is empirical and the numbers should show it.

How Card Scoring Fits Alongside Merchant Scoring

It is also important to know how card-level scoring fits with the other scoring work fraud teams are doing.

Rippleshot’s Fraud Interceptor solution applies risk thresholds to merchants, surfacing the highest-impact rules an institution should deploy based on consortium-level fraud trends. That is a merchant-side capability that changes how the institution writes and prioritizes its rules.

Sonar's fraud forecast score operates on the other side of the transaction. It scores the card, not the merchant, on its probability of experiencing fraud in the next 90 days. The two complement each other for a more efficient risk management system. While merchant scoring helps your team decide which transactions deserve more scrutiny, card scoring helps you decide which cards deserve more attention, regardless of where they next transact.

The institutions getting the most out of it tend to use both together: tighter rules at high-risk merchants, prioritized intervention on high-risk cards, and a feedback loop between the two as new fraud patterns emerge across the network.

The Bottom Line

Modern fraud does not move uniformly across a portfolio. It focuses on specific merchants, channels, and, critically, cards. Treating every card the same way after a compromise event, or relying entirely on transaction-level decisions in the moment, leaves both fraud losses and cardholder experience on the table.

Card-level risk scoring closes that gap. It gives fraud prevention teams a prioritized, forward-looking view of which cards in their portfolio are most likely to become fraudulent, enabling a precise response. Paired with merchant compromise signals and consortium-level intelligence, it is one of the highest-leverage capabilities a fraud management program can adopt this year.

Ready to see what a card-level view of your portfolio looks like? Get in touch with Rippleshot and see how Sonar’s fraud forecast score, combined with consortium-level merchant intelligence, can sharpen your fraud detection and mitigation response.