Cost effective fraud prevention can often be a balancing act. Businesses that deal in large numbers of transactions, such as insurance companies or online retailers, will try to automate as much of the system as possible.

In many insurance companies, for example, the majority of outpatient medical claims are never seen by a claims examiner. Data from a claim form is entered into a claims system and the claim then enters “auto-adjudication,” which is a fancy way of saying the computer decides if the claim is paid or not and how much. However, if certain criteria are met, the claim will be passed on to an actual person. There are many reasons for this. Sometimes this is because a claim is too complicated for the computer or the form was not filled out right.

Sometimes, however, it is because the computer has smelled something fishy. The computer is programmed to look for red flags. Some diagnosis codes or procedure codes are especially prone to be abused. There is also a dollar threshold. Any claim above a certain dollar amount will automatically be sent to a live person.

Retailers do the same thing. They set a dollar threshold and pass any order below that amount. The reason is simple. A ten, twenty-five, or even fifty dollar purchase may not be worth the time and effort it takes to investigate. The time it takes someone to call a bank or customer to verify that a purchase is legitimate costs the seller money in the form of that investigator’s salary. Time that could be put to better use. An investigation can easily cost more than the value of the purchase.

If a fraudster can learn that threshold amount, he can place order after order with little risk. Unless a fraudster has access to an insider’s knowledge (which happens), the only way to discover this “sweet spot” is trial an error.