At a glance
- Did you know
- Fraud models score each transaction in milliseconds from behaviour and history.
- Rule of thumb
- Decide in advance what happens when scoring times out: allow or decline.
- Watch out
- Model latency on the checkout path; false declines cost sales.
Its settings in ScaleMySystems
What you can change on it in the lab, and what each number does.
- Concurrency (slots)
- Calls it can work on at once (per instance when autoscaling). Needed slots ≈ calls per second × seconds each takes. Extra calls wait in the queue, then are rejected.
- Queue capacity
- Calls allowed to wait for a free slot. A bigger queue absorbs bursts but adds waiting time; 0 rejects straight away.
- Latency (p50) (ms)
- Typical time one call takes here, before any calls it makes itself. Slots are held for this long.
- Latency (p99) (ms)
- The slowest 1% of calls. Callers must set their timeout above this or they cut off healthy calls.
- Attack block rate
- Share of the attacks it covers that it stops. The rest pass through and are served like real users.
- False positives (real users blocked)
- Share of real users it wrongly blocks. Stricter rules raise the block rate and this together.
Problems that start with it
- Stripe: from launch build to real traffic A payments API on its first servers: no charge status cache, and the charges API, status API, fraud scoring, ledger and webhook delivery workers at an eighth of their real size. 1,500 requests a second: 70% charges that must never apply twice, 30% status checks. About half of all requests fail.
Full lesson coming soon
Lessons are being added one component at a time: how it works, its settings, a live exercise to break and fix it, interview questions and a short check. See the Circuit breaker lesson for what one looks like.