Negative list / blacklist

A list of specific addresses, emails, phone numbers, or card numbers a business has flagged as tied to past fraud, used to auto-decline anything matching them again.

If a fraudster used a particular email address once, adding it to the list means the next attempt with that address gets blocked immediately.

A merchant-maintained or shared registry of attributes previously linked to confirmed fraud, checked against new transactions to trigger automatic rejection rather than routing to a model or manual review.

A negative list typically works like this:

1. A case is confirmed as fraud.
2. The associated attributes, such as an email, a device, a card number, or an address, are added to the list.
3. New transactions are checked against the list.
4. A match triggers an automatic decline.

Lists can hold several kinds of attributes:

• Contact details, such as emails, phone numbers, and addresses.
• Payment details, such as card numbers.
• Technical identifiers, such as devices and IP addresses.

Lists can be private to one business or shared across organizations, which gives each member visibility into fraud that others have confirmed.

The approach has known weaknesses:

• It only catches repeats, since an attribute must be seen once before it can be listed.
• Fraudsters rotate details, so a listed attribute may never appear again.
• Details can be reused by innocent people, such as a reassigned phone number or a shared address, which creates false positives.
• Lists go stale, so they need expiry dates and regular review.

A negative list sits next to terms that are easy to mix up:

• Whitelist or approve list is the opposite, a list of trusted details that skip extra scrutiny.
• Watchlist is a register of sanctioned or high-risk parties used in compliance screening.
• Fraud ring is a coordinated group whose shared details can be added to a list.