What a threat intelligence provider actually does for payment fraud

A threat intelligence provider is a company that collects, analyzes, and sells information about fraud patterns, stolen payment data, and criminal networks targeting businesses. They do not stop fraud themselves—they give you data so your team can. For payment fraud specifically, they track things like compromised card numbers circulating on the dark web, known phishing domains targeting your industry, and patterns in how criminals test stolen cards before making large purchases.

The core question is whether their data will actually reduce fraud losses at your business. That means understanding what they collect, how fresh it is, whether it covers the fraud types that hit you hardest, and whether their format works with your existing systems. A provider that excels at detecting account takeover may be useless if your main problem is synthetic identity fraud. One with excellent data but a three-week reporting lag will not catch real-time card testing.

Most providers fall into a few categories: those who monitor the dark web and underground forums, those who track payment networks and card processor data, those who analyze phishing and malware, and those who combine multiple sources. Each has different blind spots and different price tags.

Key Takeaways

  • Threat intelligence providers sell data and analysis, not fraud prevention—you still need your own detection rules and response team to act on what they tell you.
  • The best provider for your business depends on which fraud types cost you the most money, so audit your actual fraud losses before comparing vendors.
  • Data freshness matters more than volume: a provider reporting stolen cards within hours is more useful than one reporting thousands of cards a week with a two-week lag.
  • Verify that their data format integrates with your payment system, fraud detection software, or manual review process before signing a contract.
  • Ask for references from businesses similar to yours in size and industry, and ask those references specifically whether the provider reduced their fraud rate.

Start by mapping your actual fraud losses

Before you talk to a single vendor, spend a week or two pulling your own fraud data. Break it down by type: card-not-present fraud, account takeover, synthetic identity, friendly fraud, card testing, and anything else that shows up in your chargeback reports or internal fraud logs. Calculate the dollar loss for each category over the past six months or a year.

This number is your baseline. A provider that claims to reduce card-not-present fraud by 30 percent means nothing if card-not-present fraud is only 5 percent of your losses. If 60 percent of your fraud is account takeover, you need a provider strong in that area, even if their card-testing detection is weak.

Also note the timing of your fraud. If most of your losses happen within the first 24 hours after a card is compromised, you need real-time or near-real-time data. If your fraud is spread across weeks or months, a provider with a weekly reporting cycle may be sufficient. The timing affects both which provider you choose and what you can realistically do with their data.

Evaluate data sources and how current they are

Threat intelligence providers get their data from different places, and the source determines both accuracy and speed. Some monitor dark web marketplaces and forums where criminals buy and sell stolen card data. Others have relationships with payment networks, card processors, or banks that feed them compromised card information. Some track phishing domains and malware distribution networks. The best providers combine multiple sources, but no provider has everything.

Ask each vendor directly: Where does your card data come from? How do you know it is accurate? How long after a card is compromised does it appear in your system? If they say "within 24 hours" but your fraud happens in the first 2 hours after compromise, their data arrives too late to help. If they say they monitor dark web forums but cannot explain how they verify the data is real and not honeypots or scams, be skeptical.

Cross-check their claims. If a provider says they have 50 million compromised cards in their database, ask how many are from the past 30 days versus the past year. Old data is less useful. Ask whether they deduplicate—if the same card appears in ten different breaches, do they count it once or ten times? A vendor inflating their numbers with duplicates is wasting your money.

Test whether their data actually integrates with your systems

Data is only useful if you can act on it. Before you commit to a provider, confirm that their output format works with your setup. Some providers deliver data via API that your fraud detection software can query in real time. Others send daily or weekly CSV files via email or SFTP. Some require you to log into a portal and manually check each card. The format determines how fast you can respond and how much manual work your team does.

If you use a fraud detection platform like Kount, Sift, or Feedzai, check whether the provider has a pre-built integration. If not, ask your fraud platform whether they can ingest the provider's data format. If the answer is no, you are looking at manual review or custom development, both of which slow you down and cost money.

Also ask about volume and rate limits. If a provider can send you 1,000 card checks per day but you process 50,000 transactions daily, their API will bottleneck your system. If they charge per API call and you have high transaction volume, the cost may be prohibitive. Get the numbers in writing before you sign.

Compare pricing models and what they actually cover

Threat intelligence pricing varies widely. Some providers charge a flat monthly fee for access to their database. Others charge per query or per card checked. Some charge based on transaction volume. Some charge for different data tiers—basic card data is cheaper, but adding geolocation intelligence, device fingerprinting, or behavioral analysis costs more.

The cheapest option is rarely the best. A provider charging $500 per month for unlimited card checks may be cheaper than one charging $0.01 per check if you run millions of checks monthly, but the opposite is true if you check only a few thousand cards. Calculate your expected usage and get a quote from each vendor based on your actual volume.

Also clarify what is included in the base price and what costs extra. Some providers include historical data but charge for real-time feeds. Some include card data but charge separately for phishing domain lists or malware signatures. Some include basic reporting but charge for custom dashboards or API access. Read the contract carefully—the cheapest line item often hides expensive add-ons.

Ask for proof that they reduce fraud at similar businesses

Vendors will claim their data reduces fraud, but claims are cheap. Ask for references—specifically, businesses similar to yours in size, industry, and fraud profile. Then call those references and ask: Did this provider actually reduce your fraud rate? By how much? How long did it take to see results? Would you recommend them?

Be specific in your questions. "Did they help?" is too vague. Ask: "What was your fraud rate before and after?" "How much of that improvement came from this provider versus other changes you made?" "Did the data integrate smoothly with your systems, or did you need custom work?" "How responsive is their support when you find bad data or have questions?"

If a vendor cannot provide references, or if their references are vague or defensive, that is a red flag. A provider confident in their product will connect you with happy customers who can speak specifically about results.

Verify their data quality and error handling

Even the best threat intelligence providers make mistakes. They may flag a card as compromised when it is not. They may miss a card that is actively being used in fraud. They may have false positives in their phishing domain lists. The question is not whether they make mistakes—they do—but how they handle them and how often it happens.

Ask: What is your false positive rate? How do you measure it? If a customer reports that a card you flagged is legitimate, how do you investigate and correct it? Do you have a process for removing data that turns out to be inaccurate? How long does correction take?

Also ask about their data retention and deletion policies. If a card is compromised and then reported safe, when do they stop flagging it? If a phishing domain is taken down, when do they remove it from their list? If they keep flagging old data long after it is no longer relevant, you will waste time on false positives.

Understand what you still have to do yourself

Threat intelligence is one input to fraud detection, not a complete solution. Even with the best provider, you still need to decide what to do with their data. If they flag a card as compromised, do you decline the transaction, ask for additional verification, or just monitor it? Different businesses make different choices based on their fraud tolerance and customer experience priorities.

You also need a process for acting on the data. If a provider sends you a list of 10,000 compromised cards every week, someone on your team has to load that list into your system, check it against your customer database, and decide what action to take. If you do not have that process in place, the data sits unused.

Finally, threat intelligence is most effective when combined with your own fraud detection rules, customer behavior analysis, and manual review. A provider that tells you they will solve all your fraud problems is overselling. A provider that tells you they will give you better information to make your own fraud decisions is being honest.

Frequently Asked Questions

How much does a threat intelligence provider cost?

Pricing ranges from a few hundred dollars per month for small businesses to tens of thousands per month for large enterprises. Most charge either a flat monthly fee, a per-query fee, or a percentage of transaction volume. Get a quote based on your specific usage before comparing vendors.

Can a threat intelligence provider stop fraud before it happens?

No. They provide information about fraud patterns and compromised data, but your team has to decide what to do with that information. They can help you decline risky transactions or flag them for review, but the decision and the action are yours.

What if a threat intelligence provider flags a legitimate card as compromised?

Ask the vendor about their dispute process before you sign. Most have a way to report false positives and remove cards from their database, but the speed and ease of that process varies. Check their response time in your contract.

Do I need a threat intelligence provider if I already use fraud detection software?

It depends on what your fraud detection software does. Some platforms include threat intelligence feeds built in. Others work better when you add external data. Ask your fraud platform vendor whether they recommend supplementing with an external provider, and if so, which ones integrate well.

How do I know if a threat intelligence provider is actually reducing my fraud?

Compare your fraud rate before and after implementation, but account for other changes you made at the same time. If you also added a new verification step or changed your rules, you cannot attribute all improvement to the provider. Ask your vendor to help you isolate their impact.