A large number of e-commerce shops still rely on heuristics (rules of thumb) to manage their fraud risk. Accertify is a major software vendor in the e-commerce space and their framework doesn't incorporate machine learning. Their sales pitch is that they give tons of flexibility to write a rule that adds or subtracts point from the score. My response was always how do I know how many points this rule should be? Once you look under the hood at most shops you see that everything is + or - 1 million and essentially the scoring engine becomes a simple pass/fail engine.

The super-majors like Amazon are heavy into machine learning and rebuild some of their models daily. But even with their prowess they still had a thousand people doing manual investigation a couple of years ago. One subtle signal that you have triggered their fraud system is that they will ask you to renter your card number.