Cutting millions in payment fraud with operational AI

PayPal is one of the world’s leading digital payments platforms, operating in more than 200 countries and regions. In 2025, the company processed $1.8 trillion in total payment volume across 25 billion transactions and had over 400 million active consumer and merchant accounts.

For PayPal, fraud prevention is part of the customer experience. The platform must protect buyers and sellers while allowing legitimate transactions to move forward with as little friction as possible.

To keep legitimate transactions moving with minimal friction, PayPal needed fraud calculations to complete within a defined decision window. PayPal completed 98.5% of calculations within that window. The remaining 1.5% ran late. A late calculation could force PayPal to choose between allowing a potentially fraudulent transaction to proceed and interrupting a legitimate one while the decision was completed.

Keeping decisions aligned with current reality

PayPal’s risk platform evaluates activity across the customer journey, including login, account updates, wallet changes, purchases, transfers, and withdrawals. Each interaction can change the state against which the next decision must be made.

A decision may need to combine historical behavior with recent events, counters, decay variables, device and account information, and relationships among customers, merchants, and transactions. Multiple models may run in sequence or in parallel before PayPal returns a decision.

Volatile and adversarial fraud patterns

Fraud patterns shift rapidly as attackers use account takeover, identity fraud, coordinated activity, and high-velocity transaction chains. PayPal must continuously incorporate new signals and changing behavior while keeping legitimate customer interactions fast and predictable.

PayPal also needed the decisioning data layer to respond quickly enough to support a responsive customer experience.

Scaling fraud decisioning economically

As data volumes grew, PayPal’s previous in memory architecture created increasing cost pressure. Scaling purely in RAM was becoming economically inefficient, while the risk platform needed consistent access to a very large and continuously changing data set.

PayPal needed to keep current risk context available inside the decision window, sustain rapid growth, and improve the economics of operating its fraud infrastructure.

PayPal built a homegrown, end-to-end risk and predictive-AI platform that combines real-time decisioning, near-real-time event processing, and offline analytics. Aerospike supports the operational data layer that keeps current risk context available inside the decision window.

Real-time data for fraud decisioning

Aerospike serves as the operational intelligence platform for real-time feature access and model execution. Its low latency primary key access helps PayPal retrieve the information needed for a decision, while its hybrid memory architecture (HMA) lets PayPal use memory and SSD together.

The new platform delivers P95 latency under 1 ms and P99 latency under 4 ms in the real-time data layer while supporting approximately 1 PB of data and about 30 billion decisioning queries per day.

When a customer clicks “Pay,” the platform retrieves historical risk features, incorporates recent behavioral signals, evaluates counters and decay variables, executes multiple predictive models, and returns a decision within the required window. The resulting event and decision then update the context available to subsequent decisions.

Consistent performance across a distributed deployment

PayPal’s deployment spans multiple geographic regions and supports real-time decisioning, caching, and near-real-time data processing. Strong consistency and cross-datacenter replication (XDR) help maintain reliable risk decisions and availability across the environment.

The deployment spans more than 2,400 nodes across two geographic regions. It supports peak throughput of 200M queries per second (QPS) and 99.999% availability across clusters.

Scale for real-time predictive AI

Across the broader risk infrastructure, the platform processes approximately 60B queries per day and approximately 25B computations per day.

PayPal’s approach strengthened fraud prevention while improving the economics and predictability of operating its risk platform at global scale.

Business outcome

PayPal improved the share of fraud-detection calculations completed within the required time window from 98.5% to 99.95%, reducing the share that missed the target from 1.5% to 0.05%. That represents a 97% reduction in calculations that missed the time window. PayPal also reported reducing fraud losses to approximately $0.175 per $100 in transactions.

Infrastructure efficiency

By using HMA to combine memory and SSD, PayPal projected $9M in hardware savings, reducing the estimated hardware cost from $12.5M to $3.5M. The case study also reported an 80%+ reduction in total cost of ownership over five years and lower server requirements. The deployment also reduced re-indexing time by 12x.