You are on the operations desk of a payment switch that sits between merchants and card issuers. Every minute about 400 transactions per second arrive; each is scored for fraud, waits for a free connection slot, and is forwarded to its issuer for an answer. The model computes queueing, timeouts, client retries, the fraud-screen trade-off and stand-in exposure from textbook formulas. Amounts are in generic currency units (u). Educational simulation only — not financial, legal or investment advice.
Each server holds 32 connection slots. Added servers take 5 minutes to start; every server is billed, starting or not.
Admits at most 90 % of capacity and answers the excess at once with “try again later”, instead of letting it queue and time out.
How merchants retry a technical failure (up to 3 retries). Immediate = in the next minute; backoff = randomized exponential backoff, mean delays 1, 2 and 4 minutes.
Transactions scoring at or above this are declined. Scores are in standard deviations of genuine traffic: lower means more fraud stopped and more good customers declined.
Scores this far below the threshold get an extra customer challenge instead of a decision: 85 % of genuine customers complete it, 5 % of fraudsters pass. 0 = off.
How long a connection slot waits for the issuer’s answer. After that the switch sends a reversal and uses stand-in, or declines “issuer unavailable”.
When the issuer does not answer in time, the switch approves on its behalf up to this amount. Every stand-in approval is exposure the issuer never checked. 0 = off.
| Approval rate, healthy issuers | 99.9 % |
|---|---|
| Good customers declined by the fraud rule | 1.3 ‰ |
| Transactions sent to step-up | 0.0 % |
| Fraud stopped | 31 % |
| New transactions | 400 tx/s |
| Offered load (new + retries) | 400 tx/s |
| Retries | 0 tx/s |
| Shed (answered “try later”) | 0 tx/s |
| Dropped in the queue | 0.0 % |
| Issuer timeouts | 0.0 % |
| Stand-in approvals | 0 tx/s |
| Servers in service | 6 |
| Servers starting | 0 |
| Server cost rate | 36 u/h |
| Server cost so far | 0 u |
| Stand-in exposure | 0.00 M u |
| Fraud approved so far | 0.00 M u |
| Good transactions lost so far | 0.0 k tx |
| Transactions waiting to retry | 0 tx |
| Issuer group B latency (mean) | 250 ms |
A big online sale opens at minute 5 and doubles traffic to about 800 transactions per second for 45 minutes. The switch runs 6 servers, sized for a normal day at about 70 % busy. Merchants retry every technical failure at once. Keep good customers approved and answers fast without buying capacity you do not need.
At minute 5 a batch of stolen card details starts being used: the fraud share of traffic jumps from 0.1 % to 1 %. The decline threshold is set for normal days (3σ) and step-up is off. Bring the fraud rate down without turning away good customers.
At minute 5 the issuers of group B — a quarter of all traffic — slow to a mean answer time of 12 seconds. The switch waits up to 8 s for an answer, has no stand-in, and runs 6 servers. Keep the customers of the healthy issuers flowing, serve group B as far as you safely can, and keep stand-in exposure and cost in check.
Every relation the simulator uses, with its source. Constants marked as assumptions are illustrative calibrations.
λ(t) = base × surge(t) (2-min lag); count/min ≈ N(60λ, √(60λ)) × (1 + N(0, 0.03))[2]Assumption: slot counts, service and issuer times, score separation, step-up pass rates, wasted-work share, amounts and prices are illustrative values for a mid-size switch, not figures of any real network.genuine score ~ N(0,1), fraud ~ N(d′,1), d′ = 2.5; FPR(t) = 1 − Φ(t), TPR(t) = 1 − Φ(t − d′); AUC = Φ(d′/√2) ≈ 0.96[6][7]Assumption: slot counts, service and issuer times, score separation, step-up pass rates, wasted-work share, amounts and prices are illustrative values for a mid-size switch, not figures of any real network.decline when e^(d′x − d′²/2) ≥ (1 − π)·c_FP / (π·c_FN) ⇒ t* = [ln((1 − π)c_FP/(π c_FN)) + d′²/2] / d′[8][7]scores in [t − b, t) are challenged: genuine pass 85 %, fraud pass 5 %; scores ≥ t declined[10]Assumption: slot counts, service and issuer times, score separation, step-up pass rates, wasted-work share, amounts and prices are illustrative values for a mid-size switch, not figures of any real network.L ~ Exp(mean m); E[min(L, T)] = m(1 − e^(−T/m)), P(L > T) = e^(−T/m); S = 80 ms + forwarded × Σ share·E[min(L,T)][2][9]busy slots = λ·S (Little) ⇒ utilization = λ·S / (32 × servers)[3]P(W > 2 s) = C(a, N)·e^(−(N/S − λ)·2 s), a = λS; mean wait = C / (N/S − λ)[1][2]λ ≥ N/S: goodput = (N/S − ω·λ)/(1 − ω), ω = 0.3; load shedding admits ≤ 0.9·N/S and answers the rest at once[4][5]Assumption: slot counts, service and issuer times, score separation, step-up pass rates, wasted-work share, amounts and prices are illustrative values for a mid-size switch, not figures of any real network.failed attempt → retry with p = 0.95, ≤ 3 retries; immediate: next minute; backoff: delay ~ Exp(mean 1, 2, 4 min)[4][5]Assumption: slot counts, service and issuer times, score separation, step-up pass rates, wasted-work share, amounts and prices are illustrative values for a mid-size switch, not figures of any real network.issuer timeout → reversal; stand-in approves if amount ≤ limit: P = Φ((ln L − μ)/σ), volume = e^(μ+σ²/2)·Φ((ln L − μ − σ²)/σ)[9][11]fraud rate = approved fraud amount / approved amount × 10,000 bp (reference scale: 13 bp)[10]32 slots per server, 2–24 servers, +5 min boot, 6 u per server-hour · switch time 80 ms · queue timeout 2 s · issuer latency 250 ms (group B = 25 % of traffic, ±15 % per minute) · amounts lognormal, median 40 u, σ = 1, fraud ×1.5 · ω = 0.3 · shedding at 90 % · reversal = 80 ms of switch timeAssumption: slot counts, service and issuer times, score separation, step-up pass rates, wasted-work share, amounts and prices are illustrative values for a mid-size switch, not figures of any real network.Randomness: a seeded mulberry32 generator; distributions used — uniform, exponential (inverse CDF), normal (Box–Muller), Poisson (Knuth). The seed is shown and shareable.
Educational model — not for operational decisions. Real sites calibrate every constant to their own equipment and data.