How PayPal and Block Can Cut Fraud Scoring Latency From 20ms to 15 Microseconds

PayPal processes over 25 billion transactions per year. Block (Square, Cash App) processes billions more. Both companies run ML fraud scoring on every single transaction. The scoring pipeline is identical in structure: collect features (user history, transaction patterns, device data, merchant risk), run the model, return a decision. And in both cases, the same bottleneck dominates: feature collection takes 15–30ms while model inference takes just 1–2ms. Feature fetching is 90%+ of the total fraud scoring latency. L1 caching collapses the pipeline from 20ms to 2.015ms — a 10x improvement that changes what is architecturally possible.

The Shared Architecture Problem

PayPal and Block have different business models, different user bases, and different product lines. But their fraud scoring architectures share the same fundamental design: a real-time feature pipeline feeding an ML model. When a Cash App user sends $50 to a friend, the fraud scoring service needs to assemble a context vector before the model can make a decision. That context vector includes the sender’s transaction history encoding (embedding), the recipient’s risk profile, the device fingerprint, velocity features (how many transactions this user has made in the last minute, hour, day), geographic anomaly scores, and relationship graph features (is this a known contact? first-time recipient? connected to flagged accounts?).

At PayPal, the same pattern applies at even larger scale. Every Venmo transfer, every PayPal checkout, every Braintree-processed transaction runs through the fraud pipeline. PayPal has publicly discussed their risk scoring architecture, which relies on hundreds of features computed in real time. But real-time computation is limited by the speed of feature retrieval. Each feature lives in a different storage system: user embeddings in a vector store, velocity counters in a time-series database, graph features in a relationship database, device data in a fingerprinting service. Each lookup is a network round-trip.

Breaking Down the 20ms Pipeline

A typical fraud scoring request at PayPal or Block follows this timeline: the transaction event arrives at the fraud service (0ms). The service issues parallel requests to multiple feature stores. The user embedding lookup takes 2–4ms (feature store network round-trip). The recipient risk profile takes 2–3ms. The device fingerprint lookup takes 1–3ms. Velocity feature aggregation takes 3–5ms (requires querying a time-series store and computing sliding window aggregates). Graph feature computation takes 4–8ms (requires traversing relationship edges). Merchant category risk takes 1–2ms. Account age and history features take 1–2ms.

Even with aggressive parallelization, the total feature assembly time is bounded by the slowest feature. Graph features at 4–8ms and velocity aggregates at 3–5ms are the long poles. The p50 feature assembly time is approximately 8ms. The p99 — which is what matters for SLA compliance — hits 18–25ms due to tail latency amplification across multiple parallel requests.

L1 Caching: 10 Features in 15 Microseconds

The critical insight is that fraud features at PayPal and Block exhibit extreme access locality. Active users — the ones actually making transactions right now — represent a small fraction of the total user base. PayPal has 430 million active accounts, but on any given day, perhaps 20–30 million users are transacting. The embeddings and features for those active users are accessed repeatedly throughout the day. Popular merchants (Amazon, Walmart, Target, Uber, Starbucks) have their risk profiles queried thousands of times per second. Device fingerprints repeat across sessions for the same user.

An L1 in-process cache stores these hot features directly in the fraud scoring service’s memory. Each lookup completes in 1.5 microseconds. Ten feature lookups take 15 microseconds. Not milliseconds — microseconds. The total fraud scoring pipeline becomes: 15µs for feature assembly + 2ms for model inference = 2.015ms total. That is a 10–15x reduction from the current 20–32ms p99.

What 10x Faster Means at PayPal/Block Scale

The downstream effects of a 10x latency reduction at this scale are substantial. First, more transactions per server per second. When fraud scoring takes 20ms, each server thread is occupied for 20ms per transaction. At 2ms, the same thread handles 10x more transactions. This translates directly into fewer servers needed to handle peak volume. At PayPal’s scale (25B+ transactions/year, with peaks during Black Friday, Cyber Monday, and holiday shopping), the infrastructure savings from 10x fewer fraud-scoring servers is measured in tens of millions of dollars annually.

Second, latency headroom enables more complex models. When the fraud pipeline takes 20ms and the SLA is 100ms, there is limited room for model complexity. At 2ms total pipeline, there is 98ms of headroom. PayPal and Block can run ensemble models (multiple models voting on each transaction), add more features (graph features that were previously too slow to compute in real time), or implement multi-stage scoring (a fast first-pass model followed by a detailed second-pass for borderline cases). Each of these improvements directly increases fraud detection accuracy without violating latency SLAs.

Velocity Features: The Special Case

Velocity features — transaction counts and amounts over sliding time windows — are the most latency-sensitive fraud features because they change with every transaction. A user’s 1-minute velocity counter increments every time they transact. Traditional architectures compute these in real time by querying a time-series store, which adds 3–5ms per lookup. With L1 caching, the velocity counter lives in-process and updates atomically on each transaction. The current value is always available at memory speed. Asynchronous write-back to the persistence layer ensures durability without blocking the scoring path. This pattern eliminates the single slowest feature lookup in the entire pipeline.

For both PayPal and Block, the path from 20ms to 2ms fraud scoring is not a theoretical exercise. It is a concrete architectural change: move hot features from network storage into process memory, use L1 caching with predictive warming, and let the feature store serve as L2 for cold data. The model becomes the bottleneck. The feature pipeline disappears. And the savings — in infrastructure, in latency, in fraud losses prevented by better models — compound across billions of transactions.

Related Reading

• Fraud Detection Solutions
• AI Infrastructure Solutions
• Cachee Pricing
• Start Free Trial