If the majority of your customers are good, failing closed will cost more than the fraud during the anti-fraud system's downtime.
If that is the mindset in your company, why even bother looking for vulnerabilities?
Until any bad customer learns about the fail-open.
If that is the mindset in your company, why even bother looking for vulnerabilities?