Each time we get an event API events we extract features related to those events and compute the Sift Score. These features are then weighed based on fraud we've seen both on your site and within our global network, and determine an event's Score. There are features that can negatively impact a Score as well as ones which have a positive impact.  

We learn in real-time, which means Scores are constantly being recalculated based on new knowledge of fraudulent users and patterns. For example, when someone logs in, we've found out a lot of information in the meantime about suspicious devices, IP addresses, shipping addresses, etc., based on the activity of other users. Add this to the fact that there may have been some new labeled users since their last login, and the event scores can sometimes have a significant change. This is also more likely if the user hasn't had much activity on your site.

For more information on when Scores are updated, see this article.