Firms that screen retirement withdrawals for scams must choose how suspicious a request has to be before it is escalated for review or held. A low threshold stops more scams but delays and frustrates legitimate customers, while a high threshold does the reverse. We estimate both sides of this trade-off and derive cost-minimizing escalation policies. Using 1,264,530 retirement withdrawal requests from owners aged 60 and older at a national custodian between 2022 and 2025, we combine a sharp regression discontinuity at the custodian's existing risk-score threshold with a 24-week randomized experiment that assigned requests to one of three thresholds. Escalation at the margin reduced expected scam losses by 1,840 dollars per escalated request while raising 30-day abandonment by 2.1 percentage points and 180-day account attrition by 0.9 percentage points among legitimate customers. In the experiment, lowering the threshold from 0.62 to 0.50 increased escalations by 58 percent and prevented an additional 22 percent of scam dollars, whereas raising it to 0.72 cut escalations by 37 percent but allowed 31 percent more scam dollars through. A cost model calibrated to these estimates places the loss-minimizing single threshold near 0.54. A two-tier policy that routes moderate-risk requests to a brief structured call and holds only high-risk requests lowers total expected cost by a further 17 percent. Optimal thresholds vary substantially by request size and channel, and queue capacity can erase much of the benefit of aggressive thresholds during demand surges. Escalation rates at the optimal policy did not differ meaningfully by neighbourhood income.