Velocity Checks

Velocity checks are fraud detection controls that monitor the rate at which specific identifiers, a card number, a device fingerprint, an IP address, an email address, or a shipping address, are used to initiate transactions within a defined time window. When the frequency of activity associated with a particular identifier exceeds a defined threshold, the velocity check triggers an alert, a hold, or a decline.

The underlying logic reflects how fraud attacks typically operate. Fraudsters rarely test stolen card credentials or attempt purchases one at a time across weeks. They tend to work in bursts: testing multiple cards in rapid succession on a low-value transaction to identify which are valid (carding attacks), placing multiple high-value orders in quick succession before fraud detection can respond, or using a compromised device or IP address to initiate transactions at scale. Velocity checks catch these patterns by treating abnormal rate as a fraud signal in itself, independent of whether any individual transaction in the burst would be flagged on its own merits.

Common velocity check configurations include: more than three declined transactions on a single card within 24 hours (suggesting card testing); more than five transactions from a single IP address within one hour; more than two different cards used from the same device fingerprint within 30 minutes; or multiple transactions shipping to a single address within a defined period across different customer accounts. The specific thresholds are calibrated based on the merchant's normal transaction patterns, what is abnormal for a luxury goods merchant differs from what is abnormal for a digital streaming service.

Velocity checks are most effective as one layer in a multi-signal Fraud Scoring system. Strict velocity rules applied in isolation can produce high False Positive rates, a family sharing a device or a legitimate customer placing multiple orders legitimately will trigger the same velocity signal as a fraudster.