Fraud lives in patterns
A single order rarely screams fraud, but patterns across many orders often do. Fraud tends to move fast and repeat, testing and exploiting before anyone reacts, which produces telltale rhythms. Watching for these patterns lets you intervene early, turning fraud prevention from a reactive scramble after disputes arrive into a proactive discipline that stops losses before they happen.
The idea behind velocity checks is simply to notice when activity speeds up or clusters in ways that do not match normal customer behavior.
What is a velocity check?
A velocity check is a fraud rule that counts how many times a single identifier is used within a set time window, and flags, reviews or declines activity when the count goes past a limit you choose. The identifier can be a card number, an email address, an IP address, a device, a shipping address or a customer account.
The logic is simple: a real customer rarely tries five different cards in ten minutes, but a fraudster testing stolen card numbers often does. Counting speed and repetition catches that behavior even when each individual transaction looks normal on its own.
Common credit card velocity check rules
Most velocity rules follow the same pattern: an identifier, a count, and a time window. The right limits depend on your business, so start from your own normal order patterns rather than copying someone else's numbers.
- Transactions per card: how many attempts one card makes in an hour or a day.
- Declines per card or account: repeated declines often signal card testing.
- Cards per device, IP or email: many different cards from one source is a classic fraud pattern.
- Orders per shipping address: many orders from different cards to one address.
- Amount per card over a period: total spend climbing far above your typical order.
Signals worth watching
Several broad patterns commonly indicate elevated risk and deserve a closer look.
- Unusual bursts of orders in a short window.
- Repeated attempts that suggest testing rather than buying.
- Orders that deviate sharply from your normal customer behavior.
- Clusters of activity sharing suspicious commonalities.
Respond without punishing good customers
The challenge is acting on these signals without disrupting legitimate buyers, since some real customers occasionally look unusual. The best responses add scrutiny to genuinely suspicious activity while leaving normal customers untouched, rather than clamping down on everyone. Tuning your response to catch fraud while preserving a smooth experience for good customers is what makes signal-based prevention effective rather than costly.
Prevention that quietly declines good customers is its own kind of loss, so balance is essential.
Combine signals with your other defenses
Velocity and pattern signals work best alongside your other prevention practices, each catching what the others might miss. No single signal is definitive, so layering them and combining them with sound operations creates a defense that is both strong and accurate. Treating signals as one input among several keeps your prevention sharp without becoming heavy-handed.
Key takeaways
- Fraud usually shows up in patterns, not single transactions.
- Bursts, repeated attempts, and deviations from normal behavior are common signals.
- Respond to genuine risk without punishing good customers.
- Combine signals with your other defenses for accurate prevention.
Frequently asked questions
What is a velocity check?
It is watching for activity that speeds up or clusters in ways that do not match normal customer behavior, which can indicate fraud testing or exploitation before it becomes a chargeback.
How do I act on fraud signals without hurting sales?
Add scrutiny to genuinely suspicious activity while leaving normal customers untouched, and combine multiple signals rather than clamping down on everyone based on one.
What limits should I set for velocity checks?
There is no universal number. Look at how your real customers behave, such as how many attempts a genuine buyer usually makes, then set limits a little above that and adjust as you see results. Too tight declines good customers; too loose lets card testing through.
Do velocity checks stop card testing?
They are one of the main defenses against it. Card testing produces many small attempts or declines from one source in a short time, which is exactly the pattern a velocity rule counts.