Also called: Velocity limits
What a velocity check is
A velocity check counts how frequently a payment-related identifier appears within a defined period. The identifier could be a card or card token, email address, account, device, or IP address. If activity crosses a threshold you set, the system can flag, challenge, review, or block the attempt.
The rule combines an identifier, an event, a count and a time window. For example, you could count authorization attempts from one card during 10 minutes, or total spending from one account during a day. There is no universal threshold: five attempts in 10 minutes is an example rule, not an industry standard.
A velocity rule is only as useful as its balance: stop suspicious bursts without turning repeat customers away.
How it works
Your fraud tool checks incoming attempts against your rules in real time. A rule might count attempts by card, IP address or device, then send an alert, request additional verification, or decline the payment when the limit is reached. You choose which activity to count, such as all attempts, declined attempts or completed transactions.
For example, an illustrative rule could flag a card that makes five attempts in 10 minutes. Another illustrative warning sign is a card normally used three times a day making 10 attempts in one hour. Those numbers show how a rule might work, not what your business should use.
A sample velocity rule
| Trigger | 5 attempts in 10 minutes |
|---|---|
| Identifier | One card |
| Possible action | Flag or block |
Illustrative only. This is an example threshold, not a universal limit or recommendation.
Why it matters to your business
A burst of attempts using many cards from one IP can point to card testing, where someone checks whether stolen card details work. Catching that pattern can stop more fraudulent payments before they are approved. A velocity check is one layer of fraud detection, not a guarantee against fraud or chargebacks.
The tradeoff is lost sales. A legitimate customer placing several orders, or a staff member retrying a payment after a decline, can hit an overly strict threshold. The result is a false decline, extra verification or a blocked checkout. That friction can cost you a sale even when the customer is genuine.
Costs and what appears on your statement
A velocity check is a fraud rule, not a card-network fee. The research does not establish a standard fee for the check itself, and it does not identify a standard merchant-statement line for it. Look at your statement for a specific fraud-tool or risk-service charge, rather than assuming every fraud-related line is a velocity-check fee.
The financial effect comes from the decisions the rule triggers. Blocking a real buyer can mean lost revenue; letting a fraudulent transaction through can expose you to the cost of the goods, service and resulting dispute. Velocity checks also cannot prevent friendly fraud after a genuine purchase.
Where velocity rules go wrong
A rule based on one identifier is easier to evade. Fraudsters can spread attempts across cards, rotate IP addresses or change devices. Cross-checking more than one signal, such as card plus device or IP, gives you a fuller pattern, while creating more data to handle.
Review the results by customer type and sales pattern. A threshold that works for a low-volume online shop could block legitimate repeat purchases at a busy clinic or ticketing business. Track both fraud caught and legitimate payments declined, then adjust the rule when those outcomes show the limit is too tight or too loose.
What you can actually change
- Count the right events. Decide whether your rule counts authorization attempts, declines, or completed payments. Counting attempts helps expose bursts that never become approved sales.
- Use more than one signal. Combine card or token activity with device or IP patterns where your tools support it. A single-identifier rule is easier to evade by rotating cards or addresses.
- Measure false declines. Review blocked orders alongside confirmed fraud. If real customers are hitting the rule, adjust the threshold or send borderline activity for verification instead of automatic blocking.
- Recheck seasonal patterns. Compare rule outcomes during promotions and busy periods with ordinary days. A sudden increase in legitimate repeat orders can make a previously reasonable threshold too restrictive.
Frequently asked questions
What does a velocity check look for?
It counts how often payment attempts or transactions are tied to an identifier, such as a card, account, device or IP address, within a set time. A rule can also track total payment amounts during that window.
Is there a standard velocity limit for card payments?
No universal limit is established in the research. Your rule depends on the identifier, event and time window you choose. Examples such as five attempts in 10 minutes are illustrative, not required network limits.
Can a velocity check block legitimate customers?
Yes. A customer making several purchases or retrying after a decline can cross a threshold intended to catch fraud. Track legitimate declines as well as fraud outcomes, then tune the rule or add a verification step.
Does a velocity check have its own processing fee?
The research does not establish a standard fee for velocity checks or a standard statement line. If your statement shows a fraud-tool or risk-service charge, review its description and billing basis rather than assuming it is a network fee.