Velocity is the rate of an activity over an entity or time window, such as transactions per card per hour or signups per device per day. It is one of the oldest and most reliable fraud indicators, because spikes flag card testing, bot attacks, and bust-out behavior at machine speed.
What is velocity, in plain English?
Velocity measures how fast something is happening over a chosen entity and time window. Instead of looking at a single event, you count events: five card attempts on one account in ten minutes, twenty signups from one device in a day, thirty logins from one IP in an hour. The count over the window is the velocity, and a sudden spike is the signal.
It works because fraud is often automated and repetitive. A human buys one thing; a script tries a stolen card list hundreds of times. That difference in pace is exactly what velocity captures, which is why velocity rules sit on the front line against card testing, credential stuffing, bot-driven signups, and the ramp-up phase of a bust-out.
The whole art is in the three dials: the entity you count over, the window you count within, and the threshold that trips the rule. Pick them well and you stop machine-speed abuse cheaply. Pick them carelessly and the same rule that catches a bot will wrongly stop a busy real customer.
How a velocity check is built
- Entity — Pick what to count over. Choose the entity that scopes the count: card, account, device, IP, email, or a combination.
- Window — Pick the time window. Set how far back you count, from minutes for card testing to days for signup abuse.
- Threshold — Set the trip point. Decide the count that is suspicious for that entity and window.
- Too loose — Threshold set high. Fast automated attacks stay under the line and slip through.
- Too tight — Threshold set low. Legitimate bursts like payday or a promo rush get blocked.
- Action — Decide the response. On a breach, step up, hold for review, or decline, and monitor the false positive impact.
Who tunes velocity rules?
Who | Their role |
Fraud analyst | Spots a burst pattern in cases and proposes the entity, window, and threshold. |
Risk strategy | Owns the thresholds and balances catching attacks against blocking real bursts. |
Data engineering | Builds the counters that track velocity across entities in real time. |
Data science | Turns velocity counts into features that feed models, not just standalone rules. |
What it looks like in practice
In practice
A merchant sees a flood of tiny card authorizations overnight, each for a dollar or two, most declining. It is a card-testing script probing a stolen list. The team adds a velocity rule: more than four card attempts on one account in five minutes triggers a lock. The overnight noise stops, because a script trips the counter almost instantly while a real shopper never does.
A month later a legitimate flash sale sends real customers into a buying frenzy, and a too-tight velocity rule on the checkout starts holding good orders during the busiest hour of the quarter. The fix is not to remove velocity but to widen the window and raise the threshold for that promo segment, so the rule still stops bots without punishing a genuine crowd.
Why it matters to operators
Velocity is cheap, fast, and durable. It needs no labels and no model, it runs in real time, and it has caught the same core attacks for decades because automation is inherently repetitive. For card testing, credential stuffing, and bot signups, a well-set velocity rule is often the first and most effective line of defense.
The trade to manage is machine-speed abuse against normal human bursts. Real life has spikes too: payday spending, a promo rush, a viral moment. Set the dials too tight and you block those; too loose and fast attacks slip under. The same rule that stops a bot can wrongly stop a busy real customer if the entity, window, and threshold are chosen carelessly, so velocity rewards careful, segment-aware tuning.
What to watch when you tune it
- Wrong entity. Counting per account misses attacks spread across many accounts; add device and IP scopes to catch distributed abuse.
- Window mismatch. A window built for minute-scale card testing will miss a slow signup ramp over days, and the reverse. Match the window to the attack.
- Legitimate bursts. Payday, paydays, promos, and seasonal peaks look like spikes; segment or raise thresholds for known-good surges.
- Threshold drift. As volume grows, a fixed count that was tight last year may now catch normal traffic; revisit thresholds regularly.
- Attackers adapting. Once a threshold is known, fraudsters throttle just below it, so watch for activity clustering right under your limits.
Quick questions
What entities can velocity be measured on?
Anything you can identify and count over, such as card, account, device, IP, email, phone, or shipping address. The right entity depends on the attack; distributed abuse often needs device or IP scopes rather than per-account counts.
How do I pick the right window?
Match it to the pace of the attack. Card testing happens in minutes, so use short windows; signup abuse or bust-out ramps over days, so use longer ones. Running several windows in parallel catches both fast and slow patterns.
Why do velocity rules cause false positives?
Because legitimate activity also spikes. Payday, promos, and seasonal peaks produce real bursts that can trip a threshold meant for bots. Segmenting traffic and tuning thresholds per segment is how teams reduce this.
Can attackers get around velocity checks?
Yes, by spreading activity across many entities or throttling just under the threshold. That is why teams combine multiple entity scopes and watch for behavior clustering right below known limits.
Is velocity a rule or a model feature?
Both. It works as a standalone rule and as a powerful input to models, where a velocity count becomes one of many features weighed together for a more nuanced decision.
What attacks does velocity catch best?
Automated, repetitive ones: card testing, credential stuffing, bot-driven signups, and the rapid activity of a bust-out. Anything where a machine acts far faster than a person is where velocity shines.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.