What is velocity checking?
Velocity checking is a fraud control that tracks how often payments or logins come from the same card, account, device, or IP address in a set time window. It flags or blocks anything past a preset limit.
A stolen-card script running dozens of small purchases in minutes trips it, while a real shopper buying twice a week stays clear. It counts attempts over time, so the whole run decides the outcome.
Why velocity checking matters for merchants
Merchants run velocity checks to stop automated card-testing traffic before it turns into a real charge. Every attempt the rule misses can come back as a chargeback, and by then you are paying a fee on top of the loss.
You can write the rule around a dollar total as easily as a count, and you only write it once.
Your gateway then applies it to every authorization request. That keeps clean orders moving without a person screening each one.
Say a card, device, or IP tries five transactions in a short burst.
Checkout.com puts the trigger point at five transactions over 20 minutes, and Chargebacks911 describes a similar window at 30 minutes.
Both figures are vendor illustrations, and you set your own. Pull 90 days of order history, find the most orders one real customer placed in that window, then set the limit above it.
How velocity checking works
Every attempt passes through a real-time counter inside the authorization request, and the count decides whether it clears. Three things happen in order:
- Set the rule: cap attempts per card, such as three in 10 minutes.
- Check every attempt: your gateway or fraud tool matches each request against the rule.
- Act on a breach: block it, hold it for review, or step up authentication.
You have the most choices at the third step, because each response costs you something different:
Most merchants send a breach to review or to a step-up challenge. A hard block is the only response of the three that can lose you a real customer outright.
Velocity checking vs. card testing fraud
Velocity checking is the detection method and card testing is the attack it catches. Three differences matter when you're sorting one from the other:
Velocity checking catches only the noisiest version of that attack, the one that runs fast enough to break a count.
Where velocity checking falls short
A strict rule turns away real customers, and a loose one lets a patient fraudster stay under the limit. Count and timing are all the rule has to work with.
Counting attempts tells you only how fast someone is buying.
Five gift cards bought in one sitting and five stolen-card tests happen at the same speed. The rule reads them as the same event.
A fraudster who understands that slows down. They stay under your limit and work the same list of cards over a day instead of an hour.
So add checks that look at something other than timing:
- Address verification and CVV matching test whether the buyer holds the card details.
- Device fingerprinting recognizes one machine behind many card numbers.
- A fraud-scoring tool like Signifyd or Kount weighs every signal at once.
Once the payment goes through, only a post-authorization control reaches it.
A chargeback alert is that control. It tells you the cardholder disputed the charge while you can still refund them.
Refund in time and the card network records no chargeback against you. That is the stage our alerts cover, after your front-end rules have done their work.
Run your own dispute count through our ROI calculator to see what the fraud that slips past velocity checks is costing you.
FAQ
Do velocity checks stop chargebacks?
Yes, for the fraud they block, since a blocked charge gives the cardholder nothing to dispute. Their reach ends at authorization.
What velocity threshold should a small business set?
Pull your order history and find the most orders one real customer placed in your chosen window. Set the limit above that figure, because your own buying patterns are the only reliable baseline.
Can velocity checking block real customers by mistake?
Yes, and a tight limit is the usual cause. Shared IP addresses and repeat orders from one customer are the common triggers.
