Velocity Abuse

Velocity abuse is a pattern of fraud in which a criminal performs a large number of payments, login attempts, sign-ups or other actions in a short period. The aim is either to test stolen data at scale, to extract as much value as possible before a compromised account or card is blocked, or to exploit an offer or limit that was meant to apply once per customer. Merchants, payment processors, banks and wallet providers all face it, and it is one of the main reasons that payment systems count and limit activity over time.

The term takes its name from velocity, meaning the rate at which events occur. Controls that watch this rate are called velocity checks or velocity rules, and velocity abuse describes attempts to beat them, whether by sheer speed, by spreading activity across many identities, or by staying just below known limits.

The same basic tactic appears in many settings:

• Card testing. Fraudsters run thousands of small authorisations through a merchant's checkout to find which stolen card numbers are live. This is described under card testing, and related variants include the BIN attack and the enumeration attack, which guess valid card numbers, expiry dates or CVVs.
• Login attacks. Automated tools try large lists of stolen usernames and passwords, a method known as credential stuffing, to take over accounts.
• Cash-out bursts. After an account takeover, the criminal makes many transfers, purchases or withdrawals in quick succession before the victim or the bank notices.
• Promotion and bonus abuse. Many new accounts are opened to claim sign-up bonuses, referral rewards or free trials meant for one per person.
• Limit splitting. Large sums are broken into many smaller payments to stay under per-transaction limits, similar to structuring in money laundering.

Many controls act after the fact. Card disputes arrive weeks later, customers notice unauthorised transactions only when they check statements, and some fraud models score transactions individually without looking at what happened minutes earlier. A fraudster who moves quickly can complete dozens of transactions before any of these signals arrive. Automation makes this easier: bot attacks can submit requests far faster than any human and rotate through proxy servers, devices and email addresses to avoid simple counting rules.

The costs for the target business are significant even when individual amounts are small. Merchants pay authorisation fees on every attempt, see their decline and dispute ratios rise, and may be flagged by card schemes or their acquirer. Banks face direct losses from emptied accounts, and wallet providers lose money on bonuses paid to fake customers.

Businesses counter velocity abuse by measuring activity across several dimensions at once. Typical rules count events per card, account, device, IP address, email domain, shipping address or bank account over windows ranging from seconds to days, and block, delay or challenge activity above set thresholds. Examples include a maximum number of failed payment attempts per card per hour, a cap on new accounts per device per day, or a limit on the value of outgoing transfers from a newly opened wallet.

Effective controls link identities together. Device fingerprinting and IP reputation data reveal when many accounts or cards come from the same source, even if each looks normal on its own. Machine learning models include velocity features in the transaction risk score, so a burst of activity raises the score of each subsequent attempt. Friction such as CAPTCHA tests, step-up authentication and cooling-off periods for new payees slows automated attacks without blocking most genuine users. Some firms also share data on attacking devices and IP ranges with their processor or an industry consortium, so an attack seen at one merchant can be blocked at others before it spreads.

Velocity rules can catch genuine customers: a shopper retrying a declined card, a business paying many suppliers at once, or a family sharing a home internet connection. Overly tight thresholds lead to lost sales and complaints, while loose ones let attacks through. Fraud teams therefore tune limits by segment, allow trusted customers higher thresholds, and review blocked events to measure false positives. Thresholds should also change over time, since fraudsters probe for limits and adjust to stay just below them. A broader view of rule design is given under fraud rule.