Velocity checking is a fraud and risk control that counts how many times something happens, or how much money moves, within a set period, and flags or blocks activity that exceeds a limit. Typical checks count card payments per hour, login attempts per minute, transfers per day or new accounts opened from one device per week. Card issuers, merchants, payment processors, banks and money transfer firms all use it because fraud tends to arrive in bursts: a criminal with a stolen card or a hijacked account tries to use it as much as possible before it is blocked.
Velocity checking is a practitioner term rather than a formal standard; regulators describe the same idea as monitoring the frequency and value of transactions. It is one of the oldest and simplest techniques in fraud detection and sits alongside behavioral analytics and anomaly detection inside a fraud management system. Anti-money laundering teams use similar counts in transaction monitoring.
Velocity checking in plain terms
Imagine a shopkeeper who notices the same customer coming back to the till ten times in five minutes, each time buying a gift card with a different credit card. No single sale looks odd, but the pace does. Velocity checking is that shopkeeper's instinct turned into a rule a computer can follow.
A speed camera is another good comparison. It does not care where you are going, only how fast you are moving. Velocity checks ignore most details of each payment and simply ask: is this card, account, device or person doing far more, far faster, than a normal customer would?
How velocity rules work
Every velocity rule has four parts: the thing being counted (the key), what is measured, the time window and the limit. The key can be a card number, account, customer, device, IP address, email address, delivery address or beneficiary account. The measure is either a count of events or a sum of amounts, and the window can be fixed (each calendar day) or rolling (the last 60 minutes).
A rolling-window count can be written as:
Here is the velocity for key at time , is the window length, and the sum counts each event for that key whose timestamp falls inside the window. For a value check, the 1 is replaced by the amount of each event. The rule fires when exceeds the limit .
A worked example: a merchant sets a limit of payment attempts per card in a rolling 10-minute window. A card is tried at 12:00, 12:02, 12:03 and 12:05. At 12:05 the count of attempts between 11:55 and 12:05 is 4, which is above 3, so the fourth attempt is declined and sent for review. If the next try comes at 12:16, only attempts after 12:06 count, the velocity falls back to 1 and the payment can proceed if it passes other checks.
| Example rule | Key | Window | Typical purpose |
|---|---|---|---|
| More than 5 declined attempts | Card number | 1 hour | Stopping card testing fraud |
| More than 10 different cards | Device | 24 hours | Catching one fraudster using many stolen cards |
| Total transfers above a daily limit | Account | 1 day | Limiting losses from account takeover |
| More than 3 new payees added | Customer | 1 day | Spotting scams and mule activity |
| More than 2 applications | Identity details | 30 days | Detecting synthetic identity fraud and application bursts |
Where velocity checks are used
In card payments, issuers apply velocity limits in their authorisation systems, and merchants and payment gateways apply them at checkout to stop bots that test thousands of numbers. Many decline codes and soft blocks seen by customers, such as a card temporarily refused after several online purchases in a row, are the result of a velocity rule. Daily cash withdrawal and spending limits on a debit card are a simple form of the same idea.
In bank transfers and instant payments, velocity checks look at the number and value of outgoing payments, new beneficiaries and changes to contact details. Since March 2026, Nacha's operating rules for the US ACH network require originating banks and large originators, and later most participants including receiving banks, to run risk-based processes to identify fraudulent entries; velocity monitoring is among the methods commonly used to meet that standard. In the EU, the regulatory technical standards on strong customer authentication require payment providers to monitor transactions for signs of fraud, and their exemptions for low-value contactless and online payments include cumulative limits on the number of transactions and total amount since the last full authentication, which is itself a velocity rule.
Money transfer firms and electronic money institutions use velocity and value limits to manage both fraud and money laundering risk, for example by lowering limits for new customers and raising them as a history builds up. A pattern of many payments just below a reporting threshold is a velocity signal for structuring.
Strengths and limitations
Velocity checks are cheap, fast and easy to explain to customers, auditors and regulators, which is why nearly every fraud risk management programme uses them. Their weaknesses are equally clear. A fixed limit cannot tell a busy legitimate customer from a criminal, so tight limits cause false declines and loose limits let fraud through. Criminals learn the limits and stay just under them, spreading activity across many cards, devices and accounts. For these reasons firms tune limits by customer segment, combine velocity with device signals from a digital fingerprint, and feed velocity counts into machine-learning models as inputs rather than relying on them as stand-alone rules.