What is a velocity check?
A velocity check measures how many times a customer, device, card, email, or IP performs an action inside a defined window—for example five failed logins in two minutes or twenty authorizations from one BIN in an hour.
What good velocity rules look like
Name the identifier, the action, the window, and the threshold. “More than three payments from the same device in ten minutes” is reviewable. A vague “too much activity” rule is not. Keep windows short enough to catch bursts and long enough to avoid punishing a family sharing a network.
How Naiza runs velocity checks
Naiza evaluates product events with an explainable rule engine. Velocity conditions can sit next to device, IP, and list rules and return ALLOW, REVIEW, or BLOCK with a reason you can show to operations. Tune thresholds in shadow or review-first mode before enforcing blocks.
Where velocity fails alone
Low-and-slow fraud stays under thresholds. Attackers also rotate IPs and devices. Pair velocity with device fingerprinting, lists, and AML screening on counterparties rather than treating count spikes as a verdict.
Frequently asked questions
Short answers written so search and answer engines can cite them.
What is a velocity check in fraud prevention?
It is a rule that compares the count, sum, or uniqueness of events for an identifier against a threshold in a time window.
What identifiers should velocity rules use?
Common keys are customer id, device fingerprint, IP, email, card hash, and beneficiary account. Use the most stable key you actually collect.
Should every velocity hit be a BLOCK?
Usually no. Burst traffic can be bots or a legitimate sale. Start with REVIEW, measure false positives, then BLOCK only the high-confidence patterns.