What is a velocity limit in payments?

A velocity limit is a fraud rule that caps how many times, or how much, an action can happen in a time window, such as payment attempts per card or cards per device. When the threshold is crossed, the payment is declined, challenged or reviewed.

Common velocity limits

• Payment attempts per card per hour or day.
• Different cards used from the same device, IP address or account.
• Total amount spent per card, customer or merchant in a period.
• Failed attempts in a row.
• New accounts created from the same device.

Why they work

Fraud often happens in bursts: testing stolen cards, trying many combinations, or spending as much as possible before a card is blocked. Real customers rarely behave this way, so counting events over time separates the two.

What happens when a limit is hit

Depending on the rule, the payment can be blocked, sent for 3-D Secure authentication, put on hold for manual review, or simply flagged for monitoring.

Tuning matters

Limits must match each merchant's normal patterns. A ticket seller during a big release does not look like a subscription business.

What it means for payment operators

For you, velocity limits are part of your risk rules per merchant. Being able to set them by merchant, method and channel, and to adjust them during peaks, lets you stop fraud bursts without blocking good customers.