Where do velocity limits sit on a payment platform?

They sit in the rules applied before a transaction is sent to a provider, next to blocklists and risk checks. Operators combine them with routing rules and follow their effect on declines and fraud in analytics dashboards.

Before the provider, not after

A velocity limit counts attempts over a window, for example five authorizations on one card in ten minutes, and blocks the next one. It only works if it runs before the request leaves the platform. Once the authorization reaches the acquirer, it counts as an attempt and, if it fails, as a decline in the merchant's ratios.

The rule layer

• Velocity limits live with blocklists, amount thresholds and device checks, in the risk rules evaluated at checkout.
• They can be set per merchant account, per payment method and per market.
• Blocked attempts are recorded as a risk decision, not as a provider decline, so reporting keeps the two apart.

Why operators care

Card testing attacks send hundreds of small authorizations through one merchant in minutes. Each one creates a fraud report at the issuer and weighs on the merchant's and the acquirer's monitoring ratios. A velocity limit stops the attack at the second or third attempt. Combined with routing rules, the platform can also send suspicious traffic to a provider with stronger fraud screening. Dashboards then show the share of attempts blocked by rule versus declined by the issuer, which is the number a risk team wants.