Velocity checks

Watching how fast something is happening, such as five applications submitted in a minute.

Honest customers act at human speed. When one device, person, or detail suddenly shows up many times in a short window, the speed itself is a warning sign.

Rate-based rules evaluating event frequency per identity, device, or attribute over time windows. A time window is a set period, such as one minute or one day, over which the system counts events.

A velocity check typically works like this:

1. The system counts events tied to a key, such as a device, an email address, or a document number.
2. It compares the count within a time window with a limit.
3. A count above the limit triggers an action, such as a block, a review, or a stronger check.

Common examples include:

• Applications per device, such as many signups from one device in an hour.
• Attempts per account, such as repeated failed logins.
• Accounts per detail, such as many accounts sharing one phone number or address.
• Transactions per card, such as many small purchases in a short time.

Velocity checks have limits that teams plan for:

• Low-and-slow attacks stay under the limits by spreading activity over time or across many devices.
• Shared connections, such as an office or a mobile carrier network, can make many honest users look like one source.

Velocity checks sit next to terms that are easy to mix up:

• Bot attack is the automated traffic that velocity rules often catch.
• Bust-out fraud shows up as a burst of spending that velocity rules can flag.
• Rules engine is the component that runs rules such as these.