Velocity of use counts how many transaction attempts share a common data element — a credit card number, an address — as a way of spotting suspicious behavior before it becomes a loss.
What it catches
Coordinated fraud rings, repeat attacks from a single perpetrator, and some forms of identity morphing. Worth tracking: card numbers, addresses, phone numbers, email addresses, account numbers, and how many accounts a single customer identity is tied to.
What implementation requires
- A supporting database and two system calls — one to increment a count, one to retrieve it
- Logging every transaction attempt, not just completed orders
- Keeping history for at least 12–18 months
- Address normalization, so formatting differences don't create false negatives
Setting thresholds
Decide upfront which data elements to monitor, what frequency counts as acceptable, and over what time window — then apply either simple pass/fail logic, or a graduated scale where risk climbs with frequency. Thresholds are genuinely business-specific: three daily orders might be nothing unusual for a printer ink retailer, but two purchases a day from the same identity would raise real questions for a jewelry seller.
Handling a failed check
Transactions that fail a velocity test inside a 24-hour window should be cancelled or held. The 90-day chargeback window deserves particular attention too, since staggered fraud attempts are specifically designed to spread out and avoid tighter, shorter-window checks.