Payments glossary
Velocity checks
Velocity checks are fraud rules that count how often something happens in a time window - attempts per card, per device, per IP address, per email - and block or flag activity that breaches the limit, such as ten card attempts from one device in five minutes.
What velocity checks catch
The classic target is card testing: a bot working through a list of stolen card numbers, firing rapid small authorisations - R1.00 at a time - to find the cards that still work. To a per-transaction fraud check each attempt looks harmless; it is the frequency that gives the game away, and a velocity rule on attempts-per-device shuts the run down after a handful of tries. The same logic catches stolen-card spending sprees, account takeover bursts, and promotion abuse from one person posing as many.
How velocity limits are set
A velocity rule is a dimension, a window and a counter. Dimensions include the card number, device, IP address, email and delivery address; windows run from minutes to days; counters track attempts, declines or amounts - for example, more than three declined attempts on one card in an hour, or cumulative spend above R20,000.00 from a first-seen device in a day. Tuning matters: genuine customers retry after typos, and households share IP addresses, so limits must fit the merchant's real traffic patterns.
Velocity in a layered defence
Velocity checks rarely act alone. Their counts feed the overall fraud score, so a moderate burst raises suspicion rather than triggering a hard block - one signal among many, which is how modern risk engines, including LekkaPay's, keep false positives down.
Last updated:
Payments without the jargon.
One integration, every way Africa pays - we'll handle the acronyms.