A velocity check counts how many times the same identifier appears inside a set time window, then flags or blocks the pattern once it crosses a threshold. In card testing, that identifier is usually an IP address, device fingerprint, card BIN, email, or customer ID. Someone running a batch of stolen numbers from one source will spike those counts in minutes, which is exactly what the rule is built to notice.

Why card testing looks different from ordinary fraud

Most payment fraud is about value. Someone wants a laptop, a gift card, a big-ticket item shipped somewhere. Card testing is about information. The attacker does not care about the merchandise, or only cares a little. They want to know which numbers still authorize.

That produces a signature you can spot:

• Many attempts in a short burst, often dozens to thousands per hour.
• Small amounts, frequently $0.01 to $2, or donation and subscription trial pages that only require an authorization.
• Sequential or near-sequential card numbers from the same source.
• A high decline rate mixed with a small number of approvals, since most tested numbers are dead.
• One IP or device touching many different BINs and issuing banks in a country the merchant rarely sells to.

The loudest signal is not any single attempt. It is the ratio of attempts to unique customers.

The identifiers worth counting

I look at counters per axis rather than one global number, because each one fails in a different way. A single counter on IP alone misses attacks that rotate through a proxy pool, and a single counter on card number alone misses the fact that each tested card is used once.

• IP address. Fast and cheap. Also the noisiest, because of carrier NAT and corporate networks.
• Device fingerprint. Harder to fake than IP, and consistent across many card numbers.
• Card BIN. Catches batches drawn from one bank's range.
• Email address and domain. Throwaway domains and plus-addressing give this one away.
• Billing address and ZIP. Useful when the attacker reuses one address across many cards.
• Customer ID or account. Catches an existing account being used to probe stored cards.

Choosing windows and thresholds

Short windows catch bursts. Long windows catch slow drips. You want both, and you want them rolling rather than fixed, so an attacker cannot simply pause at the top of the hour and start again.

A workable starting set for a mid-size store: 5 authorization attempts per card per 24 hours, 10 attempts per device per hour, 20 attempts per IP per hour, and 3 attempts per email per 10 minutes. Convert every rule to an alert first, watch it for two weeks, then promote the ones with clean precision to a block or a step-up challenge.

Layering velocity with other signals

Velocity alone produces false positives. Velocity plus context produces decisions. Pair the counters with BIN country versus IP country, AVS and CVV mismatch rates, IP reputation and proxy detection, and the age of the account or email. A brand new email, a mismatched BIN country, and 14 attempts in 20 minutes is not a customer having a bad day.

When a rule fires, prefer graduated friction over a hard decline: require 3D Secure, ask for a one-time code, hold the order for review. A hard block teaches the attacker your threshold; a challenge just costs them time.

False positives and how to keep them down

Shared IPs are the main source of pain. University campuses, hotels, corporate offices, and mobile carriers all put many real buyers behind one address. Cardholder retries after a genuine decline are another. So exclude known-good networks from IP counters, count only failed authorization attempts for the retry rule, and give returning customers with clean history a higher allowance.

Measuring whether it works

Track four numbers weekly: card testing attempts blocked, false positives per 10,000 orders, authorization rate, and fraud chargeback rate. If blocks rise but chargebacks do not fall, the rule is catching noise. If chargebacks fall and the auth rate barely moves, you have the threshold roughly right. Revisit it every quarter, because the attackers adjust before you do.