How does a velocity check work?
The rule keeps a counter per key, such as a card, an email address, a customer account, a device or an IP address, over a window such as an hour, a day or a week. Each new attempt is compared with the limit, and attempts above it are blocked, sent to review or asked for extra authentication. Stripe’s rules reference describes the same idea: attributes that count events per card, customer or IP address over several time scales, which it calls velocity rules.
Why does it matter?
Velocity is the clearest signal of automated abuse. Stripe’s card testing guide notes that card testing leads to disputes, extra fees and a high decline rate that can make issuers treat even legitimate payments from the merchant as riskier. As an illustrative example: a script tries 3,000 card numbers on a store’s checkout in one night. A limit of five cards per IP address per hour and three per new account stops most of the attempts in the first minutes.
What are the risks?
Limits set too low block real customers, for example a family sharing one network or a customer who mistyped a card twice. Velocity on a single key is easy to get around by rotating IP addresses, so good rules combine keys. And the merchant’s own retries count too: Stripe warns that excessive payment retries can look like card testing.
Where does Omno use it?
Omno’s customer rules by tag and volume and its limits per provider and method act as velocity controls, card blocking stops cards linked to fraud before any provider sees them, routing rules set which providers a payment can move through, and the routing-decision log records every attempt with its response code, which is the data needed to set and tune velocity limits.