Velocity Checks: Catching Card Testing Before It Becomes a Chargeback Pile

October 31, 2026 - RiskRampart

Card testing looks boring in a log. A few declined authorisations, a dollar here, a failed AVS there. Then the pattern resolves: hundreds of cards tried against your checkout in an hour, each tested cheaply so the stolen ones that pass can be sold or used elsewhere. Velocity checks are how you see the burst instead of the individual declines, by counting attempts per key over time and acting while the test is still running.

What velocity actually counts

A velocity rule pairs a key with a window: attempts per card number, per email, per IP address, per device fingerprint, in five minutes, an hour, a day. Any single key can look innocent. A device producing forty card attempts in ten minutes is not a clumsy customer. It is a script, and the count is the evidence no single transaction provides.

Thresholds need tuning per store. A gift card balance checker legitimately generates repeated small attempts. A normal checkout does not. Start by observing: run the rules in alert only mode, read a week of would be blocks, and separate the attacks from the odd power user before enforcing anything. Blocking on untuned velocity rules is how stores lock out their best wholesale customer during his monthly order.

Why attackers test on small stores and small amounts

Stolen card lists are sold untested, and buyers pay more for verified live cards. Testing needs a merchant who will attempt authorisation without much scrutiny, ideally with low value or donation style transactions that do not alert the real cardholder. Small and mid sized stores are targeted precisely because enterprise checkouts run these controls by default.

The cost to the test site is not the tiny transactions. It is the authorisation fees on hundreds of declines, the card network monitoring programmes that count your decline and dispute ratios, and the chargebacks when tested cards are later used or when cardholders spot the test charges. Cheap tests are only cheap for the tester.

Layering velocity with the rest of the stack

Velocity is a tripwire, not a verdict. A tripped rule should step up scrutiny: challenge, review, or hold, in proportion to the rest of the signal. Combined with AVS and CVV results, device intelligence, and order value, it separates a botnet's Tuesday from a family's shared iPad at Christmas, which raw counts alone cannot do.

Share the counts across your own surface. Attackers probe the weakest endpoint, often a gift card or account page, then spend at checkout. Velocity tracked per silo misses the journey. Counted across the store, the probe and the purchase join into one story, and the defence gets to read it.

What to do during a live burst

Slow the endpoint, raise challenges on the affected keys, and contact your payment provider while it is happening, not in the morning report. Preserve the logs: IPs, devices, card BINs attempted, timestamps. Card networks and issuers use exactly that data, and a merchant who arrives with evidence gets treated as a victim and a partner. One who arrives with a surprise chargeback pile gets treated as a statistic.

Keep reading

Frequently asked questions

What is a velocity check in fraud prevention?

A rule that counts repeated attempts sharing a key, such as a card, email, IP address, or device, within a time window. Excessive counts indicate automated abuse like card testing, even when each individual attempt looks unremarkable.

What is card testing fraud?

Attackers run stolen card numbers through a merchant's checkout in small or low value attempts to learn which cards are still active. Verified cards are then used for larger fraud or resold. The test merchant absorbs authorisation fees, decline ratio damage, and some chargebacks.

How should velocity thresholds be set?

From your own traffic. Run rules in alert only mode first, inspect what would have been blocked over at least a week, and set thresholds above legitimate behaviour for your store type. Gift card and account pages usually need different limits from checkout.

What should I do during a card testing attack?

Rate limit or challenge the affected endpoint and keys, preserve full logs of the attempts, and notify your payment provider during the event. The logs help issuers kill the tested cards, and acting during the burst limits fee and ratio damage.