What Are Velocity Limits? Stopping Fraud at Speed (2026)

Velocity limits are fraud rules that cap how many times, or how much, an action can happen within a time window: payments per card, attempts per device, refunds per account, new cards per user. When a threshold is crossed, the system blocks, challenges or flags the activity before losses grow.

In 2026, speed is the fraudster’s main weapon. Bots test thousands of card numbers in minutes, AI agents now shop on behalf of real customers, and Visa monitors card-testing attacks at acquirer level. Velocity limits remain one of the simplest and fastest defenses, as long as they are tuned to real customer behavior.

What are velocity limits?

A velocity limit answers one question: is this happening too often, too fast, to be normal? One payment on a card is ordinary. Fifteen payments of $1 on fifteen different cards from the same device in two minutes is an attack.

Velocity rules count events per key over a time window:

• Payment instrument: card number, network token, bank account, wallet.
• Customer: account ID, email, phone number, shipping address.
• Technical identity: device fingerprint, IP address, browser session.
• Merchant: for PSPs and PayFacs, the sub-merchant’s volume, declines and refunds.

They protect payments, but also logins, password resets, coupon redemptions, refunds and payouts.

How velocity limits work

1. Track: every event increments a counter for each key (card, device, IP, account).
2. Compare: the counter is checked against a threshold, for example “more than 5 attempts on one card in 10 minutes” or “more than €1,000 per account per day”.
3. Act: the system declines, asks for strong authentication, sends the case to review, or slows the user down.
4. Reset: the counter expires at the end of the window, rolling or fixed.

Typical layered rules: no more than 3 declined attempts per card per hour; no more than 10 different cards per device per day; no more than 2 refunds per account per week; 1 new card added per account per hour. In modern fraud engines, these counts also feed machine learning models as features, next to location, amount and time of day.

Where velocity limits are used

• Card testing: bursts of small authorizations, often on low-price products or donation pages, to find which stolen card numbers work.
• Account takeover: repeated login attempts, password resets, or a new device followed by an address change and a large order.
• Promotion abuse: the same person opening many accounts to reuse a welcome coupon or a free trial.
• Refund abuse: abnormal numbers of refund or “item not received” claims from one account or address.
• Bots on limited stock: tickets, sneakers or gift cards bought by the hundred in seconds.
• Payouts: a sudden change of bank details followed by a withdrawal, a classic account takeover pattern on marketplaces.

The limits of velocity limits

Fixed thresholds are easy to learn. Experienced fraudsters spread their attempts across many devices, IP addresses and cards, and stay just below the limit. Rules that are too tight have the opposite problem: they block loyal customers during peaks and generate false declines, which cost sales and support time. Velocity limits work best as one layer in a stack, with device intelligence, authentication and scoring models, and with thresholds reviewed against real outcomes: how many blocked attempts were fraud, and how many were good customers.

Velocity limits in numbers (2026)

• Card testing: in the second half of 2025, Visa blocked 13% more unique enumeration attacks at network level, and enumeration losses fell 16% year on year, largely thanks to tens of millions of suspected fraud attempts blocked.
• Merchants hit: card testing is one of the five most common attacks, each reported by at least a third of merchants. The average fraud rate by order rose from 3.0% to 3.5%.
• Smaller, more frequent fraud: in the UK, remote purchase fraud cases reached a record 3.2 million in 2025 (+13%), while the average case fell to £132, from £300 in 2016.
• Europe: card fraud was 17 times higher when the payee was outside the EEA, where strong customer authentication is not required.
• Bots and agents: AI-driven traffic to US retail websites grew over 4,700% in a year, according to Visa.

Velocity limits and the rules: schemes and regulators

Visa VAMP enumeration

Visa’s Acquirer Monitoring Program tracks card testing separately. A merchant is flagged when 20% or more of its authorization attempts are identified as enumeration, with at least 300,000 such attempts in a month. Fraud reports from successful testing also count in the VAMP ratio, which feeds chargeback monitoring.

Scheme limits on retries

Card schemes apply their own velocity limits to merchants. Mastercard charges a fee on authorization attempts made after 20 issuer declines on the same card within 24 hours. Retry engines and payment fallback logic must stay below these limits.

European rules

The agreed text of the new Payment Services Regulation requires PSPs to run transaction monitoring for fraud risk, and links failures to monitor with refund outcomes. As of October 2026, it was still awaiting formal adoption and publication, with most rules applying 21 months after entry into force. For instant payments, the Instant Payments Regulation lets customers set a limit per day or per transaction: a velocity limit chosen by the customer.

Velocity limits: what changes for PSPs, PayFacs and platforms

Stop card testing at the edge

Card testers look for weak checkouts: low-value products, no CAPTCHA, no authentication, detailed decline messages. Counting attempts per device, IP and session, before the authorization request is sent, stops the attack where it costs nothing. Returning generic decline messages gives testers less information.

Watch velocity per sub-merchant

For a PayFac, the key is also the merchant. A new sub-merchant whose volume jumps tenfold in a week, a spike in declines, or many refunds right after onboarding are classic signs of bust-out fraud or of a checkout under attack.

Tune for peaks and agents

Black Friday, ticket releases and live sales create bursts of real customers. Thresholds should adapt by merchant, product and season, and a challenge (3-D Secure, one-time code) is often better than a hard block. Purchases made by AI agents will change “normal” patterns too: Visa’s Trusted Agent Protocol, launched in October 2025, helps merchants tell trusted agents from malicious bots. The same question arises with cars, meters and other connected devices that pay on their own (see What is the Internet of Payment?).

Cover refunds and payouts

Velocity on refunds, payout account changes and withdrawals catches insider fraud and account takeover, where the damage is done after the payment. NORBr provides the white-label payment infrastructure to route, onboard, pay out and analyze, under your own brand.

Are velocity limits worth it in 2026?

Yes. They are cheap, fast and easy to explain to merchants, regulators and auditors. On their own they are not enough: fraudsters pace their attacks to stay under fixed thresholds. Combined with authentication, device data and machine learning, and reviewed regularly, they remain a first line of defense.