3.8.3.2 - What are Velocity & Geolocation Fraud Rules for E-commerce Transactions? (Difficulty: Advanced | Path: Scale)

Imagine your online store as a bustling nightclub. Most patrons are there to have a good time and spend money legitimately. However, there are bad actors trying to sneak in. Some are using fake IDs (stolen credit cards), while others are aggressive bots trying to force open the back door hundreds of times a minute. If you rely solely on a manual bouncer checking every single ID by hand, your line will move too slowly, and legitimate customers will leave. Worse, if you have no bouncer at all, the fraudsters will flood your venue, run up a tab they never pay, and leave you with the bill.

This is where Velocity and Geolocation rules come into play. They act as your automated security system, operating silently in the background of every transaction. Geolocation rules function like a border control policy, deciding which regions are permitted to enter and transact based on your shipping capabilities and risk tolerance. If you do not ship to a specific continent, or if 90% of your fraud comes from a specific country, a geolocation rule stops those orders before they ever reach your payment processor.

Velocity rules, on the other hand, are your defense against speed and volume. Fraudsters rarely use a stolen card just once; they "test" thousands of stolen card numbers using automated scripts (bots) to see which ones work. This is called a "card testing" attack. A velocity rule detects this superhuman speed—such as five declined attempts in one minute—and automatically locks the door, preventing the bot from testing more cards. Without velocity checks, a single attack can result in thousands of authorization fees and a damaged reputation with your payment gateway.