Velocity: the attacker racing the clock and the shop owner leave the same trace

How it attacks

The attacker has one stolen card. Just one, and they know it will not last long. At some point the cardholder checks their statement or the bank calls, and the number dies.

So they run. They pull out everything they can in the time they have, and they pull it out in things that turn into cash without any explaining: gift cards, electronics, top-ups.

The amateur goes straight for it. Buys, buys something pricier, buys something pricier still. Burns out within the hour.

The professional builds the card a history before using it for real. A couple of small purchases, a quiet day, another small purchase. By the time the move that matters arrives, that card has spent days behaving well with you.

Both leave the same thing on the surface: several purchases within a few hours on the same payment method.

Who looks like it and is honest

Three customers do exactly that every month.

The shop owner. Goes restocking on Tuesday morning. Wholesale market, hardware store, packaging, the assistant's pay, the electricity bill. Fifteen or twenty purchases in two hours, on the same personal card, at merchants with nothing to do with each other. Around here the business card and the household card tend to be the same card.

The one who pays every bill at once. Their day of the month arrives and they clear eight bills in an hour: power, water, gas, internet, phone, rent. Same phone, same connection, one after another.

The one who just got paid. Payday landed. Within two days they buy the clothes they had been putting off, the gadget they had been eyeing for months, dinner out, the overdue gifts. Then they go back to one or two purchases a day.

All three trip the same velocity alarm.

The payday one is the most expensive to block, because their burst always falls on the same days of the month. A velocity rule with no further context will cut their purchase on payday, month after month, until they give up.

What actually separates them

• What gets bought. The shop owner moves through supplies, services and providers. The payday one mixes clothes, food and gifts. The attack burst concentrates on whatever resells fast.
• Where it ships. The honest customer sends everything to the address they have used before. In the attack new addresses show up, sometimes a different one per purchase.
• The shape of the amounts. In the honest burst amounts go up and down depending on what has to be paid. In the attack they move almost always upward, each purchase a little above the last.
• Whether it happened before. Bill day and payday repeat on similar dates month after month, and those earlier bursts ended fine. The attacked card has a single burst in its whole life with you.
• How it ends. The honest burst dies on its own, when the list of errands runs out. The attack burst keeps going until something cuts it.

The shop owner opening an account with you today also has a single burst and no history behind it. It takes several of these signals landing on the same case at once.

How it mutates once you detect it

Every purchase you decline tells the attacker where your limit is. With the next card they work around it.

1. You block on purchases per hour. They stretch the burst across the day and stay just under your limit.
2. You block the amount escalation. They flatten the curve. Every purchase lands in the normal range of your business and none stands out for being large.
3. You block the customer with no history. They manufacture one. Small purchases, a few quiet days, and only then the move they were after from the start.

Every mutation eats into their time, and time is the one thing that card does not have. The deadline is set by the day the cardholder reviews their statement.

The one in a hurry falls to a velocity rule, because their burst runs past the limit on its own. The one who does this every day already spreads their purchases below that same limit.

Closing

The work is in letting the payday burst through and stopping the other one, which during the first purchases looks the same. That depends on how much you know about that customer before the burst begins.

So how do you solve it?

Tuning this by hand takes days, and every day costs chargebacks and good sales. That is what we are solving at Frauddi. We will show you on your own data.

Book a free demo

Next: the first big purchase, the attacker who knows they get a single shot and the customer who barely uses your product until the fridge breaks down (3 of 9).