Transaction Velocity

Velocity features are computed by aggregating transaction counts or amounts over sliding time windows (e.g., 1 minute, 15 minutes, 1 hour). A tumbling window resets completely after each interval, while a hopping window overlaps to provide smoother, continuous monitoring. The choice of window size directly impacts detection latency: shorter windows catch rapid bot attacks, while longer windows identify sustained, low-and-slow fraud campaigns. Feature engineering typically involves multiple concurrent windows to capture behavior at different temporal resolutions.

Raw velocity counts are far more powerful when segmented by categorical dimensions. Common segmentations include:

• Per merchant category code (MCC): Detects sudden spikes at specific merchant types
• Per device fingerprint: Identifies a single device attempting multiple transactions
• Per IP address or geo-location: Flags credential stuffing from a single origin
• Per payment instrument: Catches rapid card testing attacks This multi-dimensional approach transforms a simple count into a high-cardinality feature space that isolates specific fraud vectors.

Beyond absolute counts, derived velocity ratios provide normalized signals that are robust across different user profiles. Key examples include:

• Transaction amount velocity: Sum of amounts per window, catching high-value rapid transfers
• Decline ratio: Ratio of failed to successful attempts, a strong indicator of card testing
• Velocity acceleration: The rate of change of velocity itself, detecting the onset of an attack
• Unique merchant velocity: Count of distinct merchants, distinguishing normal shopping from rapid-fire fraud These derivatives reduce false positives from legitimate high-frequency users.

Simple count-based windows treat all events within the window equally. Exponential decay weighting assigns higher importance to recent events using a decay factor λ (lambda). The weighted velocity at time t is computed as a recursive sum: V_t = x_t + α · V_{t-1}, where α = e^{-λΔt}. This approach provides a smooth, continuously updated signal without the boundary artifacts of discrete windows, making it ideal for streaming architectures where event times are irregularly spaced.

Absolute velocity thresholds (e.g., '>10 transactions per minute') generate high false positive rates for legitimate high-volume users. Peer group comparison normalizes an individual's velocity against a cohort with similar behavioral profiles. A user's velocity is scored as a z-score or percentile rank relative to their peer group's historical distribution. This contextualization ensures that a corporate account's normal high-velocity behavior is not flagged, while a sudden spike on a typically dormant account triggers an alert.

A probabilistic model for sequences of discrete events occurring in continuous time. TPPs characterize the stochastic timing of transactions, modeling the intensity function that governs event arrival rates. By learning the distribution of inter-arrival times, a TPP can detect deviations from normal temporal patterns—such as a sudden surge in login attempts—that signal automated attacks. Unlike discrete-time models, TPPs naturally handle irregularly spaced events without binning.

A self-exciting temporal point process where each event temporarily increases the probability of subsequent events. This captures bursty behavior characteristic of coordinated fraud attacks, where a single malicious transaction triggers a cascade. The model decomposes intensity into a background rate and an excitation kernel, enabling precise differentiation between organic user bursts and scripted velocity spikes.

A computational paradigm for ingesting and analyzing continuous flows of event data in near real-time. Stream processors like Apache Kafka and Flink compute sliding-window velocity features—such as transactions per minute—directly on live data without batching. This enables fraud systems to calculate and act on velocity checks within milliseconds, blocking attacks before authorization completes.

An algorithmic technique for identifying moments where the statistical properties of a time series shift abruptly. In velocity monitoring, change point detection flags sudden transitions from a user's normal low-frequency behavior to high-frequency bursts. Methods like Bayesian Online Change Point Detection operate sequentially, updating beliefs about regime shifts with each new transaction to trigger real-time alerts.

A mathematical function that assigns exponentially decreasing weights to older observations. In velocity calculations, time-decay ensures recent transactions dominate the rate estimate while stale activity fades. A common formulation is the exponential moving average, parameterized by a half-life that controls how quickly historical influence decays—critical for adapting velocity baselines to evolving user behavior.

A sequential analysis technique that accumulates deviations from a target mean over time. CUSUM is highly sensitive to small, sustained shifts in transaction velocity that individual threshold checks might miss. When the cumulative sum exceeds a control limit, an alert fires. This makes CUSUM ideal for detecting slow-burn account takeover, where an attacker gradually ramps activity to evade velocity limits.