The verdict in three sentences
Fraud is not fought only with expensive tools: simple velocity rules stop the majority of automated attacks. Block after 3 attempts in 10 minutes, cap of 500,000 FCFA per order for a new customer, risk score 0 to 100 with manual review above 70. Well tuned, these rules cut fraud by 60 to 80 % while keeping false positives under 2 %.
The velocity rules that matter
Velocity measures how often a signal (card, IP, e-mail) occurs within a time window. An abnormal spike betrays a stolen-card test or a bot.
| 2026 rule | Recommended threshold | Action |
|---|---|---|
| Payment attempts | > 3 in 10 min | Temporary block |
| Different cards / same IP | > 2 in 1 h | Manual review |
| New-customer amount | > 500,000 FCFA | Verification |
| Orders / same e-mail | > 4 in 24 h | Alert |
| IP country ≠ delivery country | Mismatch | +20 to score |
| Consecutive OTP failures | > 3 | Account lockout |
The 0-to-100 risk score
Each signal adds points. Below a threshold, the order passes; above it, it is reviewed or declined. The goal is to block fraud without penalizing good customers.
| Score band | Interpretation | Decision |
|---|---|---|
| 0 to 30 | Low risk | Automatic approval |
| 31 to 50 | Moderate risk | 3-D Secure / stronger OTP |
| 51 to 70 | High risk | Phone verification |
| 71 to 100 | Critical risk | Manual review or decline |
| False positive target | — | < 2 % |
| Expected fraud reduction | — | 60 to 80 % |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Moussa, who runs a small accessories store in Thiès, faces a card-testing wave: 40 attempts in one night from the same IP. With a rule "block beyond 3 attempts in 10 minutes" and "max 2 cards per IP per hour", he stops 37 of the 40 tries automatically. On a 30,000 FCFA average basket, he avoids roughly 1,100,000 FCFA of potential fraudulent transactions and 4 to 6 future chargebacks.
FAQ
Do I need a developer to set these rules? No in most cases: modern payment platforms and e-commerce modules offer configurable velocity rules. Kolonell activates and calibrates them for you without code.
What attempt threshold should I trigger? A temporary block beyond 3 attempts in 10 minutes is a solid starting point, to be tuned to your average basket and volume. Too strict, it creates false positives.
What is a good risk score? A 0-to-100 score where you approve automatically below 30, strengthen authentication between 30 and 70, and manually review above 70. False-positive target: under 2 %.
How much does fraud actually drop? Well-tuned velocity rules cut fraud by 60 to 80 %, especially automated attacks and card testing. They complement, not replace, 3-D Secure and OTP.
Does mobile money need these rules? Yes, adapted: caps per new account, lockout after 3 OTP failures, number/device consistency checks. Velocity logic applies to every payment method.
Let's talk about your project. We calibrate your velocity rules and risk score to block fraud without disrupting your customers. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
