What are velocity checks?

A velocity check counts how often something happens within a time window and flags it when the rate exceeds what ordinary use produces. Nine password resets on one account in ten minutes, forty signups from one IP in an hour, six referral redemptions from one device in an afternoon: none of these is impossible, and all of them are worth a second look.

How velocity checks work

Every velocity check has three parts: the action being counted, the entity it is counted against, and the window used for the count. The pattern comes from card payments and anti-money-laundering transaction monitoring, where velocity rules have been standard for decades, and it transfers to account abuse unchanged. The choice of entity often determines whether the check is useful. Counting logins per account catches a brute-force attempt against one target and nothing else. Counting failed logins per IP catches the more common pattern of one attacker working through a long list of accounts and trying each only twice.

Where velocity checks fall short

Used alone, velocity checks are blunt instruments, and any sophisticated fraud operation is built to stay below them. Spread the same volume across enough accounts, devices, and hours, and no individual rate leaves the normal range even though the overall campaign is enormous. Thresholds are awkward to tune as well: set them too tightly and shared networks or busy customers produce false positives; set them too loosely and the patient abuser strolls through.

A cleverer threshold does not fix the problem. The useful step is to stop treating every entity as independent. Once accounts are linked through shared devices, networks, and sessions, the meaningful rate is the one measured across the whole cluster: exactly the number the abuser was trying to keep invisible.

Velocity in Dregs

Dregs uses velocity analyzers for login attempts, password-reset pressure, one-time-code requests, and signup bursts. Each contributes to the Behavior score as a weighted observation rather than firing a standalone rule. Because scoring happens over an identity's accumulated history and its linked identities, a rate spread thin across a cluster of accounts is still counted together. Teams can add their own thresholds through custom rules and lists, and every observation shows the counts and windows behind it. The result is less manual review of accounts that turn out to be nothing more sinister than a busy Tuesday.

Frequently Asked Questions

Q: What is the difference between a velocity check and a rate limit?

A: A rate limit protects infrastructure and is enforced immediately: exceed it and the request is refused. A velocity check protects against fraud and is usually evaluated after the fact: exceed it and the account is scored, flagged, or queued for review. The thresholds differ accordingly. A rate limit sits far above normal use so nobody legitimate ever meets it; a velocity threshold sits close to normal use, because the whole point is to notice behavior that is merely unusual rather than physically excessive.

Q: What should velocity checks be keyed on?

A: Anything an abuser has to reuse. Per-account is the obvious key and the easiest to evade, since the answer is simply more accounts. The keys that catch coordinated abuse are the shared ones: device fingerprint, IP or subnet, email domain, payment instrument, and referral code. A campaign that looks unremarkable per account often looks absurd per device.

Q: Do velocity checks produce false positives?

A: Yes, and predictably so. Shared networks (offices, universities, carrier CGNAT) concentrate unrelated users behind one IP, and legitimate bursts happen constantly: a customer onboarding a team, a user who has genuinely forgotten a password four times. This is why velocity is best used as one weighted input to a score rather than a standalone rule, so a burst on its own is not enough to punish an account.

Detect abuse campaigns that stay below simple thresholds.

Dregs helps you detect abuse campaigns designed to stay below per-account thresholds. It measures activity across linked accounts and devices, so distributed attacks still add up without flooding your team with false positives.

Schedule a Demo