Fraudsters move fast. To evade detection, they use incognito mode, change IP addresses, and deploy bots for credential stuffing attempts, just to name a few. 

To stop them, businesses need to be as fast — or faster. 

Introducing Velocity Signals

Velocity Signals tracks key metrics at three levels: per VisitorID, per LinkedID, and per IP. This gives us a more granular view of user activity and helps identify unusual patterns that could indicate fraudulent behavior. Below is a breakdown of each category and how it contributes to detecting suspicious activity.

How Velocity Signals enhance fraud detection

Monitoring these signals at short intervals helps identify patterns indicating potential threats or anomalies. This rapid detection mechanism aids businesses in making informed decisions quickly, reducing the risk of fraud.

Per visitorID

• distinctIp: Number of distinct IP addresses linked to the visitorID.
  • What does it do? It can help prevent fraudulent activity or account sharing.
  • Why does it matter? Multiple IP addresses linked to the same visitor ID can indicate suspicious activity, such as a single user accessing an account from multiple locations, which is a common pattern for fraud or account sharing.
• distinctCountry: Number of distinct countries associated with a visitorID.
  • What does it do? It can help prevent geo-location based fraud
  • Why does it matter? Identifying when a visitorID is associated with multiple countries within a short timeframe can indicate suspicious activity.
• distinctLinkedId: Number of distinct linkedIDs associated with the visitorID.
  • What does it do? It can help prevent trial fraud 
  • Why does it matter? A large number of linkedIDs for one visitor might indicate that the same person is using multiple accounts, potentially violating platform terms.
• events: Number of events linked to the visitorID
  • What does it do? Helps prevent fraudulent transactions or abuse
  • Why does it matter? A high volume of events from a single visitorID may indicate automated behavior or attempts to manipulate the system

Per linkedID:

• distinctIpByLinkedId: Number of distinct IPs associated with the linkedID.
  • What does it do? It can help prevent account sharing or account takeovers. 
  • Why does it matter? Multiple IPs linked to a single LinkedID can suggest that the account is being used by different individuals or that the device has been compromised.
• distinctVisitorIdByLinkedId: Number of distinct visitorIDs associated with the linkedID.
  • What does it do? It can help prevent account sharing. 
  • Why does it matter? Recognizing when multiple visitorIDs are linked to the same account or linkedID can surface unauthorized account sharing.

Per IP:

• ipEvents: Number of events linked to an IP address.
  • What does it do? Can help prevent DoS attacks or credential stuffing.
  • Why does it matter? A high number of events from a single IP address in a short period can indicate automated attack attempts.

Getting started with Velocity Signals

All customers with access to our Smart Signals will automatically have access to Velocity Signals. It is available through Webhooks, Sealed Client Results, and the Server API at the existing Events endpoint as a property, making it easy to integrate into your existing fraud prevention workflows.

Key takeaways

Businesses looking to enhance their fraud detection efforts should incorporate Velocity Signals into their decision-making processes when visitors interact with their sites.