Caribbean velocity rules are the layer of fraud detection that screens transactions based on frequency — how many times a card has been used, how many transactions have come from the same IP, how many attempts in a five-minute window. The default thresholds shipped by most processors were tuned on US transaction patterns. Applied unchanged to Caribbean traffic, they generate substantial false declines while missing the regional fraud patterns that matter. This piece walks through how velocity rules work, why the defaults need adjustment for the Caribbean, and what tuning looks like in practice.
A velocity rule is a count-based fraud signal. Examples: more than 5 transactions on the same card in 10 minutes triggers a flag. More than 12 attempts from the same IP address in an hour triggers a flag. More than $2,000 in cumulative volume from the same card in 24 hours triggers a flag. Each rule is independent. Together they form the velocity layer of the fraud detection stack.
Caribbean velocity rules are tuned through threshold settings — what counts, what windows, and what the action is when the threshold is crossed (decline, hold for review, require step-up authentication).
Why default velocity thresholds miss in the Caribbean
US-default velocity rules assume a few things about transaction patterns that are not true in the Caribbean.
US transaction velocity is typically dispersed across many different merchants. A US cardholder rarely runs 5 transactions in 10 minutes at the same merchant. Caribbean transaction velocity often concentrates — a hotel guest running 4-6 transactions in 30 minutes (room charges, restaurant, gift shop, spa) is normal hospitality behavior, not fraud. US-default thresholds would flag this. Caribbean-tuned thresholds should not.
US transaction velocity assumes broadband-connected merchants with steady transaction flow. Caribbean merchants on intermittent venue connectivity sometimes batch-process transactions when connectivity returns, producing momentary velocity spikes that are not fraud. The velocity rule needs to distinguish bursty merchant-side connectivity recovery from actual fraud bursts.
US transaction velocity assumes regional dispersion of IP addresses. Caribbean ISP concentration means that a meaningful share of legitimate Caribbean customers share IP address ranges through a small number of ISPs. A velocity rule that flags "more than 8 attempts from the same /24 IP block in an hour" catches a Caribbean ISP shared-NAT range and triggers false declines on legitimate cardholders.
What caribbean velocity rules should typically look like
Tuned thresholds for Caribbean merchant velocity rules vary by merchant category but a common starting point:
Same-card velocity: 7-10 transactions in 10 minutes for hospitality merchants, 3-5 for retail. The hospitality threshold accommodates the normal multi-charge hotel pattern. The retail threshold catches genuine card-testing fraud.
Same-IP velocity: 15-20 attempts in 60 minutes (vs the US default of 8-10). The higher threshold accommodates Caribbean ISP NAT ranges.
Cumulative-volume velocity: $3,500-5,000 in 24 hours per card for hospitality and tour operators, $1,500-2,500 for retail. The hospitality threshold accommodates package-pricing patterns.
Time-of-day velocity: relaxed in early-morning hours (5am-9am) for hospitality, where check-out timings concentrate transactions; relaxed on cruise days for retail.
These are starting points. Each merchant needs to tune based on their own observed legitimate transaction patterns.
How to actually tune caribbean velocity rules
The tuning process is iterative. Three weeks of monitoring data, then a tuning adjustment, then three more weeks of monitoring, then another adjustment.
Start by pulling the merchant velocity-flag log for the first three weeks under default thresholds. Each flag should be classified as: actually fraud (the merchant believes the transaction was fraudulent), false positive (the merchant believes the transaction was legitimate), or unclear.
The false-positive rate tells you which thresholds are too tight. If 75% of flags are false positives, the threshold is too low. Raise it.
The fraud-catch rate tells you which thresholds are too loose. If actual fraud is leaking through without triggering a flag, the threshold is too high. Lower it. (This requires separately identifying fraud that came through unflagged — typically the chargebacks that arrived weeks later that should have been caught at the velocity layer.)
The tuning is per-merchant. A boutique hotel needs different velocity thresholds than a coffee shop, even if both are running on the same processor.
What the operational rhythm looks like
A merchant running caribbean velocity rules well has the following monthly process:
- Review velocity-flagged transaction log, classify each.
- Calculate false-positive rate and fraud-catch rate.
- If false-positive rate is above 30%, raise thresholds.
- If fraud-catch rate is below 80%, lower thresholds.
- Adjust per-category if specific merchant categories are showing different patterns.
This process takes about 30 minutes a month. It pays back in two ways: fewer false declines (recovering legitimate revenue that would have been lost), and tighter fraud catch (avoiding chargebacks that should have been blocked).
Talk to our team on WhatsApp →
The interaction with other fraud signals
Caribbean velocity rules do not exist alone. They interact with AVS, 3DS, device fingerprinting, BIN analysis, and processor-level fraud scoring. A transaction that triggers a velocity flag plus a 3DS failure plus an AVS no-match is materially higher risk than one that triggers velocity alone.
The processor-level fraud scoring engine should weight velocity flags appropriately. A velocity flag in isolation might not justify a decline. A velocity flag combined with two other risk signals usually does. The tuning of caribbean velocity rules should think about the rule as one input to the broader fraud score, not as a standalone decline gate.
Where this leaves Caribbean merchants
Caribbean velocity rules are one of the highest-leverage fraud-detection levers a Caribbean merchant has, and one of the most commonly left at default settings that do not fit the region. The merchants who tune them properly recover meaningful false-decline revenue and tighten their actual fraud catch. The merchants who leave them at US defaults pay both costs invisibly. Spending 30 minutes a month on tuning is among the highest-ROI fraud-prevention work a Caribbean merchant can do.