Velocity and Exposure Limits

What it is

Velocity and exposure limits set the blast radius. Every other control in this vault will sometimes fail (a model misses, an authentication factor is phished, a promo has a bug), and limits decide how much that failure costs. That makes them one of the highest-return controls in fraud, and one of the most often under-designed.

Kinds of limit:

What it stops (and what it doesn't)

• Stops or caps:
  • The size of any single ATO cash-out
  • The upside of kiting and instant-funding rings
  • The speed of a bust-out
  • Losses from a logic exploit before anyone notices (Case Study - Pinduoduo Coupon Exploit (2019) and Case Study - Robinhood Infinite Leverage Glitch (2019) are public examples of unbounded exposure)
  • Mule throughput per account
• Doesn't stop:
  • Fraud spread thin across many accounts unless entity and cluster limits exist (Entity Link Analysis)
  • Slow, patient extraction
  • Scams where the victim moves money within their normal limits

Design considerations

1. Size limits to trust, and let trust grow. Limits should follow the evidence you have about an entity:

• KYC tier (KYC and Customer Identification Program (CIP))
• Tenure and clean history (Customer Tenure and History)
• Verified funding and payout sources (Bank Account Ownership Verification)
• Device binding (Device Binding and Trusted Devices)
• Prior limit usage without losses

An illustrative ladder (structure only; calibrate to your data):

2. Tighten automatically on risk events. A contact change, MFA change, new device, recovery, return or dispute should immediately lower limits for a window (Contact Change Cooling-Off Periods). Attackers time cash-out right after changes. Limits should already be lower when they do.

3. Cap instant funding as aggregate exposure. For instant ACH pulls, mobile deposits, or instant buying power, track total uncleared exposure per entity and cap it. A customer making ten deposits each under the per-deposit limit can reach ten times the intended exposure without an aggregate cap. Pair with Funds Availability Holds.

4. Add destination limits. New payees, new bank accounts, new cards and new wallet addresses get their own cap that grows as the destination ages and successful payments accumulate. This is one of the most effective controls against Payout Redirection and first-time scam payments.

5. Add cluster limits. Aggregate exposure across accounts that share a device, funding source, payout destination, address or identity attribute. Rings beat per-account limits by multiplying accounts, and cluster limits remove that advantage (Multi-Accounting, Fraud Rings and Collusion).

6. Put program and global circuit breakers on new products. Size these in the Fraud Risk Assessment for the product. Every promo, new payout type or new funding product needs a total budget, a per-hour loss sentinel and a kill switch before launch. This is the main defense against Business Logic Exploitation (Promotion Design Guardrails, New Product and Promo Launch Review).

7. Treat an over-limit request as a decision point. At the limit, offer graded options: step up to raise the limit (Risk-Based Authentication and Step-Up), split across days, downgrade the rail, or send to review. Make sure limit-check failures don't fail open.

8. Don't publish exact limits. Disclose that limits exist and how customers can raise them. Avoid publishing exact thresholds that let attackers size transactions just under them. Watch for amounts clustering just below a limit, which is a classic probing signal (Velocity Signals).

Industry lens.

• Brokerage: instant buying-power caps; withdrawal caps after bank-link changes; outbound ACATS reviewed above thresholds; caps on concentrated buys of thinly traded securities from new or changed accounts.
• Neobanks: instant-ACH and early-direct-deposit exposure caps; P2P and RTP daily caps by tenure; card-to-bank push limits.
• Payments / P2P: first-send-to-payee caps; sender and receiver velocity; card-funded send caps.
• Cashback / rewards: per-account and per-device redemption caps; caps per offer and per store; withdrawal minimums and maximums; daily program budget sentinels.
• Marketplaces: new-seller payout caps; per-buyer refund velocity; store-credit cash-out limits.
• Retail: gift-card purchase limits per tender; return-without-receipt limits per identity.

Implementation path

Customer friction and trade-offs

• Limits most affect power users and new customers trying to move large amounts early (paydays, home purchases, consolidating investment accounts). Offer a high-assurance path to raise limits rather than making everyone wait.
• Limits that are too tight push customers to competitors or to support, where social engineering risk rises.
• Opaque limit hits frustrate customers ("transfer failed"). Clear messages ("You can send up to $X to a new recipient today; this increases over time") reduce complaints without revealing exact thresholds for every tier.
• In scams, a limit can be a feature: a capped first payment to a new payee reduces victim loss and buys time to intervene.

Measuring effectiveness

• Loss severity distribution: the size of individual fraud losses. Good limits cut the tail. Track p95 and max loss per incident by mechanism.
• Peak exposure: maximum outstanding uncleared and unvested exposure per entity and in total, compared with appetite.
• Limit-hit rate among genuine customers, and the conversion of the raise path.
• Probing indicators: the share of transactions just below thresholds; its growth suggests limits are known.
• Circuit-breaker performance: time from exploit start to automated cap. Dollars lost before and after the breaker tripped.

Common failure modes

• Per-account only, with no device, payee, funding-source or cluster limits.
• Per-transaction only, with no aggregate exposure cap on instant funding.
• Static limits that don't tighten after contact or MFA changes.
• Seasoning too fast, so bust-out rings grow limits deliberately.
• No circuit breaker on new promos or payout types.
• Fail-open limit checks during outages.
• Inconsistent enforcement across channels (API, partner, support-initiated transfers).

Regulatory and policy notes

• Reg E disclosures. Banks and fintechs offering EFT services must disclose limits on the frequency and dollar amount of transfers. Security-related limits can be described generally (Regulation E and Unauthorized Transfers).
• Instant payment rails. Both US instant rails now cap individual payments at $10 million: The Clearing House raised the RTP limit from $1 million to $10 million on February 9, 2025, and FedNow raised its customer credit transfer limit from $1 million to $10 million on November 12, 2025. On FedNow, participants can keep the network maximum or set lower limits of their own, and the Fed has added risk tools such as account activity thresholds. The network cap is not a risk limit; consumer-facing programs should set their own per-transaction, daily and new-payee caps far below it.
• Nacha 2026. Risk-based fraud monitoring by originators and RDFIs. Velocity monitoring and limits are a natural part of that (Nacha Rules and ACH Risk).
• Fair treatment. Limits based on tenure and verification are generally defensible. Avoid using protected-class proxies, and document the business rationale (Privacy and Data Use in Fraud Prevention).

Mechanisms addressed

• Instant Funding Abuse (Kiting), Check and Mobile Deposit Fraud, ACH Funding Fraud
• Account Takeover (ATO) and Real-Time Payment Rail Fraud
• Bust-Out Fraud
• Money Mules (throughput caps)
• Business Logic Exploitation, Promo Code Abuse, Sign-Up Bonus Abuse
• Loyalty and Rewards Redemption Fraud, Gift Card Fraud
• Authorized Push Payment (APP) Scams (first-payment caps)

Related controls

• Funds Availability Holds
• Rate Limiting and Throttling (request-level)
• Real-Time Transaction Risk Scoring
• Withdrawal and Payout Controls
• Contact Change Cooling-Off Periods
• Promotion Design Guardrails
• Seller Onboarding and Reserves
• Kill Switches and Circuit Breakers (emergency throttles and automatic breakers)
• Playbooks: Playbook - Instant Funding Abuse Members, Playbook - Business Logic Exploit Response Members, Playbook - Bust-Out Detection Members, Playbook - Payout and Withdrawal Risk Members
• Program: Exposure Window Modeling (sizing limits from expected and stress loss), Entity Resolution (entity-level limits)

Sources and further reading

• Nacha: Fraud Monitoring Phase 1: risk-based monitoring; red flags include bursts of credits and new or dormant accounts.
• J.P. Morgan: Nacha 2026 rule changes webinar: recommends velocity monitoring alongside validation and ownership matching.
• CFPB: Regulation E § 1005.6: consumer liability framework that shapes how far an institution can push limit design onto customers.
• Federal Reserve SR 21-14 (FFIEC Authentication and Access): layered controls for high-risk transactions, including push payments.
• Federal Reserve Financial Services: FedNow transaction limit increase (Nov 2025): $10M network limit effective November 12, 2025 (from $1M); participant-set lower limits
• Federal Reserve Financial Services FED360: FedNow $10M limit: participant risk tools including account activity thresholds
• Payments Dive: RTP limit increase: RTP $10M per-transaction limit effective February 9, 2025 (from $1M)