Q: How did a single velocity rule cut our fraudulent signups by 64%?

Q: How did a single velocity rule cut our fraudulent signups by 64%?

A: Velocity rules limit how fast the same identifier (IP, device, email pattern) can act. They're cheap to set up and one of the most effective single defenses. Here's a real result.

A registration-offer affiliate was getting hammered by bursts of signups. They added one rule: no more than 3 signups per IP per hour, and no more than 5 per device fingerprint per day.

What the logs showed before the rule:
— A handful of IPs were producing 40-60 signups each in minutes
— One device fingerprint appeared across 200+ accounts

After the rule went live, flagged fraudulent signups dropped 64% in the first week. Genuine users almost never hit the cap — fewer than 0.3% of legitimate signups bumped against it, and those got a soft 'try again later' rather than a hard block.

Short version: a simple per-IP and per-device velocity cap kills most bulk fraud while barely touching real users.

Still stuck? Drop your case in the comments.