Use case summary
Set volume-based limits per customer, per merchant account, per commerce account and card network, and on the route itself. Limits run daily, weekly, or monthly, with counters that reset automatically, and block, grey, and allow lists cover the cards, emails, and countries you have already decided about. Result: a new fraud pattern stops at a ceiling you set rather than running until someone notices.
- Payment Manager
- Payment Ops
Why fraud rules alone leave exposure open
Fraud rules encode what you have already seen. They catch the patterns someone wrote a rule for, which means they work well on last quarter's fraud and say nothing about the attempt that starts tomorrow morning.
While a new pattern runs, nothing stops it except attention. A card tested in small amounts, a customer account cycling through stolen numbers, a merchant in your portfolio whose volume triples overnight: each of these can run for hours before it registers as anything other than growth.
Acquirers add their own version of the problem. Most set volume conditions on the accounts they give you, and exceeding one quietly is a conversation nobody wants to have with the provider processing their traffic.
How to cap exposure at every level
Rules decide whether one payment looks wrong. Limits decide how much can go through before the system stops accepting, whatever the rules think.
- 1
Cap volume per customer
The customer turnover attribute in payment gateway routing sets volume-based limits for a single customer, so one account cannot keep processing past a ceiling you chose.
- 2
Cap volume per merchant account
Turnover limits for a merchant account are set in routing filters as daily or monthly ceilings, with counters that reset automatically at the start of each period.
- 3
Cap volume per card network
Commerce account turnover limits can be set separately for each card network, on payments or payouts, as daily, weekly, or monthly thresholds. This is also how teams keep within the volume conditions an acquirer has set.
- 4
Watch the card itself
Routing metrics cover turnover and the number of transactions per card number, which is what catches a single card being tested repeatedly rather than a customer spending more than usual.
- 5
Pause the route at its ceiling
Turnover caps pause a route once it reaches its daily volume limit and resume it when the limit resets, so traffic moves on rather than pushing one provider past its agreed volume.
- 6
Keep decided cases on lists
Block and allow lists cover the cards, emails, IPs, and countries you have already made a decision about. Lists take bulk uploads of up to 200000 items; a card mask or customer email can be added to a list straight from a payment; and external services can feed in their own sanction lists and decisions.
What you get
A fraud pattern you have never seen still stops at a number you chose in advance.
A known worst case
Because every level has a ceiling, the most a new attack can cost before anyone intervenes is a figure you set, rather than however much it managed before someone noticed the graph.
Acquirer conditions kept without watching them
Limits per card network and per account hold you inside the volume conditions your providers set, which keeps a routine commercial arrangement from becoming a risk conversation.
One bad actor contained, not the whole channel
Caps at customer and card level stop the specific source, so the response to an attack does not have to be switching off a payment method for everyone using it.
Decisions that stay made
Once a card, email, or country is on a list, it stays handled, including in bulk, so the same fraudulent customer does not have to be caught again by a rule every time.
Card fraud losses in the EEA rose 29% in a single year
The European Banking Authority and the European Central Bank reported in December 2025 that fraud on EEA-issued cards reached €1.329 billion in 2024, up 29% year on year, while overall fraud rates as a share of transaction value stayed broadly stable. The report also notes that new fraud types are rising, particularly those that manipulate legitimate customers into authorizing payments themselves. Patterns that arrive faster than rules can be written are exactly the case that a ceiling covers and a rule does not.