Fraud has a rhythm. KODA's fraud engine applies payment fraud velocity rules to catch reused codes, impossible timing and suspicious bursts before they cost you.
— reads
A single fake payment is caught by arithmetic. But coordinated abuse looks different: many small test transactions, the same code retried again and again, rapid-fire attempts spread across minutes. That behaviour has a shape, and KODA's fraud engine is built to recognise the shape rather than only the individual message. Fraud, at scale, has a rhythm, and rhythm is something a machine watches far better than a tired cashier at closing time.
Velocity is simply the speed and pattern of activity. Every verification that runs through KODA is scored against a set of velocity and pattern rules before it is allowed to stand. A reference code that was already locked by an earlier order raises the score immediately. A sequence of attempts arriving faster than a human could realistically type them looks automated. A payment that claims to happen at a time that could not physically follow the previous one is flagged as impossible. Each of these signals is recorded in the same decision trace you can see on How KODA verifies mobile money payments.
Here is how it works in practice. When a payment arrives through any of the five doors, KODA does not just ask whether this one message is genuine; it asks whether this counterparty, this code and this burst of activity fit a normal customer or an attacker probing for weakness. Low-risk payments still clear in about three seconds with no friction. Only the patterns that match known abuse are held for a human to review, so the honest customer standing at your counter never notices the machinery working behind the verdict.
This matters for African merchants because the attacks are rarely one-off. A fraudster who finds a shop that ships on a screenshot will come back and industrialise it, testing dozens of variations to see what slips through. Across operators such as Orange Money, Airtel Money, M-Pesa and Wave, the tactics travel from market to market. Velocity rules turn the attacker's own persistence against them: the more they push, the more clearly their pattern separates from real trade, and the sooner they are stopped.
The common mistake merchants make is treating fraud as a series of unrelated incidents. They refund one bad order, shrug, and move on, never noticing that the same number tried six times that morning. Without a system watching velocity, the individual events never add up into the picture they actually form. KODA keeps that running picture so you do not have to hold it in your head, and it never blocks a genuine payment simply for being large or unusual on its own; it is the combination of signals over time that trips a hold.
the fraud engine does not work alone. It layers on top of the anti-forgery defence described in How KODA Catches Fake Payment SMS, which catches a doctored message on arithmetic grounds, while velocity rules catch the coordinated behaviour that no single message would reveal. Together they cover both the forged artefact and the campaign behind it. Screenshot forensics adds a third layer for merchants who still accept images, scoring them for signs of tampering before they are ever trusted.
When a payment is held, nothing is wasted. The evidence is already assembled and ready to flow into Win Mobile Money Disputes with an Automatic Evidence File, and confirmed abuse is pushed into the The Shared Fraud Network: One Attacker, Everyone’s Warning so your attacker becomes a known risk at every participating merchant. Nothing is a dead end: a held payment either clears on review and completes normally, or it becomes a documented case that strengthens your defences elsewhere. Parse health and engine status stay visible on KODA platform status & operator parse health, so you can always see the system is live and working rather than trusting a black box, and so a genuine customer waiting on a held order is never left in silence.
You cannot out-stare a determined fraudster, but you do not have to. Let the engine watch the rhythm of every payment and hold only what genuinely looks wrong. Get started with KODA free with KODA and put velocity rules to work on your busiest days, when a distracted moment is exactly what an attacker is counting on.
Payment velocity and pattern: reused references, impossible timing, and abnormal bursts. It works alongside the How KODA Catches Fake Payment SMS arithmetic defence.
Genuine payments verify instantly; only patterns that match abuse are held for review. Parse and health signals are visible on KODA platform status & operator parse health.