Guides
PortalContact Sales
Start typing to search…
  1. Risk & Fraud
  2. Risk Variables

Count Aggregation

The Count aggregation tallies the number of transactions, days, or events that meet specific criteria within a defined timeframe. Use it to monitor activity patterns like transaction frequency, failed attempts, or merchant-specific events.

Transaction Velocity

Track how many transactions occur in a period.

Days Since Event

Count days since last challenge or frictionless transaction.

Failure Detection

Monitor repeated failed attempts indicating fraud.

Configuration

Parameter
ParameterDescription
TransactionsCount transaction events
DaysCount days meeting criteria (limited timeframes)
📘

When counting Days, only "Since Last Challenged" and "Since Last Frictionless" timeframes are available.

Filter (Optional)

Narrow the count to specific conditions:

  • Transaction status (Succeeded, Failed, etc.)
  • Merchant name or ID
  • Device IP or ID
  • Amount thresholds

See Filter Options for full list.

Timeframe
TimeframeValues
Hour1–24
Day1–365
Week1–52
Month1–12
Since Last ChallengedN/A
Since Last FrictionlessN/A
Variable Name

Unique identifier for the variable (e.g., successfulAuth24h, daysSinceChallenge).

Using Count in Rules

successfulAuth24h > 10 → Challenge
failedAuth24h > 5 → Reject
daysSinceChallenge > 3 → Challenge

Examples

Frictionless Transactions in 24 Hours

Detect rapid transaction activity.

Type: Count
Parameter: Transactions
Filter: Was Challenged = false
Timeframe: 24 hours
Variable Name: successfulAuth24h

Rule: successfulAuth24h > 10 → Challenge

Failed Attempts by Device IP

Monitor repeated failed attempts from specific IPs.

Type: Count
Parameter: Transactions
Filter:
  - Transaction Status != Succeeded
  - Device IP = Equals to Current
Timeframe: 24 hours
Variable Name: failedAuth24hByIP

Rule: failedAuth24hByIP > 5 → Challenge

Merchant-Specific Transactions

Track concentrated activity at a merchant.

Type: Count
Parameter: Transactions
Filter:
  - Merchant Name = Equals to Current
  - Transaction Status = Succeeded
Timeframe: 24 hours
Variable Name: merchantSuccess24h

Rule: merchantSuccess24h > 15 → Challenge

Failed Device Attempts

Identify brute-force attacks from the same device.

Type: Count
Parameter: Transactions
Filter:
  - Computed Device ID = Equals to Current
  - Transaction Status != Succeeded
Timeframe: 24 hours
Variable Name: deviceFailed24h

Rule: deviceFailed24h > 3 → Challenge

Days Since Last Challenge

Track time since last challenged transaction.

Type: Count
Parameter: Days
Filter: None
Timeframe: Since Last Challenged
Variable Name: daysSinceChallenge

Rule: daysSinceChallenge > 3 → Challenge

How It Works

sequenceDiagram
    participant Card
    participant Aggregation as Aggregation Engine
    participant Rule as Conditional Rule

    Note over Card,Rule: 4-hour window (10:00–14:00)

    Card->>Aggregation: Transaction 1 (10:00)
    Aggregation-->>Aggregation: transactionCount4h = 0
    Aggregation->>Rule: count > 3? (No, accept)

    Card->>Aggregation: Transaction 2 (10:30)
    Aggregation-->>Aggregation: transactionCount4h = 1
    Aggregation->>Rule: count > 3? (No, accept)

    Card->>Aggregation: Transaction 5 (13:00)
    Aggregation-->>Aggregation: transactionCount4h = 4
    Aggregation->>Rule: count > 3? (Yes, challenge)

The variable reflects historical transactions in the window, starting at 0 for the first transaction and incrementing based on prior transactions.

Getting Started

  1. Navigate to Risk Profiles → select or create a profile
Risk Profile

  1. Click + under "User Defined Variables"

  2. Select Count aggregation type

  3. Configure Parameter, Filter, Timeframe, and Variable Name

Variable
  1. Use in a Conditional Rule
Risk Rule

Related Aggregations


Updated 18 days ago