This rule uses statistical baselines to detect abnormal surges in merchant transaction volumes that may indicate fraud attacks or compromised accounts.

System flags when:
1. Merchant daily transaction volume exceeds 4x rolling average
2. Baseline calculated from historical merchant activity
3. Sudden volume spike deviates from normal business patterns

Volume spikes can indicate multiple fraud scenarios:
- Merchant account compromise (fraudster processing fake transactions)
- Terminal compromise being exploited for bulk fraud
- Organized fraud ring coordinated attack
- Money laundering operation (rapid high-volume processing)
- Merchant collusion with fraud ring

4x threshold is significant because:
- Normal business fluctuations rarely exceed 2-3x average
- Indicates substantial abnormal activity
- Balances fraud detection with legitimate business variations
- Reduces false positives from seasonal/promotional spikes

Alert enables fraud team to:
- Merchant contact for business validation
- Review of transaction legitimacy
- Velocity monitoring for escalation
- Terminal security inspection if needed
- Account suspension if fraud confirmed