This rule identifies potential card testing or credential stuffing attacks by monitoring transaction patterns within a specific time window.

It triggers when ALL of the following conditions are met:
1. Same card is used for multiple transactions
2. Each individual transaction amount is between AED 2,000 and AED 5,000
3. Two or more qualifying transactions occur within 60 minutes
4. The card is classified as an international card

This pattern is commonly associated with fraudsters testing stolen card credentials using small amounts before attempting larger fraudulent purchases. The system places these transactions on HOLD to prevent progressive fraud attempts.