diff --git a/lib/reporting/fraud_metrics_lg99_report.rb b/lib/reporting/fraud_metrics_lg99_report.rb
index 734772e7447..8dfbae7d342 100644
--- a/lib/reporting/fraud_metrics_lg99_report.rb
+++ b/lib/reporting/fraud_metrics_lg99_report.rb
@@ -106,6 +106,7 @@ def query
             name
           , properties.user_id as user_id
         | filter name in %{event_names}
+        | limit 10000
       QUERY
     end
 
diff --git a/spec/lib/reporting/cloudwatch_client_spec.rb b/spec/lib/reporting/cloudwatch_client_spec.rb
index 66986b08b2e..5c371a59e51 100644
--- a/spec/lib/reporting/cloudwatch_client_spec.rb
+++ b/spec/lib/reporting/cloudwatch_client_spec.rb
@@ -58,33 +58,15 @@
 
     subject(:fetch) { client.fetch(query:, from:, to:, time_slices:) }
 
-    # Helps mimic Array<Aws::CloudWatchLogs::Types::ResultField>
-    # @return [Array<Hash>]
-    def to_result_fields(hsh)
-      hsh.map do |key, value|
-        { field: key, value: value }
-      end
-    end
-
     def stub_single_page
-      query_id = SecureRandom.hex
-
-      Aws.config[:cloudwatchlogs] = {
-        stub_responses: {
-          start_query: { query_id: query_id },
-          get_query_results: {
-            status: 'Complete',
-            results: [
-              # rubocop:disable Layout/LineLength
-              to_result_fields('@message' => 'aaa', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex),
-              to_result_fields('@message' => 'bbb', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex),
-              to_result_fields('@message' => 'ccc', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex),
-              to_result_fields('@message' => 'ddd', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex),
-              # rubocop:enable Layout/LineLength
-            ],
-          },
-        },
-      }
+      stub_cloudwatch_logs(
+        [
+          { '@message' => 'aaa', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex },
+          { '@message' => 'bbb', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex },
+          { '@message' => 'ccc', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex },
+          { '@message' => 'ddd', '@timestamp' => now.iso8601, '@ptr' => SecureRandom.hex },
+        ],
+      )
     end
 
     context ':slice_interval is falsy' do
diff --git a/spec/lib/reporting/fraud_metrics_lg99_report_spec.rb b/spec/lib/reporting/fraud_metrics_lg99_report_spec.rb
index 7c11894bb7e..2e743eb223e 100644
--- a/spec/lib/reporting/fraud_metrics_lg99_report_spec.rb
+++ b/spec/lib/reporting/fraud_metrics_lg99_report_spec.rb
@@ -2,7 +2,7 @@
 require 'reporting/fraud_metrics_lg99_report'
 
 RSpec.describe Reporting::FraudMetricsLg99Report do
-  let(:time_range) { Date.new(2022, 1, 1).all_month }
+  let(:time_range) { Date.new(2022, 1, 1).in_time_zone('UTC').all_month }
   let(:expected_lg99_metrics_table) do
     [
       ['Metric', 'Total'],
@@ -13,9 +13,8 @@
   subject(:report) { Reporting::FraudMetricsLg99Report.new(time_range:) }
 
   before do
-    cloudwatch_client = double(
-      'Reporting::CloudwatchClient',
-      fetch: [
+    stub_cloudwatch_logs(
+      [
         { 'user_id' => 'user1', 'name' => 'IdV: Verify please call visited' },
         { 'user_id' => 'user1', 'name' => 'IdV: Verify please call visited' },
         { 'user_id' => 'user1', 'name' => 'IdV: Verify setup errors visited' },
@@ -32,8 +31,6 @@
         { 'user_id' => 'user5', 'name' => 'IdV: Verify setup errors visited' },
       ],
     )
-
-    allow(report).to receive(:cloudwatch_client).and_return(cloudwatch_client)
   end
 
   describe '#lg99_metrics_table' do
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index 09c22c7a6e5..95b8bcb97e6 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -42,6 +42,7 @@
   config.include Capybara::RSpecMatchers, type: :component
   config.include AgreementsHelper
   config.include AnalyticsHelper
+  config.include AwsCloudwatchHelper
   config.include AwsKmsClientHelper
   config.include KeyRotationHelper
   config.include OtpHelper
diff --git a/spec/support/aws_cloudwatch_helper.rb b/spec/support/aws_cloudwatch_helper.rb
new file mode 100644
index 00000000000..0d588df3155
--- /dev/null
+++ b/spec/support/aws_cloudwatch_helper.rb
@@ -0,0 +1,26 @@
+module AwsCloudwatchHelper
+  # Helps mimic Array<Aws::CloudWatchLogs::Types::ResultField>
+  # @return [Array<Hash>]
+  def to_result_fields(hsh)
+    hsh.map do |key, value|
+      { field: key, value: value }
+    end
+  end
+
+  # @param rows [Array<Hash>]
+  def stub_cloudwatch_logs(rows)
+    query_id = SecureRandom.hex
+
+    stub_const('Reporting::CloudwatchClient::DEFAULT_WAIT_DURATION', 0)
+
+    Aws.config[:cloudwatchlogs] = {
+      stub_responses: {
+        start_query: { query_id: query_id },
+        get_query_results: {
+          status: 'Complete',
+          results: rows.map { |row| to_result_fields(row) },
+        },
+      },
+    }
+  end
+end