Address mismatch, VPNs and rush shipping — what fraud signals actually mean
Risk signals are probabilities, not proof. Here is what each of the common ones actually tells you about an order — and how much weight it deserves.
Signals are weights, not verdicts
Every fraud signal has a false-positive rate. The mistake merchants make is treating one signal as proof, cancelling legitimate orders and training their team to ignore the queue.
A useful model assigns each signal a weight, sums them per order, and only escalates when the total crosses a threshold. Below is what each of the common signals is really telling you.
Address mismatch
Billing and shipping differ on a large share of perfectly normal orders. What matters is the shape of the mismatch: a different flat number is noise, a different continent is not.
Weight it higher when the shipping address is a reshipping service, when the same address appears across orders paid with different cards, or when the customer changes the address after payment.
VPN, proxy and data-centre IPs
A residential VPN exit tells you the customer values privacy. A data-centre or known-proxy IP is more suspicious because it is the cheap way to hide location in bulk.
Geographic distance between the IP and the billing address is the more useful version of this signal — and remember that mobile networks routinely place users hundreds of kilometres away.
Rush and expedited shipping
Fraudsters race the cardholder's statement. Overnight delivery on an item nobody urgently needs — especially when the shipping cost is a large fraction of the order — is a genuine signal.
It is also what impatient real customers pick during sales. Weight it moderately, and higher when combined with a resellable SKU and a new account.
Email and phone quality
Disposable domains and long random local parts are strong signals, because throwaway inboxes are how fraud scales. A free-mail address on its own means nothing.
A missing or clearly invalid phone number on a high-value order matters more than the number's format. Both fields are worth checking, because both are what you will use to verify the buyer.
Checkout behaviour
Time to checkout, pasted rather than typed card data, and repeated failed attempts before success are the behavioural core of card testing. These are among the highest-value signals available to you and the hardest for a fraudster to fake.
Velocity matters too: several orders from one device or address within minutes is worth more than any static attribute on the order.
Turning the score into an action
- Low total — fulfil automatically and move on.
- Medium total — send a verification email to the checkout address and ship once it clears.
- High total — hold, request a government-issued document, and only then decide.
- Any lane — log the outcome, so next month's thresholds are based on evidence.
Frequently asked questions
- Should I block orders from VPN IP addresses?
- No. VPN use is mainstream and privacy-conscious customers are often good customers. Treat it as a small weight that matters only when it stacks with other signals such as a mismatched address or a disposable email.
- Is address mismatch a reliable fraud indicator?
- On its own it is weak — gifts, office deliveries and parcel lockers all produce mismatches. It becomes strong when the two addresses are in different countries, or when the shipping address is a known freight forwarder.
- What is a good risk threshold to start with?
- Start conservative: auto-fulfil below about 30, verify between 30 and 60, and hold above 60. Then adjust monthly using your own dispute data instead of leaving the defaults in place forever.