An Internet Protocol (IP) fraud score rates how likely it is that a given IP address is tied to fraudulent activity. The score is calculated using details from virtual private networks (VPNs), geolocation mismatches, transaction velocity, and proxy use, such as through data centres. Unfortunately, 30% – 95% of traffic on major residential proxy networks is associated with black hat or grey hat fraud activity, which makes fraud a global problem.

Businesses pull an IP fraud score – whether at checkout or when a customer creates a new account – to help decide whether to approve a transaction, send it for review, or block it outright. On its own, the IP fraud score relays information only about the transaction's online connection, not the person using it; this is where fraud strategies can go wrong.

Below, we'll discuss how to run IP fraud score checks, how businesses use them in payment risk models, and why relying on them too heavily can result in false positives for legitimate customers.

Key takeaways

• An IP fraud score uses details about VPN and proxy detection, geolocation mismatches, and the frequency of transaction attempts to estimate risk, but it can't confirm who's actually behind a transaction

• Relying on IP scores alone might create false positives for legitimate customers, including business travellers, remote employees using corporate VPNs, and people on shared mobile networks

• Certain software programs can draw on transaction data from millions of businesses to build a more complete picture of the potential risk of a single transaction than a stand-alone IP checker can offer

What is an IP fraud score?

An IP fraud score is a numerical or tiered rating that estimates how likely a given IP address is tied to fraudulent activity. To generate it, scoring tools check the IP address against databases of known VPNs, proxies, Tor nodes, and data centres, then add in behavioural history, such as account takeovers, card-testing attempts, and past chargebacks.

What signals determine an IP fraud score?

Typically, scoring tools pull from several types of information, painting a picture of the actual risk.

Here are the main signals used to determine an IP fraud score:

• VPN and proxy detection: The IP address gets checked against lists of known commercial VPNs and open proxies, where fraudulent actors can mask their real location or cycle through many identities from one connection

• Geolocation mismatches: If the IP address is found to be in St. Petersburg, Russia, but the billing address is in Toronto, Canada, that discrepancy is seen as a risk factor, especially on a first-time order with no purchase history to compare against

• Transaction velocity: An IP address that places a dozen orders in an hour, each on a different card, is seen as more suspicious than another that tries to complete a single transaction in one sitting

• Tor exit node usage: Tor routes online traffic through multiple relays to hide a potential transaction's origin, which makes it an almost automatic flag, even though many people use it for entirely legitimate privacy reasons

• Data centre traffic: Consumers don't typically shop from Amazon Web Services (AWS) or Google Cloud IP ranges; traffic that originates from sites such as these often points to a bot, a scraper, or a script running card-testing attempts

• Device fingerprinting signals: Browser configuration, screen resolution, and installed fonts are cross-referenced against the IP address to see whether the transaction looks like a real person or a scripted attack

How do businesses use IP fraud scores in payment risk models?

E-commerce businesses and payment platforms typically pull an IP score when a potential customer creates an account or attempts to buy something at checkout. At signup, a high fraud score could trigger extra identity checks before a new account receives full privileges. At checkout, it might prompt a decision about whether to approve the transaction, send it for manual review, or require an added authentication step.

Typically, risk models work off thresholds rather than a single pass-or-fail cutoff. A score under 25 could sail through with no complications, while a score between 25 and 75 might prompt added verification or be held for review. Anything above 75 often warrants caution, particularly when it's paired with other warning signs such as a mismatched billing address or an unusually large first-time order.

However, a business that blocks a transaction solely on a high risk score might be rejecting real customers. Weighing factors such as card verification, device data, and behavioural patterns allows a business to have a more complete picture when trying to make a decision on a transaction. Setting IP score ranges, or thresholds, too loose might let fraudulent orders slip through. But if they're set too tight, legitimate customers could be turned away at checkout. Many fraud teams treat threshold-setting as an ongoing calibration exercise.

Why do IP fraud scores create false positives?

Legitimate behaviour can appear risky at the network level, but each customer that is wrongly blocked or forced to complete extra verification steps can hurt a business's bottom line. On the other hand, repeated checkout complications can push customers towards competitors with easier checkouts.

Some of the biggest sources of false positives include:

• Corporate and university networks: Large organisations route thousands of employees through a small number of shared IP addresses, so one address can appear to generate an implausible volume of unrelated transactions

• Mobile carriers: Carrier-Grade Network Address Translation (CGNAT) means a single IP address can represent hundreds or thousands of distinct subscribers at once, which throws off any scoring based on transaction velocity

• International travel: A cardholder shopping from a country that hasn't been part of the customer's purchasing history will produce a geolocation mismatch that makes the transaction look like it involves a stolen card when the customer might just be travelling out of the country

• Privacy tools: VPNs are used for reasons unrelated to fraud, from workplace security policies to personal preference, but scoring models still treat them as an elevated risk factor by default

How do you check an IP fraud score?

When a business checks a single IP address, several stand-alone IP fraud score checkers will take an address and return a risk rating based in part on any red flags such as VPN, proxy, or data centre use. These systems are good for a one-off risk rating check or to understand why a particular transaction got flagged.

But checking IP addresses one at a time isn't always manageable for businesses processing a high volume of transactions. Ideally, IP scoring should be built into the same system that evaluates the card, the device, and the customer's behaviour in real time at checkout, with no added manual step. That way businesses don't have to pull scores manually and build their own rules around them; the scoring happens automatically as part of the payment flow.

Stripe Radar factors IP address and location data into its fraud scoring, but it doesn't treat that data as a stand-alone decision point. Radar evaluates each transaction against hundreds of signals, including IP address reputation and geolocation, along with card behaviour, device characteristics, and patterns specific to a business's own transaction history.

The scale behind Radar's IP address analysis sets it apart from a dedicated IP address checker. Radar trains its machine learning models on transaction data from millions of businesses on Stripe, which provides a clearer picture of normal and abnormal transaction behaviour across numerous industries, geographies, and customer types than any single business might build by watching its own traffic alone. That scale lets Radar pick up on emerging fraud patterns, such as a new proxy network or a coordinated card-testing wave, faster than a business that relies on static IP address blocklists. Radar also lets businesses layer custom rules on top of its machine learning score so a business can decide for itself how to respond when a transaction gets flagged for an IP address-related risk.

How Stripe Radar can help

Stripe Radar helps detect fraud and unlock growth, using AI trained on data from Stripe's global network. Radar helps protect your business from fraud throughout the customer lifecycle before it affects your bottom line, while helping you approve more legitimate customers and payments.

Radar can help your business:

• Prevent fraud losses: Radar's AI learns from more than US$1.9 trillion in annual transactions across Stripe's global network, helping it identify and block fraud patterns that individual businesses might not catch on their own

• Unify protection across evolving fraud attacks: Radar brings protection against transaction fraud, account fraud, and customer abuse all into one solution, so you gain unified protection across major fraud types

• Adapt as fraud evolves: Radar continuously adapts to changing fraud patterns, from first-party abuse to agentic transactions, helping protect your business against emerging threats

• Work with your existing tech stack: Use Radar with Stripe payments with no integration required, or access Radar's intelligence through programmable APIs, whether you process payments on Stripe or not

Learn more about Stripe Radar or get started today.

FAQs about IP fraud scores