Should transactions be blocked simply because a VPN is detected?
VPN usage is a risk signal, not proof of fraud. The most effective approach is to evaluate VPN usage alongside other contextual signals such as transaction history, geography, account behavior, and infrastructure characteristics before acting.
Similar questions
How can organizations use Spur IP intelligence within a fraud decisioning workflow?
Many organizations incorporate Spur IP intelligence into risk-scoring models, adaptive authentication systems, transaction reviews, account creation workflows, and trust-and-safety investigations. Spur IP intelligence is most effective when combined with behavioral, device, and identity signals.
Can Spur IP intelligence help identify coordinated fraud rings?
Fraud rings frequently share infrastructure, anonymization services, proxy providers, or geographic patterns. Spur's Infrastructure-level intelligence can help uncover relationships that may not be visible when reviewing accounts individually.
How can organizations reduce false positives when using Spur IP intelligence?
Organizations should avoid making decisions based on a single signal. VPN usage, proxy detection, geographic anomalies, and infrastructure classifications are most effective when evaluated together with customer history, transaction context, and other risk indicators.
What signals can indicate possible location spoofing?
Potential indicators include VPN usage, proxy activity, mismatches between an IP's expected and observed location, infrastructure classifications that conflict with expected user behavior, unusual location changes, and inconsistencies between geographic, device, and behavioral information.
How can Spur IP intelligence help prevent payment fraud?
Spur IP intelligence adds context about the infrastructure behind a transaction, including VPN usage, proxy activity, network type, geographic consistency, and historical risk indicators. These signals can be incorporated into fraud models to improve decision-making and reduce both false positives and false negatives.
Related guides & explainers
Why Residential Proxy Classifications Can Appear on Legitimate Infrastructure
Residential proxy networks recruit real consumer devices to relay traffic, so a legitimate ISP's own IP ranges can show a residential-proxy classification without the ISP's knowledge or involvement.
How Spur IP Classifications Work: Observed Behavior, Not IP Ownership
Spur classifications describe what was observed happening on an IP during a given window, not who owns the IP or ASN — a key distinction when investigating a classification that looks wrong.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Switching Between Organizations
If your account belongs to more than one Spur organization, use the Organization Switcher to move between them and manage each organization's plan and settings separately.