IP Geolocation Fraud Detection: Impossible Travel, Country Mismatch, and More
Patch: integrate geolocate-based fraud checks using haversineDistance and risk scoring into your authentication flow.
Patch: add checkImpossibleTravel and checkCountryMismatch to your login handler, store last login geolocation, and block suspicious sessions.
Summary
The article outlines a fraud detection strategy that leverages IP geolocation to flag suspicious activity. It describes four key signals: impossible travel (detecting rapid geographic jumps), country mismatch (billing country vs. IP country), high‑risk region matching, and VPN/proxy detection. The core logic uses a haversineDistance function to compute the distance between two latitude/longitude pairs and compares it to the elapsed time to determine if the travel speed exceeds 900 km/h. The checkCountryMismatch function simply compares the country code from the geolocation API to the user’s billing country. The isHighRiskRegion function checks against a predefined set of high‑risk country codes. Finally, a risk score aggregates these signals, and the article notes that VPN/proxy detection requires a dedicated service like IPQualityScore.
The implementation is written in TypeScript, uses async/await for API calls, and is designed to be integrated into a login or transaction flow. By storing the last login geolocation and timestamp, the system can flag accounts that exhibit impossible travel or country mismatches, providing an additional layer of fraud prevention.
This approach is lightweight, relies on publicly available geolocation data, and can be extended with external VPN detection services for higher confidence.
Key changes
- haversineDistance calculates distance between two lat/lon points
- checkImpossibleTravel compares last login location and time to detect speed >900 km/h
- checkCountryMismatch verifies billing country vs. IP country
- isHighRiskRegion checks against HIGH_RISK_COUNTRIES set
- risk score aggregates these signals
- VPN/proxy detection requires external API like IPQualityScore
- Last login geolocation and timestamp are stored for comparison
- Functions are written in TypeScript and use async/await