Connected Identity Signals: How Linking IP, Device, and Account Data Exposes Fraud Rings

A single fake account rarely looks suspicious on its own. It has a plausible name, a working email address, a phone number that receives texts, and an IP address that geolocates to a real city. Fraud teams that review each signup or transaction in isolation will approve it, and they'll approve the next forty that look just as clean. The pattern only shows up when you stop asking whether one account looks risky and start asking what that account shares with everyone else.

The scale of the problem makes that shift urgent. The FBI's 2025 Internet Crime Report logged 1,008,597 complaints and $20.877 billion in reported losses, a 26% jump over 2024 and the first year complaints topped one million. Roughly $17.7 billion of those losses came from cyber-enabled fraud, and schemes at that size depend on infrastructure: batches of accounts, pools of proxies, and devices reused across identities. Below, we'll walk through the three signal layers that matter most: IP, device, and account, and show how linking them turns scattered weak evidence into a clear picture of a fraud ring.

Why Single-Signal Checks Miss Coordinated Fraud

Most fraud controls were built around scoring models that evaluate one event at a time. A login gets a risk score based on its IP reputation; a checkout gets a score based on order value and shipping address; and a new account gets a score based on whether its email domain appears disposable. Each check is useful, and each is easy for an organized group to pass. Fraudsters buy aged email accounts, route traffic through residential IPs, and keep order values below the thresholds that trigger manual review.

Proxies and VPNs make the IP layer especially slippery. Traffic that flows through residential and datacenter proxy networks carries an IP address that isn't the user's own, and residential proxies use addresses tied to consumer ISPs, so they look like ordinary home connections. A rule that blocks known datacenter ranges will catch careless attackers but miss those who've paid for better infrastructure. The individual signal still has value, but it can't carry the decision by itself.

Synthetic identities create a related blind spot. The Federal Reserve's synthetic identity fraud definition separates primary elements, such as name, date of birth, and Social Security number, from supplemental elements like email address, phone number, and digital footprint data, including device ID and IP address. Supplemental elements can make a fabricated identity look legitimate, but they can't establish one on their own. That distinction matters for detection, because supplemental elements are exactly what fraudsters tend to reuse when they're running many identities at once.

The Three Signal Layers That Matter Most

Connected identity analysis pulls signals from three layers and treats each one as a potential link between accounts. None of these layers is new, and most fraud teams already collect all three. What's usually missing is the step that compares them across accounts rather than scoring them within a single account.

1. IP Signals

IP data tells you where a session appears to originate and what kind of network carries it. Useful attributes include the address itself, the /24 subnet, the autonomous system number, the connection type (residential, mobile, hosting, or business), and flags for VPN, proxy, or Tor exit nodes. On their own, these attributes describe risk, but across accounts they describe relationships: twelve new accounts created from the same subnet within an hour tell a very different story than twelve accounts scattered across six states. Merchants already rely on IP intelligence for e-commerce fraud prevention to catch location mismatches and proxy traffic, and the same data gets far more useful once it's treated as a join key.

2. Device Signals

Device fingerprints capture the mix of browser version, operating system, screen resolution, installed fonts, time zone, language settings, and hardware traits that a session presents. Mobile apps can add stronger identifiers, such as an app instance ID or a device attestation result. A fraudster can rotate IP addresses cheaply, but swapping physical devices or fully randomizing a fingerprint takes real effort, so device signals tend to persist across accounts longer than network signals do. When one fingerprint appears across accounts with different names, birthdays, and addresses, you're looking at one of the strongest indicators of shared control available.

3. Account Signals

Account data covers everything a user hands you at signup and everything they change afterward. Email addresses, phone numbers, shipping and billing addresses, payout bank accounts, and payment cards all count, along with behavioral details like signup time and the order in which profile fields were filled. Fraud rings often reuse these elements with small variations, such as Gmail dot variants, sequential numbers from the same VoIP provider, or different unit numbers associated with the same street address. Normalizing the data before comparing it, so that "j.smith" and "jsmith" resolve to the same mailbox, catches reuse that exact matching would miss.

What a Fraud Ring Looks Like Once You Connect the Signals

Picture a lending platform that approves 40 new accounts in a week, each with a different name and Social Security number. Each passed identity verification and IP screening. Linked together, the picture changes: 31 share one of three device fingerprints, 18 logged in from the same residential proxy subnet, and 9 list payouts routed to just two bank accounts. No single account crossed a risk threshold, yet the cluster as a whole is unmistakable.

Rings tend to take a few recurring shapes. Some form a hub where a single device or payout account connects to dozens of identities. Others form a chain in which account A shares a phone number with account B, B shares a device with C, and C shares an address with D, so the endpoints don't look related until you trace the full path. Chains are harder because they're built to defeat pairwise comparison, and they're why multi-hop analysis matters.

Timing adds another dimension. Legitimate customers who happen to share an IP address, such as roommates or coworkers on an office network, usually sign up on different days and behave differently afterward. Ring accounts often register in bursts, sit dormant for a similar stretch while they clear a probation window, and then cash out within the same few days. Adding timestamps to each link lets you separate coincidental overlap from coordinated activity.

Modeling Identity Signals as a Graph

Relational tables can store all of these signals, but they struggle with questions that span several hops. Finding every account within four links of a known fraudster means a chain of self-joins that slows down with each step, and adding a new data source often means reworking the schema. Graph models handle this more naturally, since accounts, devices, IP addresses, phone numbers, and payout accounts become nodes and each observed relationship becomes an edge. A question like "which accounts share a device with anyone who shares a payout account with a confirmed fraudster" turns into a straightforward traversal.

Graph analytics fraud detection applies algorithms across that whole network of relationships instead of scoring one record at a time. Connected component analysis groups every account that links to every other through any chain of shared signals. Community detection finds dense clusters inside larger, noisier components, and distance-to-fraud scoring measures how many hops separate a new account from a confirmed bad actor. Those graph-derived features can then feed existing machine learning models, which helps a lot when labeled fraud examples are scarce.

Speed matters as much as depth. A ring that's flagged after cash-out results in a loss report, while a ring that's flagged at account opening results in a declined application. Running these traversals in real time, as signups and payments happen, lets a platform check a new account's neighborhood before approving it. That requires a data store that can traverse several hops in milliseconds, so the graph has to sit inside the decision path rather than in an overnight batch report.

Practical Rules for Linking Signals Without Flagging Real Customers

Shared signals aren't proof of fraud, and treating them that way will hurt legitimate users. Families share Wi-Fi, universities route thousands of students through a handful of gateways, and mobile carriers put huge numbers of subscribers behind carrier-grade NAT. Weighting each link by its rarity solves much of this. Two accounts sharing a residential IP used by three accounts in total means far more than two accounts sharing a carrier gateway used by fifty thousand.

Link strength should also reflect how costly a signal is to fake or share by accident. A shared payout bank account or a shared device fingerprint rarely happens by coincidence, so it deserves heavy weight. A shared IP address or ZIP code is cheap and common, so it should only matter in combination with other links. A sensible rule is to require at least two independent signal types before escalating a cluster, which prevents a single noisy layer from driving decisions.

Finally, decide what each cluster score actually triggers. Low-confidence links can add friction, such as step-up verification or a short payout hold, without blocking anyone outright. High-confidence clusters that touch a confirmed fraud case can justify declines or account freezes, as well as a review of every connected account. Feeding analyst decisions back into the graph as labels sharpens the next round of scoring and builds the training data most fraud models are short on.