Fraud Scoring at Signup: Combining Email, Phone, and IP
The strongest signup fraud defense combines email, phone, and IP risk into one decision. Learn how to layer these signals into a real-time scoring model.
No single signal catches fraud reliably. A disposable email might be a privacy-minded real user; a VoIP number might be someone's only phone; a datacenter IP might be a developer on a VPN. The magic is in the combination. When you score email, phone, and IP together at signup, the individually-ambiguous signals resolve into a clear picture, and that combined picture is what separates modern fraud prevention from brittle single-rule blocklists.
The three pillars
- Email: disposability, deliverability, alias abuse, and domain age/reputation.
- Phone: VoIP and prepaid detection, carrier, and line type.
- IP: residential vs datacenter classification, known-VPN flags, and geolocation.
Each pillar catches a different slice of abuse. Email flags throwaway identities, phone flags disposable verification, and IP flags anonymized or automated origins. Fraud that evades one pillar usually trips another.
Why combining beats any single check
Consider a signup with a 12-day-old catch-all email domain, a prepaid VoIP number, and a datacenter IP flagged as a known VPN. Any one of those might be explainable. All three together is not a real customer, it's automated abuse, and no single check would have been confident enough to act. Combination turns three medium signals into one high-confidence decision.
Building the score
- Collect email, phone, and IP at signup (you usually have all three already).
- Score each with a risk API and read the per-signal level and named signals.
- Weight and combine: sum weighted signals or take the worst-case level across pillars.
- Decide: allow, step-up verify, or block based on thresholds you tune to your risk tolerance.
const [email, phone, ip] = await Promise.all([
score("email_risk", { email }),
score("phone_risk", { phone }),
score("ip_risk", { ip }),
]);
const levels = [email.risk.level, phone.risk.level, ip.risk.level];
const worst = levels.includes("high") ? "high" : levels.includes("medium") ? "medium" : "low";
if (worst === "high") block();
else if (worst === "medium") stepUp(); // extra verification
else allow();Tune for your funnel
The right thresholds depend on what's at stake. A free newsletter can tolerate more risk than a fintech payout. Start permissive, watch where fraud slips through and where real users get caught, and adjust the weights. The goal isn't zero fraud, it's the best trade-off between fraud caught and good users unblocked.
Frequently asked questions
Why combine email, phone, and IP instead of using one?
Each signal catches different abuse and each has ambiguous cases on its own. Combining them turns several medium-confidence signals into one high-confidence decision and closes the gaps a single check would miss.
How do I combine the signals into one score?
Score each pillar with a risk API, then either take the worst-case risk level across them or sum weighted named signals against thresholds you tune. Map the result to allow, step-up, or block.
What thresholds should I use?
It depends on what's at stake in the flow. Start permissive, measure fraud caught versus real users blocked, and tighten weights over time toward the best trade-off for your product.
Try RiskUnified free
Score email, phone and IP risk from one API. 500 free credits every month, no credit card required.