Your Fraud Stack Has Controls. Does It Have Memory?
Why signup, login, promotions, loyalty, and checkout should operate as one connected risk system
Most merchants have fraud controls throughout the customer journey. They screen new accounts, monitor logins, limit promotion abuse, protect loyalty balances, and evaluate transactions. Yet fraud still slips through because those controls often make decisions in isolation. Each one sees an event. The fraudster operates a journey.
A suspicious signup may not justify a block. A login from a new device may not trigger a challenge. A promotion redemption may sit just below a velocity threshold. A transaction may contain enough valid information to pass review. Separately, each event looks explainable. Together, they may reveal one coordinated operation.
Modern fraud prevention needs more than coverage at every touchpoint. It needs memory.
Fraud has learned to rotate
Fraudsters no longer need to reuse the same obvious identifiers. Email addresses and phone numbers can be replaced. IP addresses can rotate. Stolen credentials can make an attacker look like a trusted customer. Emulators, anti-detect browsers, and spoofing tools can change the device characteristics merchants use to recognize returning users.
Residential proxies make the problem harder by routing traffic through consumer internet connections that can resemble normal household activity. The operation remains connected even when its visible identifiers do not. The challenge is finding what persists underneath those changes.
Consider an actor who creates several accounts with different emails and phone numbers. Registrations arrive through rotating residential IP addresses, so no single address crosses a basic velocity rule. The accounts claim welcome offers and behave normally long enough to build credibility. Later, one accesses a compromised loyalty account, changes the shipping information, redeems stored value, and checks out with stolen payment credentials.
A point-in-time system sees unrelated accounts and transactions. A connected system looks for recurring device characteristics, spoofing indicators, shared addresses, reused payment instruments, behavioral similarities, referral relationships, and links to earlier abuse.
The goal is not to find one perfect identifier. It is to recognize the operation as the fraudster changes identities, accounts, and infrastructure.
Treat connections as evidence
A shared device is not automatically fraudulent. Neither is a location change, new phone, VPN, or unfamiliar network. Families share devices. Customers travel. People replace hardware and access accounts from work.
That is why device fingerprinting is most useful when combined with identity, network, behavioral, and transaction signals. One connection may be incidental. Several high-confidence connections appearing in sequence tell a stronger story.
Merchants should assess the confidence of a device match alongside IP and proxy intelligence, email and phone risk, behavioral indicators, and historical activity. Device intelligence tools, such as device fingerprinting by IPQS, can support that assessment by providing device identifiers, confidence scores, and related risk signals. A device match doesn’t have to become a verdict. It becomes one weighted connection within a broader risk profile, helping merchants identify continuity without relying on a single attribute.
The same principle applies to identity data. A new email address may be harmless. So may a temporary location change. A new email, VoIP number, rotating proxy, spoofed device, and repeated registrations from the same underlying environment create a different risk profile.
Modern fraud prevention should evaluate whether the account, device, network, identity, and behavior remain coherent over time. That context should begin with account creation, not when money finally moves.
Make trust conditional
Account age, loyalty status, transaction history, and previous approvals are useful trust signals. They are not permanent proof of legitimacy. An established account can be compromised. A safe device can become shared or infected. Contact details can change. An account built for fraud can be aged before it is monetized. Even a legitimate customer can begin abusing promotions or return policies.
The better question is not, “Is this a trusted account?” It is, “How much trust should carry into this session and this action?”
A familiar device, expected location, and consistent behavior may support a low-friction purchase. A new device paired with an anonymized connection, rapid credential attempts, recent profile changes, and an immediate loyalty redemption should reduce confidence, even when the account has years of history.
The action matters too. Viewing an order history does not present the same exposure as changing a password, transferring rewards, replacing a phone number, or purchasing easily resold goods. Account takeover prevention should reflect both session risk and the value at stake.
Trust should accumulate, but it should also be re-evaluated when the context changes.
Connect the journey
Every stage of the customer journey adds a different piece of evidence.
At signup, merchants can assess whether an identity appears credible, unique, and consistent with its device and network. Stopping account farms early reduces the inventory available for promotion abuse, credential testing, loyalty theft, and payment fraud.
At login, the question shifts from “Who created this account?” to “Does the current session still look like the person who usually controls it?” Device changes, location mismatches, automation, proxy use, and unusual behavior can expose risk before value leaves the account.
Promotions test whether the merchant can recognize the same operator behind different identities. Basic velocity rules count repeated values. More advanced controls examine relationships across devices, networks, addresses, payment instruments, referrals, and behavior.
Loyalty programs raise the stakes because the account itself holds value. Points, rewards, gift cards, status benefits, and stored payment methods can be monetized without a conventional fraudulent purchase. A new device that changes credentials and immediately drains a rewards balance deserves a different response than routine activity from a familiar customer.
Checkout completes the story. Transaction screening becomes more precise when it includes the history of the account, device, connection, identity elements, promotion activity, loyalty behavior, and related entities. The payment should be treated as the latest event in a relationship, not the first event that matters.
The value of that approach can be measured. One global beauty retailer implemented IPQS email validation, phone validation, and device fingerprinting at registration to address fake accounts used for loyalty abuse, coupon fraud, and unauthorized resale. Within the first quarter, the retailer reported an 84% reduction in successful fraudulent account creation, a 60% reduction in manual review, and a 32% decrease in chargebacks associated with fraudulent accounts.
Turn context into action
Connecting signals only matters if it changes the decision. A suspicious signup might require additional validation or limited account capabilities. A risky login could trigger step-up authentication while restricting sensitive changes. Promotion abuse may call for suppressed eligibility or review of linked accounts. A loyalty transfer could be delayed. A transaction could be approved, challenged, reviewed, or declined.
The response should match the event, the confidence in the signals, and the value at risk. Sending every anomaly through the same verification flow creates friction without necessarily improving detection.
Fraud flows can combine fraud checks, identity verification, and custom user inputs in configurable workflows. This allows ordinary activity to remain low friction while stronger verification is reserved for higher-risk moments. A connected system should remember good behavior too. Legitimate customers should not have to rebuild trust at every interaction. At the same time, fraudsters should not receive a clean slate because they changed an email address or IP.
Let outcomes travel backward
The journey should not end when a decision is made. Confirmed outcomes need to become new intelligence.
A chargeback reported weeks after an order may reveal that the same device appeared during account creation. A loyalty theft investigation may expose an earlier login anomaly. Several refund-abuse cases may connect through fulfillment details, referrals, or device history.
Feeding those outcomes back into the system helps merchants find where risk first appeared, not only where the loss surfaced. It also improves the next decision involving a connected account, device, address, or identity.
Feedback must be disciplined. Incorrect labels can spread weak assumptions through rules and models, while broad associations can penalize legitimate users who share devices or infrastructure. Useful memory depends on accurate outcomes, explainable connections, and regular review.
Organize around operations
Fraud teams are often divided by system or loss type. Marketing owns promotions. Identity teams own signup and login. Loyalty teams manage rewards. Payments teams manage checkout. Customer support handles refunds and account recovery. Fraudsters do not respect those boundaries.
Shared identifiers, common risk language, and coordinated policies help teams recognize when one operation crosses channels. Metrics should do the same. Chargeback rate alone cannot show the cost of fake accounts, promotion leakage, loyalty theft, refund abuse, false positives, manual review, or unnecessary customer friction.
Teams should be able to answer four questions: Where did the risk first appear? Where was it recognized? What value was exposed? How did the response affect legitimate customers?
The MRC’s 2025 Global eCommerce Payments and Fraud Report found that 57% of surveyed merchants experienced increased refund or policy abuse, while 47% identified refund abuse as their leading fraud attack. These losses reinforce the need to examine the full commercial relationship, including activity before and after payment.
Give the stack a memory
The payment page is one moment in a much longer relationship. Fraud prevention should begin with the first meaningful signal and become more informed with every interaction. That does not mean placing a hard block at every stage. It means carrying context forward as identities, devices, networks, behaviors, and value move through the customer journey. It means treating connections as evidence, keeping trust conditional, and matching the response to both risk and exposure.
The next evolution in fraud prevention is not another isolated checkpoint. It is a system that remembers what it learned, recognizes when the same risk returns in a different form, and changes the next decision accordingly.
About IPQS
IPQS provides fraud prevention and digital risk intelligence to more than 3,500 businesses worldwide. Founded in 2011, IPQS analyzes IP addresses, devices, email addresses, phone numbers and behavioral signals to help organizations identify bots, fake accounts, account takeover, payment fraud and online abuse. IPQS supports real-time risk decisions across account creation, authentication, transactions and other digital interactions. For more information, visit www.ipqs.com or contact us at news@ipqs.com.
About Alexander Hall
Alexander Hall is Vice President of Fraud Strategy at IPQS. Alexander brings a firsthand understanding of how criminals exploit gaps in identity verification, payment systems, and business processes. His experience across ecommerce, fintech, and banking informs a practical approach to fraud prevention, grounded in how attacks actually happen. At IPQS, he helps organizations connect the attacker’s mindset with actionable defenses, challenging assumptions about what makes a user, transaction, or digital interaction trustworthy.
