The "same device, same IP address" link is a strong signal, but it gets weaker when fraud rings rotate through residential proxies. Adding the IP type to the account-linking step helps: residential proxy, VPN, Tor or hosting. The ipgeolocation.io IP Security API (ipgeolocation.io/documentation/ip-security-api.ht…) returns those flags with provider names and last-seen dates, which can feed the cross-account layer you describe.