---
title: "Comment by Furqan Ashraf on \"Detecting Synthetic Identity Fraud\" | Hashnode"
description: "The \"same device, same IP address\" link is a strong signal, but it gets weaker when fraud rings rotate through residential proxies. Adding the IP type to the ac"
url: "https://hashnode.com/posts/detecting-synthetic-identity-fraud/6a834c593aa8a3ca3f701ffe/comment/6ace0b88349646b8f440f0c2"
---

[Discussion](https://hashnode.com/posts/detecting-synthetic-identity-fraud/6a834c593aa8a3ca3f701ffe)

Comment [Detecting Synthetic Identity Fraud](https://hashnode.com/posts/detecting-synthetic-identity-fraud/6a834c593aa8a3ca3f701ffe)

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 13](https://hashnode.com/posts/detecting-synthetic-identity-fraud/6a834c593aa8a3ca3f701ffe/comment/6ace0b88349646b8f440f0c2)

The "same device, same IP address" link is a strong signal, but it gets weaker when fraud rings rotate through residential proxies. Adding the IP type to the account-linking step helps: residential proxy, VPN, Tor or hosting. The ipgeolocation.io IP Security API ([ipgeolocation.io/documentation/ip-security-api.ht…](https://ipgeolocation.io/documentation/ip-security-api.html)) returns those flags with provider names and last-seen dates, which can feed the cross-account layer you describe.