Interpreting an IP Fraud Score

Identify what the field measures

Read the provider's description for the exact field and product version. A transaction score, an IP risk field, a proxy classification, and a VPN indicator can all be numeric or categorical while describing different things. Similar ranges do not make them interchangeable across products or vendors.

MaxMind's current minFraud response separates the overall transaction risk_score from the IP object's risk field. Its response documentation gives both a 0.01–99 range, but describes risk_score as transaction fraud risk and ip_address.risk as risk associated with the IP. Its older proxyScore used a 0–4 scale and was replaced by IP risk in the newer services.

Preserve the field name and product version with every score; do not translate a value from one field or vendor into another scale.

The same IP can serve many users, and its assignments or observed behavior can change. Record lookup time, provider and field version, inputs sent, and the decision made. Keep the scoring result separate from what the target actually did.

Set a threshold from outcomes

Choose the decision before tuning the cutoff: approve, send for review, request another verification step, or decline. Assemble a representative history with confirmed outcomes and allow enough time for delayed chargebacks or investigations. Split results by relevant segment and time period when policies or traffic mix differ.

Choose the cutoff using a calibration period, then evaluate it on a later, untouched holdout period. Keep the outcome definitions and reporting window consistent; do not tune the cutoff again on the holdout results. For each proposed cutoff, count true positives, false positives, false negatives, and true negatives.

Calculate precision and recall, then include the cost of review, customer friction, lost legitimate sales, and accepted fraud. A threshold that catches more fraud may also send more legitimate customers to review. Report the outcome window and exclusions alongside the figures.

Illustrative example: In a hypothetical set of 100 transactions, 10 later become confirmed fraud and 90 are legitimate. A candidate threshold flags 8 of the 10 fraud cases and 9 legitimate cases. Recall is 8/10, or 80%; precision is 8/17, about 47%.

The threshold catches most labeled fraud in this example while sending 9 legitimate customers to review. These numbers show the calculation only; they are not vendor performance or a recommended cutoff.

Prefer a review band when outcomes are uncertain. Monitor appeals, review dispositions, delayed fraud reports, and false declines after launch. Recalculate by segment when the model, input fields, customer mix, or business policy changes. MaxMind says its sandbox scores and IP data are inaccurate and intended for basic integration checks, so sandbox responses cannot estimate production scoring quality.

Keep proxy checks separate

A fraud score cannot tell whether a proxy connection works. For proxy diagnostics, check the observed exit and the target's actual response in the same client and session. An IP echo proves only the address observed by that check. A successful proxy check does not validate identity, payment risk, or business legitimacy.

When an IP-based score affects a consequential decision, retain the provider response and the policy version used, limit access to sensitive inputs, and offer a path to review disputed outcomes. The proxy IP and browser diagnostics guide covers route checks; use transaction scoring documentation for transaction decisions.

ProxyLaneTraffic never expires

Premium residential proxies
From $2/GB

Scale your workflows with the tools you already use. Rotating or sticky sessions up to 72 hours.

Try 350 MB for $1.95 View plans