---
title: "Fraud prevention with contact and IP checks"
url: "https://lookvalid.com/use-cases/fraud-prevention.md"
canonical_url: "https://lookvalid.com/use-cases/fraud-prevention"
last_updated: "2026-10-18"
type: "conceptual"
summary: "A lookup cannot prove a person is honest, but it can show where a request came from, whether the network is a hosting range or Tor exit."
related: ["https://lookvalid.com/use-cases.md", "https://lookvalid.com/products/ip.md", "https://lookvalid.com/use-cases/onboarding-verification.md"]
---

# Fraud prevention with contact and IP checks

A lookup cannot prove a person is honest, but it can show where a request came from, whether the network is a hosting range or Tor exit.

A lookup cannot prove a person is honest, but it can show where a request came from, whether the network is a hosting range or Tor exit, and whether the phone number and email domain fit what the person told you. Those signals let a fraud team route the odd ones to review instead of approving everything.

## The problem

A fraud analyst usually works a queue of orders, signups and payouts where one detail looks slightly off: a billing country that does not match the connection, a phone number with a type that does not fit, an email on a throwaway domain. Checking each by hand across separate tools is slow, so most items get a quick look or none.

Missing the mismatch costs chargebacks, abused trials and accounts that exist only to cause trouble. Over-blocking costs real customers who happen to use a VPN or a work address. The useful middle is a short set of facts per request that a rule or a person can weigh.

The FTC reported that consumers reported losing more than $12.5 billion to fraud in 2024. (2024; [New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024 (Federal Trade Commission)](https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024), read 2026-10-18.)

## What LookValid does for this

- [Where the request came from](https://lookvalid.com/products/ip.md): Returns country, region, city, time zone, the network owner and flags for hosting ranges and Tor exit nodes, plus a risk score with the factors behind it. Location is an estimate from open data, so use it as one input. (1 credit per lookup)
- [Does the number fit the story](https://lookvalid.com/products/phone.md): Checks the number against its country numbering plan and returns the formats, the country and the number type the plan assigns, such as mobile or VoIP. It does not tell you whether the line is active. (1 credit per valid number)
- [What the email domain is](https://lookvalid.com/products/email-domain-check.md): Reports MX, SPF and DMARC for the domain, and whether it is disposable, a free mailbox provider or a role mailbox. It never contacts the mail server, so it cannot confirm that a mailbox exists. (1 credit per address checked)
- [How old the domain is](https://lookvalid.com/products/domain-age.md): Returns the registration, update and expiry dates and the registrar from the public registry record. A domain registered days ago is a useful flag next to a business claim. (2 credits per registered domain (unregistered domains are free))

## A real request and response

This request checks one IP address from a signup. The response is a real capture: location, the network that owns the address, the hosting and Tor flags and the risk factors that produced the score.

```json
{
  "ip": "8.8.8.8"
}
```

Real response, captured 2026-10-18:

```json
{
  "found": true,
  "data": {
    "ip": "8.8.8.8",
    "version": 4,
    "country": "US",
    "region": "California",
    "city": "Mountain View",
    "latitude": 37.422,
    "longitude": -122.085,
    "timezone": null,
    "asn": 15169,
    "asn_org": "Google LLC",
    "is_hosting": true,
    "hosting_provider": "Google",
    "is_tor": false,
    "is_vpn": null,
    "risk_score": 25,
    "risk_factors": [
      {
        "factor": "hosting_provider",
        "points": 25,
        "description": "The address belongs to a cloud or hosting provider (Google), where traffic is often automated."
      }
    ],
    "attribution": "IP geolocation by DB-IP"
  }
}
```

## Questions

### Can one lookup decide whether to block a customer?

No. Each lookup returns facts about an address, number or domain. A rule or a reviewer decides what to do when several facts disagree with what the customer told you.

### Does the IP check detect every VPN?

No. It flags hosting provider ranges and Tor exit nodes from open lists. The VPN field is null when the data cannot say, so treat it as a hint rather than a verdict.

### Can I tell whether a phone number is active?

Not from the phone lookup. It reads the numbering plan, so it returns the number type the plan assigns but does not query carriers or check that the line is reachable.

## Sources

- [New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024 (Federal Trade Commission)](https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024), read 2026-10-18

## Related

- [What teams use LookValid for](https://lookvalid.com/use-cases.md)
- [IP Intelligence API](https://lookvalid.com/products/ip.md)
- [Onboarding verification: check signup details](https://lookvalid.com/use-cases/onboarding-verification.md)