Device Intelligence + IP Geolocation: The 2026 Multi-Layer Fraud Prevention Blueprint

// Multi-Layer Fraud Detection System
async function multiLayerFraudDetection(requestData) {
  try {
    // Parallel execution for sub-50ms response time
    const [ipIntel, deviceFingerprint, behaviorScore] =
      await Promise.all([
        // Layer 1: IP Geolocation Check
        fetch(`https://api.ip-info.app/v1/geolocate?${requestData.ip}`, {
          headers: { 'x-api-key': process.env.IP_INFO_API_KEY }
        })
        .then(r => r.json()),

        // Layer 2: Device Fingerprint Verification
        verifyDeviceFingerprint(requestData.deviceContext),

        // Layer 3: Behavioral Analysis
        analyzeBehavioralPattern(requestData.interactionData)
      ]);

    // Correlation engine combines all intelligence sources
    const riskAssessment = correlateIntelligenceSources({
      // IP Risk Factors (35% weight)
      ipRisk: {
        isProxy: ipIntel.is_proxy,
        isVpn: ipIntel.is_vpn,
        isTor: ipIntel.is_tor,
        fraudScore: ipIntel.fraud_score,
        countryRisk: ipIntel.country_risk_level,
        distanceFromUser: calculateDistance(
          ipIntel.location,
          requestData.claimedLocation
        )
      },

      // Device Risk Factors (40% weight)
      deviceRisk: {
        fingerprintMatch: deviceFingerprint.confidence,
        deviceAge: deviceFingerprint.first_seen_days,
        isEmulator: deviceFingerprint.is_emulator,
        isRooted: deviceFingerprint.is_rooted,
        screenAnomaly: deviceFingerprint.screen_mismatch,
        historicalFraud: deviceFingerprint.fraud_history
      },

      // Behavioral Risk Factors (25% weight)
      behaviorRisk: {
        humanScore: behaviorScore.human_probability,
        typingCadence: behaviorScore.typing_consistency,
        mouseMovement: behaviorScore.mouse_naturalness,
        navigationPattern: behaviorScore.flow_legitimacy,
        timeOnPage: behaviorScore.engagement_quality
      }
    });

    // Dynamic threshold based on transaction value
    const dynamicThreshold = calculateThreshold(
      riskAssessment.totalScore,
      requestData.transactionValue
    );

    // Risk-based response
    if (riskAssessment.totalScore >= dynamicThreshold.block) {
      return {
        allowed: false,
        reason: 'High-risk transaction blocked',
        riskFactors: riskAssessment.flaggedFactors,
        blockedBy: ['ip', 'device', 'behavior'].filter(
          layer => riskAssessment.layers[layer].exceedsThreshold
        )
      };
    } else if (riskAssessment.totalScore >= dynamicThreshold.challenge) {
      return {
        allowed: false,
        reason: 'Additional verification required',
        challengeType: determineChallenge(riskAssessment),
        riskScore: riskAssessment.totalScore
      };
    } else {
      return {
        allowed: true,
        riskScore: riskAssessment.totalScore,
        confidence: riskAssessment.confidence
      };
    }
  } catch (error) {
    // Fail securely: deny on system errors
    logger.error('Multi-layer detection failed', { error, request: requestData.id });
    return { allowed: false, reason: 'Security verification unavailable' };
  }
}

// Intelligence correlation engine
function correlateIntelligenceSources(data) {
  const weights = { ip: 0.35, device: 0.40, behavior: 0.25 };

  // Calculate individual layer scores
  const ipScore = calculateIPRisk(data.ipRisk);
  const deviceScore = calculateDeviceRisk(data.deviceRisk);
  const behaviorScore = calculateBehaviorRisk(data.behaviorRisk);

  // Cross-layer anomaly detection
  const anomalies = detectCrossLayerAnomalies({
    ip: data.ipRisk,
    device: data.deviceRisk,
    behavior: data.behaviorRisk
  });

  // Weighted composite score
  const totalScore = (
    (ipScore * weights.ip) +
    (deviceScore * weights.device) +
    (behaviorScore * weights.behavior)
  ) + (anomalies.length * 15); // Penalty for cross-layer anomalies

  return {
    totalScore: Math.min(100, totalScore),
    confidence: calculateConfidence(data),
    layers: { ip: ipScore, device: deviceScore, behavior: behaviorScore },
    flaggedFactors: identifyFlaggedFactors(data),
    exceedsThreshold: totalScore > 70
  };
}

// Cross-layer anomaly detection
function detectCrossLayerAnomalies(data) {
  const anomalies = [];

  // Anomaly: Device location mismatch with IP geolocation
  if (data.device.estimatedLocation) {
    const distance = calculateDistance(
      data.ip.location,
      data.device.estimatedLocation
    );
    if (distance > 500) { // 500km threshold
      anomalies.push({
        type: 'location_mismatch',
        severity: 'high',
        distance: distance,
        description: {'Device location ' + distance + 'km from IP location'}
      });
    }
  }

  // Anomaly: Bot-like behavior from residential IP
  if (data.behavior.humanScore < 30 && !data.ip.isProxy) {
    anomalies.push({
      type: 'behavior_ip_mismatch',
      severity: 'critical',
      description: 'Automated behavior from legitimate-looking IP'
    });
  }

  // Anomaly: New device with established behavioral patterns
  if (data.device.age < 24 && data.behavior.patternConsistency > 85) {
    anomalies.push({
      type: 'synthetic_behavior',
      severity: 'high',
      description: 'Perfect behavior on brand-new device'
    });
  }

  return anomalies;
}