Synthetic Identity Fraud Detection: How IP Intelligence Exposes $6B in Fake Personas

// Real-time synthetic identity check
interface IdentityRiskScore {
  score: number;  // 0-1, higher = more suspicious
  flags: string[];
  recommendation: 'approve' | 'review' | 'decline';
}

async function checkSyntheticIdentity(
  application: IdentityApplication,
  ipAddress: string
): Promise<IdentityRiskScore> {
  const flags: string[] = [];
  let riskScore = 0;

  // Get IP intelligence (23ms average)
  const ipData = await ipInfoClient.lookup(ipAddress, {
    fields: ['location', 'security', 'connection', 'asn']
  });

  // Check 1: Address-IP geographic mismatch
  const addressLocation = await geocode(application.address);
  const distance = haversineDistance(
    addressLocation,
    ipData.location.coordinates
  );

  if (distance &gt; 500) {  // More than 500km
    flags.push('geographic_mismatch');
    riskScore += 0.25;
  }

  // Check 2: Residential address but datacenter IP
  if (isResidentialAddress(application.address) &&
      ipData.connection.type === 'hosting') {
    flags.push('residential_datacenter_mismatch');
    riskScore += 0.35;
  }

  // Check 3: Proxy/VPN detection
  if (ipData.security.isProxy || ipData.security.isVpn) {
    flags.push('anonymization_detected');
    riskScore += 0.30;
  }

  // Check 4: Residential proxy (sophisticated fraud)
  if (ipData.security.isResidentialProxy) {
    flags.push('residential_proxy');
    riskScore += 0.40;
  }

  // Check 5: Timezone mismatch
  if (application.timezone !== ipData.location.timezone) {
    flags.push('timezone_inconsistency');
    riskScore += 0.15;
  }

  // Determine recommendation
  let recommendation: 'approve' | 'review' | 'decline';
  if (riskScore &gt;= 0.6) {
    recommendation = 'decline';
  } else if (riskScore &gt;= 0.3) {
    recommendation = 'review';
  } else {
    recommendation = 'approve';
  }

  return { score: Math.min(riskScore, 1), flags, recommendation };
}

// Fraud ring detection through network clustering
interface NetworkCluster {
  identifier: string;  // ASN, /24 range, or proxy network
  identityCount: number;
  riskLevel: 'low' | 'medium' | 'high' | 'critical';
  relatedApplications: string[];
}

async function detectFraudRing(
  newApplication: IdentityApplication,
  ipData: IPIntelligence
): Promise<NetworkCluster | null> {
  const lookbackDays = 90;
  const suspiciousThreshold = 3;  // 3+ identities from same network

  // Check ASN-level clustering - query returns count
  // SQL: SELECT COUNT(*) FROM identity_applications
  //      WHERE asn = ? AND created_at > DATE_SUB(NOW(), INTERVAL ? DAY)
  const asnCount = await getASNApplicationCount(ipData.asn.asn, lookbackDays);

  if (asnCount >= suspiciousThreshold) {
    // Get IP range for more granular analysis
    const ipRange = getIPRange(ipData.ip, 24);  // /24 subnet

    // Get applications in this range with claimed states
    // SQL: SELECT application_id, claimed_state FROM identity_applications
    //      WHERE ip_address BETWEEN ? AND ?
    //      AND created_at > DATE_SUB(NOW(), INTERVAL ? DAY)
    const rangeApps = await getRangeApplications(
      ipRange.start, ipRange.end, lookbackDays
    );

    // Check for state diversity (fraud rings often claim multiple states)
    const uniqueStates = new Set(rangeApps.map(r => r.claimed_state));

    if (uniqueStates.size >= 3) {
      return {
        identifier: `ASN:${ipData.asn.asn}`,
        identityCount: asnCount,
        riskLevel: 'critical',
        relatedApplications: rangeApps.map(r => r.application_id)
      };
    }

    return {
      identifier: `ASN:${ipData.asn.asn}`,
      identityCount: asnCount,
      riskLevel: 'high',
      relatedApplications: rangeApps.map(r => r.application_id)
    };
  }

  // Check for residential proxy network signatures
  if (ipData.security.isResidentialProxy) {
    const proxyProvider = ipData.security.proxyProvider;

    // SQL: SELECT COUNT(*) FROM identity_applications ia
    //      JOIN ip_lookups ip ON ia.ip_address = ip.ip_address
    //      WHERE ip.proxy_provider = ?
    //      AND ia.created_at > DATE_SUB(NOW(), INTERVAL ? DAY)
    const proxyCount = await getProxyApplicationCount(proxyProvider, lookbackDays);

    if (proxyCount >= 2) {
      return {
        identifier: `Proxy:${proxyProvider}`,
        identityCount: proxyCount,
        riskLevel: 'critical',
        relatedApplications: []
      };
    }
  }

  return null;  // No clustering detected
}

// Velocity analysis for synthetic identity detection
interface VelocityCheck {
  passed: boolean;
  violations: string[];
  cooldownMinutes: number;
}

async function checkApplicationVelocity(
  ipData: IPIntelligence,
  application: IdentityApplication
): Promise<VelocityCheck> {
  const violations: string[] = [];
  let cooldownMinutes = 0;

  // Check 1: IP velocity (applications per IP per day)
  // SQL: SELECT COUNT(*) FROM identity_applications
  //      WHERE ip_address = ? AND created_at > DATE_SUB(NOW(), INTERVAL 24 HOUR)
  const ipVelocity = await getIPVelocityCount(ipData.ip, 24);

  if (ipVelocity >= 2) {
    violations.push('ip_velocity_exceeded');
    cooldownMinutes = Math.max(cooldownMinutes, 60);
  }

  // Check 2: ASN velocity (applications per ASN per hour)
  // SQL: SELECT COUNT(*) FROM identity_applications
  //      WHERE asn = ? AND created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)
  const asnVelocity = await getASNVelocityCount(ipData.asn.asn, 1);

  if (asnVelocity >= 5) {
    violations.push('asn_velocity_exceeded');
    cooldownMinutes = Math.max(cooldownMinutes, 120);
  }

  // Check 3: Time-of-day anomaly
  const ipHour = new Date().getUTCHours() + (ipData.location.timezone_offset || 0);

  // Applications at unusual hours for claimed residence (2-5 AM local)
  if (ipHour >= 2 && ipHour <= 5) {
    const nightCount = await getNightApplicationsCount(ipData.ip, ipData.location.timezone);

    if (nightCount >= 2) {
      violations.push('unusual_hours_pattern');
      cooldownMinutes = Math.max(cooldownMinutes, 240);
    }
  }

  // Check 4: Cross-state velocity (same IP, different claimed states)
  // SQL: SELECT DISTINCT claimed_state FROM identity_applications
  //      WHERE ip_address = ? AND created_at > DATE_SUB(NOW(), INTERVAL 30 DAY)
  const crossStateApps = await getCrossStateApplications(ipData.ip, 30);

  if (crossStateApps.length >= 2) {
    violations.push('cross_state_velocity');
    cooldownMinutes = Math.max(cooldownMinutes, 1440);  // 24 hours
  }

  return {
    passed: violations.length === 0,
    violations,
    cooldownMinutes
  };
}