A card that does not match the connection is worth a second look

The problem

Chargeback fraud does not announce itself at checkout. Every signal available is circumstantial, and the country a payment appears to come from is both the cheapest one to obtain and the easiest one to hide.

This is a signal, not a verdict, and treating it as a verdict is how you decline good customers. People buy things while travelling, from hotel wifi, and from behind a corporate VPN they did not choose. As one weighted input among several it earns its place.

What to read in the response

A mismatch on its own is weak. A mismatch on a connection that also reports vpn or hosting is a different thing, because it means the country was not merely different, it was chosen. That pairing is the rule worth writing.

Wiring it up

// Points added to whatever risk score you already compute. Nothing here declines
// on its own: this decides who is asked for 3-D Secure, not who is turned away.
function ipRisk(check, cardCountry) {
  let points = 0;

  // Compare on the code, show location.country to whoever reviews the decision.
  const relocated = check.location.country_code !== cardCountry;

  if (relocated) points += 10;
  if (check.vpn || check.hosting) points += 15;

  // Different country AND deliberately relocated: not a coincidence.
  if (relocated && (check.vpn || check.hosting)) points += 25;

  return points;
}

Where to draw the line

Never decline on this alone. Use it to decide who gets 3-D Secure rather than who gets refused, or add it to an existing rules engine as one weighted input. A false decline costs more than a chargeback and nobody writes in to complain about it.

What happens on an address nobody has seen

An address the database holds nothing on answers 404, not a low score. That is deliberate: there is no country, no operator and no ASN to return either, so a result would be a row of nulls dressed up as an answer. Treat it as no opinion rather than as clean, and decide for your own case whether to let the request through. The address goes into the scan queue and usually resolves within minutes, and the call is free on a paid plan.

Every field, every error code and the exact billing rules are in the documentation. Endpoints

Other things people use it for

• Game servers
• Signup abuse
• Geo-restrictions