Account takeover is fraud that looks like a customer. The attacker has valid credentials or a valid session, so the login succeeds, and everything after it happens inside a real account with real history. Detection has to rely on signals around the login rather than the login itself, and the network the request arrives from has long been one of the most useful.
It has also become one of the most misunderstood. For years fraud teams used a simple shortcut: traffic from datacenter ranges is suspicious, traffic from residential ISPs is a customer. That shortcut no longer holds. Attackers route through residential networks precisely because residential traffic used to be trusted, and some of those networks are built from compromised devices, as covered in the malware economy behind cheap residential proxies.
This guide is written for fraud and security teams. It covers which IP signals still carry weight, how to combine them, and why the response should rarely be a blanket block.
”Residential” is context, not trust
The first adjustment is conceptual. A residential IP tells you the request came through a consumer internet connection. It does not tell you the person behind it is the account owner.
Two facts make this worse than it sounds.
Residential addresses are shared. Carrier-grade NAT means many real households can sit behind one public address, particularly on mobile networks. Blocking an address can lock out many legitimate customers at once.
Residential addresses are reassigned. An address flagged last week may belong to someone else today. Reputation data about residential IPs goes stale quickly, which is covered in what is IP reputation.
So the network signal is still valuable, but as one input to a score, compared against what is normal for this specific account, not as a verdict.
The IP signals that still work
Consistency with the account’s own history
The strongest network signals are relative. An account that has logged in from one city and one ISP for three years, and suddenly logs in from a different country on a different ISP, is interesting. The same login on a new account means very little.
Useful comparisons include the country and region of the login against the account’s usual locations, the ISP or autonomous system against the ones the account normally uses, and the connection type against the account’s pattern, since a user who has only ever used a home broadband connection appearing on a mobile network is a weaker signal than the reverse.
Impossible or improbable travel
Two logins far apart in too little time for the user to have travelled between them. It remains a useful signal, with known false positives: mobile carriers that route traffic through distant gateways, corporate VPNs, and users who genuinely use privacy tools. Treat it as a reason to look closer, not a reason to block.
Velocity, measured at the right level
Classic velocity rules count attempts per IP. Credential stuffing through residential networks defeats that by spreading attempts across many addresses, each contributing only a handful.
So measure velocity where the attack concentrates instead:
- Per credential or username. Many failed attempts against one account from many different addresses.
- Per password. The same password tried against many different accounts.
- Per device fingerprint. One device appearing across many accounts.
- Per flow. A sudden rise in failed logins across the whole login endpoint, even when no single address stands out.
The distributed pattern is invisible per IP and obvious per account, per password and per flow.
Coherence between network and client
A request whose network says one country while its browser timezone, language and keyboard settings say another is an inconsistent visitor. Individually each mismatch has innocent explanations: travellers, expats, multilingual households. Several mismatches together, on an account with no such history, are a meaningful signal.
Anonymising infrastructure intelligence
Commercial IP intelligence can flag addresses associated with VPNs, hosting providers and residential proxy networks. It is useful, and it is probabilistic. Coverage of residential proxy exits is incomplete by nature, since those addresses belong to ordinary households and change hands. Use the flag to raise a score, and check how fresh the data is.
After the login: where takeover becomes visible
Many takeovers are only obvious from what happens next. Weight the network signals more heavily when they coincide with high-risk actions:
| Action | Why it matters |
|---|---|
| Password or email change | Locks the real owner out |
| MFA reset or new authenticator | Removes the owner’s second factor |
| New payout method or shipping address | Where the money or goods go |
| New device followed immediately by a high-value action | The classic takeover sequence |
| Bulk export of saved data | Harvesting the account |
A login from an unusual network followed by a quiet browse is a weak signal. The same login followed within minutes by an email change and a new payout method is a strong one.
Respond with friction, not walls
Because residential addresses are shared and reassigned, and because false positives land on real customers, the default response to a risky score should be step-up rather than refusal.
- Low risk: allow, and log for correlation.
- Medium risk: require a second factor or re-verification before sensitive actions.
- High risk: block the sensitive action, notify the account owner through a known channel, and hold changes for review.
Measure the cost of friction as carefully as the fraud it stops. A rule that challenges thousands of legitimate customers to catch a handful of takeovers is expensive in ways that do not appear in the fraud report.
Where external residential vantage points help fraud teams
Residential networks are also a tool for defenders, in specific and authorised ways.
Seeing your own flows as customers do. Your login, sign-up and checkout experiences can behave differently for consumer networks in different countries. Authorised testing of your own systems from realistic vantage points shows what real customers and real attackers encounter.
Grounding geo claims. When a user claims to be in a market, residential observation from that market shows what a genuine local session looks like, which helps calibrate coherence rules.
Watching where stolen accounts are sold. Takeovers are often preceded by credentials appearing in public dumps or on account-trading marketplaces. Monitoring those sources gives early warning, and the method is covered in how to monitor the dark web and paste sites for leaked credentials.
Capturing evidence. Snapshots of fraudulent listings and scam infrastructure support takedowns and disputes.
The product view of this work is on the fraud detection data page.
Boundaries worth writing down
Keep testing to systems you own or are authorised to assess, in writing. Never use leaked credentials to log in to accounts, including your own customers’ accounts, to “check” them; use your own internal processes to identify affected users and force resets. IP addresses can be personal data, so apply the same care to network signals as to any other customer data, as set out in residential proxies and GDPR compliance.
FAQ
Is a residential IP a sign of fraud?
No. Most residential traffic is exactly what it looks like. It is also no longer a sign of legitimacy. Judge it against the account’s own history.
Should we block known residential proxy exits?
Blanket blocks catch real customers who share or inherit those addresses. Score the signal and apply step-up authentication on sensitive actions instead.
Does MFA solve account takeover?
It removes a large share of credential-only attacks. Attackers respond by phishing second factors and stealing sessions, so monitoring what happens after login still matters.
What is the single most valuable change for most teams?
Moving velocity rules from per-IP to per-account, per-password and per-flow. It is the change that makes distributed credential stuffing visible.
The bottom line
The network still tells you a great deal about a login, just not what it used to. Residential origin is context, not trust. Compare every login against the account’s own history, measure velocity where distributed attacks concentrate, check coherence between network and client, weight signals by the action that follows, and answer risk with friction rather than walls.
Combined that way, residential-IP signals remain one of the most useful layers in account takeover detection, even in a world where attackers use residential networks too.