Data Enrichment for Fraud Rules
- Data enrichment = looking up what you don't know about a transaction via API. No SDK, no client-side code. Just server-side calls
- Start free: MaxMind GeoLite2 (IP) costs nothing. IPQS offers a free plan (limited lookups) to test email/phone/IP signals
- All-in-one options: IPQS and SEON bundle IP + email + phone lookups into a single API
- Enrichment feeds rules, it doesn't block anything alone. You still need a rules engine to act on the signals
- Don't double-buy: If you're already on Sift, Sardine, or Kount, these signals are baked into your platform
Enrichment is the cheapest layer you can bolt onto a fraud stack. You send one data point to an API. An IP, an email, a phone number. You get back context. Is the IP a datacenter? Is the email two days old? Is the phone a burner?
That context feeds your fraud rules. Enrichment doesn't decide anything. It just gives your rules something better to work with.
What Data Enrichment Is (and Isn't)
It's a specific layer, and it's easy to confuse with the ones next to it:
| Data Enrichment | Device Fingerprinting | Identity Verification | Full-Stack Platform | |
|---|---|---|---|---|
| What it does | Looks up context on IP, email, phone via API | Collects device/browser attributes via client-side SDK | Confirms a person's identity (documents, liveness, KYC) | Combines enrichment, fingerprinting, ML, and decisioning |
| Integration | Server-side API call | JavaScript SDK or mobile SDK | SDK + user-facing flow | SDK + API + dashboard |
| Customer friction | None | None | High (document upload, selfie) | Varies |
| Cost | Free tiers available, paid from $49/month | $0.002-0.05/session | $0.50-5.00/check | % of GMV or per-transaction |
| Examples | MaxMind, IPQS, AtData, Telesign | ThreatMetrix, Fingerprint, Sardine | Socure, Veriff, Persona | Sift, Sardine, Signifyd |
The difference that matters: no SDK, no customer interaction. Your backend calls an API, gets signals, feeds them to rules. That's it. It's the cheapest layer to add and the fastest to ship.
Do You Need Standalone Enrichment?
Not always.
- Already on a full-stack fraud platform (Sift, Sardine, Signifyd, Forter, Kount)? They already eat IP, email and phone signals internally, often from MaxMind, Emailage and carrier feeds. Bolting enrichment on top is redundant. Ask your vendor what they use before you buy anything on this page.
- On processor tools only (Stripe Radar, Adyen RevenueProtect) and want more signal without paying for a platform? Enrichment is your next step. It's cheap, it's quick, and it gives you something to write smarter rules against.
- Weighing enrichment against a full-stack platform? See What to Buy by Merchant Size below. It comes down to volume and how complex your fraud is. Enrichment is a stepping stone, not a destination. Most merchants who grow past $5M end up on a full-stack platform or a guarantee provider that bundles these signals anyway.
IP Intelligence
IP is where most merchants start. Every transaction has one, and a single API call tells you whether it's suspicious.
Signals
| Signal | What It Tells You | Fraud Relevance |
|---|---|---|
| Geolocation | Country, region, city, lat/long | Compare to billing/shipping address, card country |
| IP type | Residential, datacenter, mobile, education | Datacenter IPs are 20-50x more likely to be fraud |
| VPN detection | Whether the IP belongs to a known VPN provider | VPN + country mismatch = higher risk |
| Proxy detection | Open proxy, anonymous proxy, residential proxy | Residential proxies are harder to detect and increasingly used in fraud |
| Tor exit node | Whether the IP is a known Tor exit | Very high risk for e-commerce transactions |
| ISP/ASN | Internet service provider, autonomous system number | Hosting providers (AWS, DigitalOcean) vs. consumer ISPs (Comcast, BT) |
| Connection type | Broadband, cellular, satellite | Unexpected types for the transaction context |
| IP age/first seen | How long the IP has been active in the vendor's network | Brand-new IPs (recently provisioned VPS) are higher risk |
| Risk score | Composite score combining multiple signals | Quick triage - dig into components for rule building |
Vendors
| Vendor | What You Get | Free Tier | Paid Pricing |
|---|---|---|---|
| MaxMind | GeoIP2 (geolocation, ISP, connection type) + minFraud (risk scoring, device, email, phone) | GeoLite2: free database with city/country/ASN accuracy | GeoIP2 Web: $0.0001-0.002/query depending on tier. minFraud: from $0.005/query |
| IP2Location | Geolocation, proxy detection, VPN, Tor, ISP | LITE: free database download | API plans from $49/month. Database subscriptions from $99/year |
| IPQS | IP + email + phone + device in one API | Free plan (5,000 lookups/month) | Starter $49/month (50K lookups), Pro $199/month (250K lookups), Enterprise custom |
MaxMind is the default. GeoLite2 is free and good enough for basic geolocation. Paid GeoIP2 buys accuracy. minFraud adds risk scoring on email, phone and device. Most fraud platforms (Sift, Kount, Sardine) run MaxMind data under the hood.
IP2Location is the budget option. LITE is free, and the downloadable databases let you look up locally instead of calling an API on every transaction.
IPQS bundles IP with email, phone and device signals in one API. The free plan is 5,000 lookups a month, enough to test on real traffic. Paid starts at $49/month for 50K lookups.
Deeper network signals need a client-side SDK. WebRTC leaks, TLS fingerprinting, residential proxy detection by device correlation. Those live in device fingerprinting: true IP and network intelligence.
Email Intelligence
Email is one of the highest-signal enrichment sources. A legitimate customer's email has history. A fraudster's email was created yesterday.
Signals
| Signal | What It Tells You | Fraud Relevance |
|---|---|---|
| Validity/deliverability | Whether the email exists and accepts mail | Invalid email = throwaway account |
| Domain type | Free (Gmail), corporate, disposable (Guerrilla Mail, Mailinator) | Disposable domains are very high risk |
| Domain age | When the domain was registered | Brand-new domains are suspicious |
| Email age/first seen | How long the email has existed in the vendor's network | Emails first seen < 7 days ago are higher risk |
| Social media presence | Linked profiles across platforms | Real people have social footprints. Fraud accounts usually don't |
| Breach history | Whether the email appeared in known data breaches | Breached credentials are used in ATO attacks |
| Name-to-email match | Whether the name on the order matches the email owner | "John Smith" using sarah.jones@gmail.com is worth investigating |
| Gibberish detection | Whether the local part looks auto-generated (e.g., xkj38fn2@) | Auto-generated emails signal bot-created accounts |
| Private relay | Apple Private Relay, Firefox Relay, or similar | Not inherently risky, but limits your ability to verify email history |
Vendors
| Vendor | What You Get | Pricing |
|---|---|---|
| Emailage (LexisNexis) | Largest email risk network. Consortium data from thousands of merchants. Email + IP risk scoring | Enterprise only. Per-query pricing, contact LexisNexis |
| AtData (Experian) | Email validation + age + activity + demographic append (name, location from email). Acquired by Experian in Feb 2026 | Custom pricing. Contact vendor |
| IPQS | Email validation, age detection, disposable detection, fraud scoring. Bundled with IP + phone | Free (5,000/month). Starter $49/month (50K), Pro $199/month (250K) |
| SEON | Email validation + social media lookups across 90+ platforms. Deepest social media coverage | No published free tier. Starter $699/month for 2,500 fraud checks (source, verified 2026-08-02) |
Emailage has the biggest network. LexisNexis sees email-to-identity mappings across thousands of merchants, so if an email burned somebody else, Emailage knows. It's enterprise-priced, which puts it out of reach for SMBs.
SEON stands out for social lookups. It checks whether an email has linked accounts on 90+ platforms. LinkedIn, Facebook, Twitter, Instagram, the rest. A real person's email usually connects to several. A throwaway connects to none. SEON's really a lightweight fraud platform, though, not an email API: enrichment plus device signals plus a scoring dashboard. Starter is $699/month for 2,500 fraud checks, about 28 cents a check, and there's no free tier (source, verified 2026-08-02). At that price, check it against full-stack fraud platforms before you sign.
Ekata (Mastercard) sells email intelligence inside its multi-signal identity API. It's covered in identity verification, since it's an identity tool more than an email lookup.
Phone Intelligence
Most merchants ignore phone signals. A number says a lot about who's behind a transaction, if you ask the right questions.
Signals
| Signal | What It Tells You | Fraud Relevance |
|---|---|---|
| Line type | Postpaid, prepaid, VoIP, landline | Prepaid and VoIP are higher risk (easier to obtain anonymously) |
| Carrier | Current carrier name | Useful for geographic and demographic context |
| Carrier tenure | How long the number has been with the current carrier | Short tenure + new account = higher risk |
| Active/disconnected | Whether the number is currently active | Disconnected numbers on active accounts are suspicious |
| SIM swap detection | Whether the SIM was recently swapped | SIM swap within the last 48 hours is a strong ATO indicator |
| Port history | Whether the number was recently ported between carriers | Porting can be legitimate, but recent port + high-value transaction = worth reviewing |
| Name-to-phone match | Whether the name on the order matches the phone owner | Mismatch is a supporting fraud signal |
| Number deactivation alerts | Real-time notification when a number on file is deactivated | Proactive signal that an account may be compromised |
Vendors
| Vendor | What You Get | Pricing |
|---|---|---|
| Telesign | Deepest phone intelligence. PhoneID for line type, carrier, SIM swap. Number deactivation alerts are unique to Telesign | Per-query pricing. Contact for volume pricing |
| Prove | Phone-as-identity platform. Uses carrier signals for silent authentication (no SMS OTP needed) | From $1,000/month. Contact for pricing |
| IPQS | Phone validation, line type, carrier, fraud scoring. Bundled with IP + email | Free (5,000/month). Starter $49/month (50K), Pro $199/month (250K) |
Telesign is the specialist. Its number deactivation alerts tell you when a phone on a customer's account goes dead, before whoever took the number over can use it. Nobody else sells that standalone.
Prove is an identity platform, not a phone enrichment API. It uses carrier data to verify silently that whoever's holding the phone is who they say. No SMS OTP. It starts at $1,000/month, a different tier than enrichment. Covered in identity verification.
What About Device Signals?
Device is a separate layer. Fingerprinting almost always needs a client-side SDK, a JS snippet or a mobile SDK, to read browser, hardware and behavioral signals. That puts it outside server-side enrichment.
Two paths if you need device signals:
- Lightweight device ID (Fingerprint Pro, say): a small JS snippet that returns a persistent visitor ID. Good for linking sessions and spotting returning visitors. See device fingerprinting.
- Full device intelligence (Sardine, ThreatMetrix, Sift): an SDK pulling hundreds of signals. Behavioral biometrics, emulator detection, remote desktop detection, TLS fingerprints. These are full-stack fraud platforms, not enrichment APIs.
SEON and IPQS bundle a basic device hash and OS/browser data. It's shallow next to what a dedicated SDK collects. If your problem is device-level (emulators, bots, fraud rings), enrichment won't fix it. See device fingerprinting for the full signal catalog and vendor comparison.
Identity Resolution
Identity resolution answers one question. Do these pieces belong to the same person? You've got an email, a phone, a name, a shipping address. Do they all point at one real human?
| Vendor | What You Get | Pricing |
|---|---|---|
| FullContact | Maps email, phone, social profiles, and physical address to a unified person record. Returns confidence scores on each match | From $99/month (Starter: 25K matches). Annual contracts required |
FullContact won't tell you someone's a fraudster. It tells you whether the identity pieces on an order hang together. Email says "Jane Doe" in Seattle, phone says "Mike Chen" in Houston? That's worth acting on.
For document checks, biometric liveness and KYC, see identity verification. For correlation scoring and identity graphs inside full-stack platforms, see the vendor landscape.
All-in-One Enrichment Platforms
Want one vendor instead of four? Two bundle IP, email and phone into a single API:
| IPQS | SEON | |
|---|---|---|
| IP signals | Geolocation, VPN, proxy, Tor, datacenter, ISP | Geolocation, VPN, proxy, Tor, datacenter, ISP |
| Email signals | Validation, age, disposable, fraud score | Validation, age, disposable, social media (90+ platforms) |
| Phone signals | Validation, line type, carrier, fraud score | Validation, line type, carrier |
| Also includes | Basic device fingerprint, bot detection | Basic device hash, OS/browser, fraud scoring dashboard |
| Free tier | Free plan (5,000 lookups/month) | None published |
| Paid pricing | Starter $49/month (50K), Pro $199/month (250K) | Starter $699/month (2,500 fraud checks), Premium quote-only |
| Best for | Budget-conscious merchants who want broad coverage cheap | Merchants who value social media signals for email risk |
The SEON figures came off seon.io/pricing on 2026-08-02. The IPQS figures weren't re-checked in that pass, so confirm them on IPQS's own page before you budget.
Both carry basic device data. Neither replaces a real device fingerprinting tool. If you want emulator detection, behavioral biometrics or consortium device reputation, that's a separate tool or a full-stack platform.
IPQS is the cheaper way in, and it publishes a free plan you can test on. SEON publishes no free tier, so there's no trying it without a sales call. Watch the units. IPQS prices per lookup, SEON prices per fraud check, and a fraud check is a scored decision, not a single field lookup. SEON goes deeper on social. Nobody else checks 90+ platforms for linked accounts. But $699/month for 2,500 checks, about 28 cents each, lands SEON in the same band as some full-stack fraud platforms. Make sure you're comparing the right tier.
When to Skip Enrichment and Buy a Full-Stack Platform Instead
IPQS and SEON give you signals. You still write the rules, tune the thresholds and build the decision logic. If that's more work than you want, a full-stack fraud platform (Sift, Sardine, Signifyd, Forter, Kount) bundles the signals with ML models, a rules engine, case management and usually a review queue, in one integration.
The trade is cost against effort. A full-stack platform at $1M+ volume runs $500-2,000+/month. IPQS at the same volume runs $49-199. The question is whether you've got the time and the skill to build rules from raw signals, or you'd rather pay for something that decides for you.
| If you... | Go with... |
|---|---|
| Want to learn fraud ops and build your own rules | Enrichment APIs (this page) + building fraud rules |
| Want someone else to make decisions (with guarantee) | Signifyd, Riskified, or Forter |
| Want ML + rules engine + enrichment in one platform | Sift, Sardine, or Kount |
| Have a full-stack platform but want to supplement specific gaps | Individual enrichment vendors (MaxMind for IP, Telesign for phone, etc.) |
Under $2M and want to stay hands-on? Start with IPQS. The free plan lets you test signals, and paid plans start at $99/month. If you'd rather not run fraud rules yourself, skip enrichment and look at a guarantee provider or a full-stack platform.
Building Rules with Enrichment Data
Enrichment data is worthless until it's a rule. These follow the same pattern as the day-one rule set.
Example Rules
| Rule | Pseudocode | Action | What It Catches |
|---|---|---|---|
| Datacenter IP | IF ip_type = "datacenter" | Review | Bots, scrapers, fraud from hosted infrastructure |
| VPN + country mismatch | IF vpn_detected = true AND ip_country != card_country | Review | Cross-border fraud hiding behind VPNs |
| Disposable email | IF email_domain_disposable = true | Decline | Throwaway accounts created for one-time fraud |
| New email + high value | IF email_age_days < 7 AND order_total > $200 | Review | Fresh accounts targeting high-value goods |
| Prepaid phone + new account | IF phone_line_type = "prepaid" AND account_age < 7_days | Review | Accounts created with burner phones |
| No social presence | IF email_social_profiles = 0 AND order_total > $100 | Review | Synthetic or throwaway identities on medium+ orders |
| Identity mismatch | IF name_to_phone_match = "none" AND name_to_email_match = "none" | Decline | Stolen identity - none of the contact info matches the name |
| Tor exit node | IF tor_exit_node = true | Decline | Anonymous browsing on e-commerce is almost always fraud |
Layering Enrichment with Existing Rules
Your day-one rules use transaction data: amount, velocity, country. Enrichment makes those rules smarter:
| Existing Rule | + Enrichment Signal | Improved Rule |
|---|---|---|
| Country mismatch (card != IP) | + vpn_detected = false | If no VPN, the mismatch is a real geographic discrepancy |
| New account + high value | + email_age_days < 7 | New account AND new email = much higher risk than new account with established email |
| Hourly velocity > 3 | + ip_type = "datacenter" | Velocity from a datacenter IP = almost certainly automated |
| Amount ceiling ($300+) | + phone_line_type = "voip" | High-value order from a VoIP number deserves extra scrutiny |
Risk Score Adjustments
If your system uses point-based scoring (see Risk Scoring), enrichment signals feed directly into score adjustments:
Base score: 0
# IP signals
IF ip_type = "datacenter" THEN +25
IF vpn_detected = true THEN +15
IF tor_exit_node = true THEN +40
IF ip_country != card_country THEN +20
# Email signals
IF email_domain_disposable = true THEN +35
IF email_age_days < 7 THEN +20
IF email_social_profiles = 0 THEN +15
# Phone signals
IF phone_line_type = "prepaid" THEN +10
IF phone_line_type = "voip" THEN +15
IF sim_swap_last_48hrs = true THEN +30
# Thresholds
IF total_score >= 70 THEN decline
IF total_score >= 40 THEN review
IF total_score < 40 THEN approve
Run every enrichment rule in shadow mode for two weeks before you enforce it. These signals throw false positives you won't see coming. VPN use varies by country, plenty of legitimate businesses sit on datacenter IPs, and prepaid phones are normal in some places. See shadow mode: test before you block for the method.
What to Buy by Merchant Size
| Annual Volume | Enrichment Recommendation | Or Consider Instead |
|---|---|---|
| Under $100K | Nothing. Processor tools are enough | - |
| $100K-$500K | MaxMind GeoLite2 (free IP geolocation database) | - |
| $500K-$2M | MaxMind GeoIP2 + IPQS free plan for testing | Still manageable with enrichment + manual rules |
| $2M-$10M | IPQS paid plan ($49-199/month) | A full-stack platform ($500-2,000+/month) that includes these signals + ML + decisioning |
| Over $10M | Layer specialists: MaxMind + Telesign + Emailage | Almost certainly better served by a full-stack platform or guarantee provider at this volume |
At $2M+, the question isn't which enrichment vendor. It's enrichment plus your own rules, or a platform that does the lot. Got a fraud analyst who can write and tune rules? Enrichment gives you more control for less money. No analyst? A full-stack platform or a guarantee provider is a better use of the budget.
Already on Sift, Sardine, Kount, Signifyd or Forter? Don't double-buy. Ask your vendor which signals they already ingest before you buy anything on this page.
Pull your last 30 chargebacks. Look up the IP on each (MaxMind GeoLite2 is free) and the email and phone (IPQS free plan). How many would have thrown an obvious signal? If more than half show datacenter IPs, disposable emails or VoIP numbers, enrichment pays for itself. If they all look clean, your fraud is more sophisticated than this and enrichment alone won't touch it.
Privacy and Compliance
Enrichment APIs handle personal data: IPs, emails, phone numbers. Make sure yours clears the privacy laws that apply to you.
- GDPR: fraud prevention usually rides on "legitimate interest", but you need a documented DPIA and the processing has to appear in your privacy policy
- CCPA/CPRA: fraud prevention is an exempted purpose, but you still disclose the data sharing in your privacy notice
- Data retention: don't keep enrichment results longer than you need them. 90 days is a reasonable default for fraud investigation
- Vendor DPAs: sign one with every enrichment vendor. They're processing your customers' personal data on your behalf
Next Steps
Just getting started?
- Sign up for MaxMind GeoLite2 (free) and check IPs on your last 10 chargebacks
- Create an IPQS free account and test email/phone lookups on a few transactions
- Build rules using the enrichment signals that show the most signal
Ready to buy?
- Pick a tier from the size recommendation table
- Run your chosen vendor in shadow mode for 2 weeks
- Compare enrichment-flagged transactions against actual chargebacks
Already have enrichment?
- Review your rule performance monthly
- Layer enrichment with device fingerprinting for deeper signals
- Consider identity verification for high-risk transactions
Related Topics
- Building Fraud Rules - Rules that consume enrichment signals
- Device Fingerprinting - Client-side signals that complement server-side enrichment
- Identity Verification - When you need to confirm identity, not just enrich data
- Velocity Rules - Rate-based detection enrichment enhances
- Risk Scoring - How enrichment feeds into composite scores
- Rules vs. ML - Where enrichment fits in the rules/ML spectrum
- Fraud Vendor Landscape - Full vendor comparison
- Fraud Vendors - Vendor selection by merchant size
- Card Testing - Attack type enrichment catches well
- Account Takeover - SIM swap and email signals
- Evidence Framework - How enrichment signals fit Tier 1/Tier 2
- Running Fraud Operations - Operational cadence