GEO-LOCATION FRAUD ANALYSIS:
PHYSICS DOESN'T LIE.
A device can claim to be anywhere. It cannot claim to have traveled faster than physically possible between two real transactions.
// Geo-Velocity Scoring
Every location pair is scored by Haversine great-circle distance ÷ elapsed time. The result classifies straight into a risk tier — no manual thresholds per merchant.
// Fail-Closed Design
- Bad or missing input → CRITICAL, not "unknown".
- Low velocity alone isn't automatically clean.
- VPN/Tor/proxy context can enhance a low-velocity signal to HIGH.
GPS Says One Thing. IP Says Another.
Mock-GPS apps spoof the device's own location API convincingly. What they can't spoof is where the network traffic actually originates. NonaShield cross-references device-reported GPS against edge-derived IP geolocation — independently, on every request.
Mismatch ≥300km: LOW severity flag
Mismatch ≥1500km: HIGH severity — GPS vs IP geolocation diverge by more than a country.
Anonymous-IP databases (the class of data that flags "this IP is a known VPN/Tor exit") are notoriously incomplete across every vendor, ours included on this deployment. Rather than market a single silver-bullet VPN/Tor flag, NonaShield leans on ASN-organization heuristics and a maintained hostile-ASN list at the edge, combined with behavioral and velocity signals — so no single missed database entry becomes a single point of failure.
The Verdict.
"GPS is a claim. Velocity, IP geolocation, and a learned home zone are three independent witnesses."
Using location without trusting it blindly
Location is one of the easiest signals to fake and one of the most useful when checked properly. GPS can be spoofed with a mock-location app, and an attacker can route traffic through a proxy in the victim's city.
NonaShield treats location as a claim to be tested. It compares the reported position with the network path, device signals and the customer's history, and it checks that travel between sessions is physically possible. A mismatch raises the risk score instead of deciding alone.
Location pairs with a hardware-backed device identity to answer both "is this the right device?" and "is it where it should be?". See hardware-bound identity with location checks.
Frequently asked questions
How does geo-location analysis detect fraud?
It compares claimed location with network and device evidence and checks that movement between sessions is physically possible.
What is an impossible-travel check?
Two sessions from places too far apart for the time between them. It signals a stolen session or a spoofed location.
Can attackers spoof GPS?
They can try. NonaShield cross-checks GPS against network and device signals, so a lone spoofed value does not settle the decision.