For merchants who ship physical goods, the shipping address provided by the buyer can be a rich source of information.
What’s the relationship between the billing and shipping addresses?
The simplest comparison you can make between two addresses is to see whether they’re identical. Orders shipping to an address other than the billing address are generally more likely to be fraud. With some additional work, it’s possible to calculate the distance between two postal codes, if you can find the latitude and longitude of both postal codes. This information is publicly available for United States zip codes, and may be available for other jurisdictions as well. In addition, calculating this distance is a service many fraud solution providers offer. You may find that orders shipping within a few miles of the billing address are relatively safe compared to orders shipping hundreds of miles away.
Digging deeper, you may be able to discover through manual research or through automated address lookup services that the people living at the billing address and the shipping address are related in some way. For example, an order for a laptop shipping from New York to Missouri is less likely to be fraud if both addresses are single-family residences and the families living in each have the last name Hawkins. Chances are better than not that the order is a gift for a family member.
What’s the nature of the shipping address?
Knowing what building is actually at the shipping address can be very valuable.
For example, freight forwarders are a potential sign of bad behavior. These companies receive shipments and then consolidate them to be shipped via freight overseas. There are many customers who use these services legitimately to get goods sent overseas affordably, but there are also many fraudsters who are operating in other countries and use freight forwarding to avoid recruiting local [reshippers]. One way to tell an address may belong to a freight forwarder at a glance is a container label in the address, looking like 123 Dock Road Suite 100 #KXQ-582899328. Additionally, lists of registered freight forwarders are available publicly and may be included as part of the underlying services provided by fraud detection vendors.
In addition, behavior at the shipping address can be indicative of fraud. One way to see this within the scope of your business is by looking at [velocity] of orders going to that address.
A single household might place a few orders in a month. An address that receives 15 orders in a week, each paid for with a different card, is a massive red flag and tells a different story. Useful velocity checks include:
- The number of distinct cards or payment methods tied to one shipping address
- The number of distinct accounts or email addresses shipping to the same address
- Order count and total order value to the address over one hour, 24 hours, and seven days
- Repeated orders for the same high-resale items, such as electronics, gift cards, or sneakers
Velocity matters most when the address is a residence. In reshipping schemes, fraudsters recruit people to receive goods bought with stolen cards and forward them elsewhere. The delivery address in these cases is real, residential, and passes most fraud checks, so a home address cannot be treated as safe by default. Reshipping scams are estimated to drive around $1.8 billion in losses every year. A merchant who sees only their own orders may miss a mule who is receiving packages from a dozen retailers, which is why address-level signals from your fraud tools or a consortium network can fill in the picture.
Treat freight forwarders as a signal, not a ban
While it may be tempting to block every known forwarding address, that approach tends to cost you good customers. Freight forwarders are not inherently unsafe, but they carry a disproportionately high fraud and abuse risk for e-commerce merchants, and some merchants who respond by blocking all known forwarding addresses find that it backfires.
A better question is whether the customer has a logical reason for using one. An international buyer with a clean history, ordering from a brand that doesn’t ship abroad, looks very different from a brand-new account placing a rush order for three laptops. Route borderline forwarder orders to manual review, and feed the outcomes back into your rules.
Combine address signals with the rest of the order
No single address check is conclusive. A billing and shipping mismatch, a forwarder address, a high velocity count, and a first-time buyer on a new device add up to a very different picture than any one of them alone. Treat each as a weighted input, and compare your rules against your own chargeback and false decline data so the weights reflect your customers.
Also normalize addresses before you run any check. Fraudsters often type the same address several ways, such as “Suite 100,” “Ste 100,” and “#100,” to dodge exact-match velocity rules. Standardizing abbreviations and punctuation keeps those variations from slipping through.
If your experiencing shipping address fraud, click here to learn more about what Sift can do to help.
Frequently asked questions
Is a different billing and shipping address always a sign of fraud?
No. Gifts, office deliveries, and orders sent to students or relatives all create legitimate mismatches. A mismatch raises the odds of fraud, so weigh it with other signals like order value, customer history, and device data.
Should I block orders shipping to freight forwarders?
Blanket blocking tends to cost you good customers. Many people use forwarders legitimately to buy goods that aren’t sold in their country. Instead, review whether the order makes sense given the customer’s history, the items, and how the order is paid for.
What is reshipping fraud?
Reshipping fraud happens when fraudsters buy goods with stolen cards and have them delivered to a person who then forwards the packages abroad. The person receiving the goods is often recruited through a fake work-from-home job. Participating in a single reshipping scam can lead to multiple federal charges.
