Address Risk
Address risk is the assessment of a physical address as a signal about the person supplying it — whether it exists, what kind of premises it is, how many unrelated identities are associated with it, and whether it has appeared in previous fraud. It is one of the few fraud signals that cannot be virtualized, and it is one of the easiest to misuse against legitimate people.
| Signals assessed | Deliverability, property type, occupancy history, association count, prior fraud linkage |
| High-attention property types | Vacant premises, mail forwarding services, parcel lockers, hotels, short-term rentals |
| Strongest signal | Repetition — unrelated identities sharing one address |
| Why it resists evasion | Goods and documents must physically arrive somewhere reachable |
| Matching difficulty | Address formats vary enormously; normalization is required before comparison |
| Largest false-positive source | Shared buildings — apartment blocks, student housing, care homes, shelters |
| Equity concern | Address quality correlates with income, housing stability and immigration status |
| Related evidence | Proof of address, which links a person to a location rather than scoring the location |
What the signals mean, and where each breaks
| Signal | What it suggests | Why it fails as a rule |
|---|---|---|
| Address does not validate | Fabricated or mistyped | New builds, rural addresses and non-standard formats validate poorly |
| Commercial mail receiving agency | Separation between person and location | Used legitimately by small businesses, travelers and people without fixed housing |
| Vacant or transitional property | Possible drop address | Records lag reality by months |
| Many identities at one address | Possible fraud ring or drop | Apartment blocks, student housing and shared accommodation look identical |
| Prior fraud at this address | Strong signal | Penalizes whoever lives there now, who may be unconnected |
The pattern in that third column is the point of this page. Every address signal has a large legitimate population that is indistinguishable from the risky one, and the overlap is not random — it concentrates among people in shared housing, temporary accommodation, recent arrivals and those without stable addresses. Address risk applied as a rule discriminates on housing circumstances. Applied as a weighted input among several, it is useful.
Why address repetition still works
Despite all that, the association signal earns its place, because of an asymmetry no other identifier has: a physical address cannot be generated at scale.
Emails are free and infinite. Phone numbers cost very little. Devices can be reset and virtualized. But goods, cards and documents have to arrive somewhere a person can physically reach, which caps how many working addresses an operation can hold. Reuse follows from that constraint rather than from carelessness — which is exactly why a drop address appearing across unrelated applications is one of the more reliable indicators available.
Two conditions make it work. The comparison has to run on normalized addresses, since “Flat 2, 14 High St” and “14a High Street” are the same node and will not match as strings — which is an entity resolution problem. And it has to run across a population rather than within one application, because a single application shows nothing.
Why this matters for identity verification
Address risk scores a location. It says nothing about the person, and treating it as though it does is the failure mode.
A fraudster at a pristine residential address with decades of stable occupancy scores well. A recent arrival in shared housing, or someone using a forwarding service while between homes, scores badly. Neither score describes the applicant — and the second one systematically penalizes exactly the population least able to appeal a rejection.
So its right use is routing rather than gating: a weak address signal is a reasonable reason to require stronger identity evidence, not a reason to decline. Where the risk warrants it, identity document verification answers the question address data cannot — whether a real, correctly identified person is applying — and proof of address evidence links that person to a location rather than scoring the location alone. Synthetic and stolen identity controls target what the address is ultimately serving.
What address risk can’t do
It does not identify anyone. It describes a location, and locations are shared, reused and inherited.
Its errors are not evenly distributed. False positives concentrate among people in shared, temporary or non-standard housing, which makes an aggregate accuracy figure misleading.
Data ages badly. Occupancy and property status records lag reality by months, so a vacancy flag may describe a house someone moved into in the spring.
It cannot see a recruited address. A reshipping recruit at a genuine long-held address produces a clean score.
Frequently asked questions
What is address risk?
The assessment of a physical address as a fraud signal — whether it exists and receives mail, what kind of premises it is, how many unrelated identities are associated with it, and whether it has featured in prior fraud. It scores the location rather than the person supplying it.
Why is a shared address a risk signal?
Because multiple unrelated identities at one address is the signature of a drop address or a fraud ring, and addresses are the one resource fraudsters cannot generate at scale. The same pattern is produced by apartment blocks, student housing and shared accommodation, which is why it should weight a decision rather than determine one.
Can address risk be used to decline an application?
It can, and doing so is difficult to defend. Every address signal has a large legitimate population that looks identical to the risky one, concentrated among people in shared or temporary housing. The defensible use is triggering stronger identity verification rather than refusing outright.
How is address matching done reliably?
By normalizing addresses before comparing them, since the same location is written many ways and exact string matching misses most genuine matches. That makes it an entity resolution problem, and it only produces signal across a population of applications rather than within a single one.
Related reading
- Drop address — the fraud pattern address repetition is designed to surface
- Proof of address — the evidence that links a person to a location, rather than scoring it
- Entity resolution — why normalization is the precondition for any of this working
- Address Verification Service — the narrower payments check, and the same person-versus-data gap
