Recommendations from a Fraudster: Part 3
Blog | October 10, 2025
“Did you know that cheap proxies rotate or drop without warning?”
That was the moment our Whitehat stopped me mid-conversation…again. And just like that, my jaw hit the floor. It was so obvious, why hasn’t the industry thought of this? We never take anything on faith here, so of course we put a check in place. What we found was both obvious and unbelievable all at once.
The impact was clear. This little quirk in the way cheap proxies behave is not only detectable — it’s laughably easy to catch when you know what to look for.
The Recommendation
Always check the IP address of the survey participant just before statusing them as a qualified complete.
Here’s why: when you compare the beginning IP address to the ending IP address, you’ll notice that in most cases, everything lines up just fine. If they don’t match, that doesn’t automatically mean fraud — there are legitimate reasons IPs can shift (and if you want the deep dive, reach out to me directly).
But here’s the kicker: when the IP address is different AND the ISP is different AND the Country is different… that’s a red flag you cannot ignore.
The Evidence (These are real IP Addresses so you can check for yourself)
| Field | Starting | Ending |
| IP Address | 38.13.135.126 | 105.112.179.23 |
| Timezone | America/Los_Angeles | Africa/Lagos |
| ISP | FIBERPOWER-AS | VNL1-AS |
| Country Code | US | NG |
“Different IP. Different ISP. Different Country. That’s not coincidence — that’s fraud.”
Why This Works
This isn’t rocket science. Most of your participants will look consistent from start to finish. But when someone is using a cheap rotating proxy, it can drop or flip mid-survey without warning. That means the connection your participant started with is not the one they finish with.
And when you see the triple-shift — IP, ISP, and Country all changing — there is no legitimate reason for it. Not B2B. Not consumer. Not ever.
This is also a perfect example of what we’ve covered before in Unseen Survey Fraud Uncovered. You won’t spot this in the survey data, open ends, or length of interview. It’s invisible if you’re only looking at traditional survey outputs. That’s why you need checks like this — because today’s fraud doesn’t always leave footprints in the data itself.
How to Put It in Place
If you’re using OpinionRoute’s Navigator, this protection is already built into the tech. It runs automatically behind the scenes so you don’t have to think about it and QCs that participant before the quotas and researcher are involved.
But even if you’re not on Navigator, this isn’t complicated. If you already collect IP information at the start of your survey, just add the same check at the end and compare. Tools like IP2Location, IPInfo, or IP-API are inexpensive and straightforward to set up.
“Fraudsters count on the industry not checking twice. Prove them wrong.”
Closing Thought
Fraud detection isn’t always about complex algorithms or hidden tricks. Sometimes it’s about applying a simple check at the right moment. This one takes minutes to set up and can save you countless bad completes.
Most importantly, it closes off yet another easy exploit fraudsters rely on.
Because in this industry, the smallest cracks are the ones they slip through.
Is your data protected? Contact us today to learn how Navigator can safeguard your surveys and streamline quality control.