A retailer's fraud team found that orders where the billing country, shipping country, and connecting IP address all told different stories were disproportionately the ones that ended in a chargeback.
A subscription service noticed its free trial was being claimed dozens of times by the same person cycling through VPN exit nodes, and started checking for that pattern directly.
A lending platform started checking the IP address behind every signup, catching hosting-provider traffic and shared fraud ranges before an application ever reached underwriting.