Fraud Score on a Dedicated Mobile IP: What the Number Means

You rent a fresh dedicated modem, run the address through a fraud checker, and it comes back with a score that looks bad. Nothing is wrong with the line. The score is describing the address, and the address is shared by thousands of phones you have never met. This article explains what services such as IPQualityScore and Scamalytics are measuring, why carrier addresses score the way they do, what the number predicts and what it does not, and the few actions that actually help.

What the checker is scoring

A fraud score is a guess about a public IP address, built from what the scoring company has seen from that address across its customers: sign-ups, payments, logins, abuse reports, the number of distinct devices, and whether it looks like a proxy, VPN or data centre range. It is an address-level reputation, assembled from the crowd behind the address.

On a carrier network, that crowd is large. Carrier-grade NAT puts many subscribers behind one public address, and the set of subscribers changes as sessions open and close. So the score of a mobile address is the average behaviour of a rotating group of strangers. It says almost nothing about your modem.

Why carrier CGNAT addresses score high

Three things push the number up. Volume: an address shared by thousands of phones generates a lot of events, and a few bad ones among them are inevitable. Velocity: the same address shows up at many services within minutes, which looks like automation from the outside and is just a busy tower from the inside. History: carrier address pools are old, and a pool address may have carried abuse last year from a phone that is long gone.

Some checkers also raise the score simply because the address is mobile, on the reasoning that mobile addresses are hard to trace to one person. That flag is a comment on the network type, not on you.

What the number predicts, and what it does not

The score predicts how a site that relies heavily on that specific scoring vendor might treat a first contact from the address. That is a narrow thing. Most platforms that matter run their own risk systems and weigh behaviour, device signals and account history far above a vendor score, especially for mobile addresses, which they know are shared.

The score does not predict whether your account will be flagged. We have seen lines with ugly scores run accounts quietly for months, because the only behaviour from that line is one careful user. We have seen pristine addresses get accounts restricted within a day, because the behaviour was wrong. The score is a weather report for a city of thousands. Your account is one house.

Dedicated does not mean a clean number

It is worth saying plainly: renting the modem to one customer does not give that customer a low fraud score. It gives them control over everything on their side of the carrier. The crowd behind the address is still there, and we cannot remove it. What dedicated buys you is that no additional risk is added by neighbours on the same modem, and that if a specific site reacts to a specific address, you can rotate to a different one and nobody else's behaviour follows you.

What to do

First, test the thing that matters. Load the platform you actually use through the line and see how it behaves: does sign-in work, does it ask for extra verification, do actions go through. That is the only test with a real answer.

Second, if a particular site is unhappy with a particular address, rotate. The next address from the regional pool is a different crowd with a different history. Check the site again, not the checker.

Third, keep your own behaviour ordinary. Match the device time zone and language to the modem's city, sign in at consistent hours, and do not run bursts of actions that no person would do. Behaviour is what the platform actually scores you on.

Fourth, do not stack a VPN on top of the line to chase a better number. The exit would then be a hosting range, which scores worse and loses the carrier advantage entirely.

Reading a report line by line

When a checker says proxy detected, it usually means the address is in a range the vendor associates with shared use, which every carrier range is. When it says mobile, it is correct. When it lists recent abuse, that is the crowd. When it shows a city a little away from your modem, that is the carrier gateway. The one line that should concern you is hosting or data centre, which must never appear on a mobile line; if it does, something other than the modem is in the path, and you should write to support so we can look.

Frequently asked