What is Address Manipulation Fraud?
Address manipulation fraud is the practice of exploiting address data to divert value. The criminal
actor alters delivery or billing address data elements (apartment number, building name, ZIP+4, transliteration,
“care of” recipient, etc.) to evade controls and reroute goods or conceal the identity of a mule. It can be blatant
(mid-shipment package interception, last-minute courier address field modification) or subtle (a commercial mailbox
disguised as a residential address, a vacant unit with a Post-it Note, a hotel room used as a rotating drop). Different
methods, same result—losses, messy chargebacks, compliance headaches.
Common tactics include typos unlikely to trigger deduplication; “Street” vs “St.”; adding or removing
“Apt/Suite” to avoid blacklist; PO boxes validated as physical addresses; reshipper hubs; temporary rentals;
parcel locker loops; multiple identities that lead to a single rooftop. For digital goods, the “address” may be
IP geolocation and device locale. Spoofed just far enough to support the narrative on the form.
The reason it succeeds: many risk engines depend on identity integrity, but not location. If the name and ID
document look good, the address is an open-loop. And logistics systems, optimized for efficiency, eagerly
“correct” addresses in ways that obscure manipulation.
Signals to look for: multiple deliveries to the same coordinates with different names; high rate of address
edits after authorization; “undeliverable” status followed by dispute; geolocation that doesn’t match stated city;
building types that are inconsistent with claimed residence type; reseller packaging on returns; courier notes that
suggest “no such unit.” One anomaly can be noise; clusters of correlation tell the truth.
Controls that matter: normalize and geocode at intake, enforce apartment/suite presence where required,
validate deliverability, and dedupe on geocoordinates not just address strings. Cross-check device/IP geodata against
the claimed city. Escalate underwriting when users change addresses around payout time or prior to high-value shipments.
Validate residence with robust proof-of-address (authenticity,
recency, anti-tamper) and bind identity with strong ID verification so mules can’t reuse profiles. Close the loop—feed confirmed fraud back into rules, block the rooftop—not just
the spelling.
Address fraud looks tiny. On the ledger, it hurts. Close the loop on intake, starve the pipeline.
