Incognia Uses Location Data to Stop Scams: A Merchant Fraud Primer
Location-based fraud prevention can stop account takeovers and scam purchases. See how it works, what to ask vendors and which privacy rules to check.
Photo: Pixabay
On this page 6 sections
- What Incognia Launched (The Paypers, Oct. 26, 2026)
- How Location-Based Fraud Prevention Catches Scams That Card Data Misses
- Where Location Signals Help Most: Account Takeovers, Promo Abuse and Marketplaces
- Privacy and Consent Rules to Check Before Collecting Location Data
- Evaluating Vendors: False Positives, Latency and Integration
- How Location Signals Fit With 3DS, Velocity Rules and Manual Review
Key takeaways
- Incognia's Real-Time Scam Prevention is built for banks. Merchants can buy the same kinds of location and device signals for logins, account changes and marketplace payments.
- Precise location comes from a mobile app SDK that the user has given location permission. A web-only store mostly gets coarse IP location, so it gets much less from these tools.
- When fraud is rare, a tool that is "99% accurate" can still flag far more good customers than attackers. Send flags to a challenge, not a block, unless your own pilot data shows high precision.
- 3-D Secure confirms identity, and in a scam the identity is real. Signals like an active phone call or a first payment to a stranger cover that gap.
Location-based fraud prevention checks where a device is, and where that account's device usually is. That tells you whether the person behind a login or purchase is the real customer, and whether that customer is acting freely. Incognia's new Real-Time Scam Prevention, reported by The Paypers on Oct. 26, 2026, applies the idea to bank payments. App-based merchants can already buy the same signals to stop account takeovers, promo abuse and marketplace scams. They work best on mobile and come with privacy obligations. They belong in front of 3-D Secure and velocity rules, not in place of them.
What Incognia Launched (The Paypers, Oct. 26, 2026)
Incognia announced Real-Time Scam Prevention in a PR Newswire release dated Oct. 21, 2026, and The Paypers covered it on Oct. 26. The product is for financial institutions, not merchants. It is meant to catch authorized-payment fraud and social engineering, where a real customer on their own device is talked into sending money to a scammer.
At its core is what Incognia calls a Physical Social Graph, built on its patented Trusted Locations technology. The company says it uses persistent, apartment-level indoor location data to learn where users regularly spend time. It doesn't look at where someone is at the moment of payment. Instead it compares the location histories of the sender and the recipient. Two people who share real-world places probably know each other. A first payment to an account that has never crossed paths with the sender carries more risk.
Incognia pairs that graph with several other checks: mule-account detection, active-call detection, remote-access-tool detection, device integrity checks and location-spoofing detection. Banks get a risk score and decide what to do with it under their own policies.
Incognia says the graph alone caught about 70% of scam transactions in data from one major financial institution. Treat that as a vendor figure from a single dataset. None of the coverage we reviewed gave a false positive rate, and that's the number that decides whether a tool is usable. CEO André Ferraz told Biometric Update that the company uses about 500 other signals and said, "We believe we've finally cracked the code for scams." Independent results will show whether that holds.
How Location-Based Fraud Prevention Catches Scams That Card Data Misses
Card-not-present fraud tools mostly look at the payment itself: card number, CVV match, address verification, amount, IP address and order history. Those checks are fairly good at catching stolen cards. They struggle with two patterns.
The first is account takeover. A criminal logs in with a real username and password bought from a breach, then spends saved cards, store credit or loyalty points. The card on file is valid and the account history is clean, so the payment checks pass. Our guide on how merchants fight deepfake-fueled account takeovers covers layered defenses against this pattern.
The second is the scam-driven purchase. The real customer, on their own phone, buys gift cards or event tickets because someone on the phone told them to. Every identity check passes because the identity is real. The money still ends up with a criminal, and the purchase can still come back as a dispute.
Device location fraud signals add context that card data lacks. The first is whether the device is at a place where this account normally logs in. Incognia's own data says 90% of mobile logins happen at a user's trusted locations. Other signals flag a spoofed GPS reading, an emulator pretending to be a phone, or a rooted device. The scam-specific signals are a remote-access app running in the background, or an active phone call while the customer buys $500 in gift cards.
One practical limit matters more than any feature list. Precise location comes from a mobile app that has the vendor's SDK installed and the user's permission to read location. A browser checkout usually gets location from the IP address, which is coarse and easy to hide with a VPN or residential proxy. If you run a web-only store, you'll get a fraction of what an app-first marketplace gets from the same vendor.
Where Location Signals Help Most: Account Takeovers, Promo Abuse and Marketplaces
Account Takeover Prevention for Merchants With Stored Value
Account takeover prevention pays off when an account is worth stealing, meaning it holds saved cards, store credit, loyalty balances, tickets or in-game currency. Incognia markets a login flow that lets users at a trusted location skip extra steps. A login from far away gets a one-time code or another challenge. For the merchant, that means fewer challenges for regular customers and a hard stop on credential-stuffing attempts from a new device in another state.
Promo Abuse and Multi-Accounting
New-customer discounts, referral credits and sweepstakes entries give people a reason to open many accounts. In a 2024 interview with The Paypers, Ferraz described using location behavior and device signals to find repeat offenders who create, rent or share accounts. He also mentioned ban evasion in ride-sharing. Ten "new" accounts that all sleep at the same address is a pattern an email check will never see.
Marketplaces, Ticketing and Gaming
Incognia's bank logic carries over most directly to marketplaces, because buyers pay seller accounts that the platform also controls. A buyer and seller who share physical places may be working together on fake sales, reviews or refund schemes. A buyer with no connection to a brand-new seller, rushing a high-value purchase while on a phone call, fits the scam pattern.
Ticketing accounts become targets around on-sales, when the tickets they hold are worth stealing and transferring to strangers. A login from an unfamiliar location followed by a transfer to a new recipient is a sensible thing to watch for. Real-money gaming, sweepstakes and sports betting operators already run location checks because legality depends on state law. That means spoofing and collusion detection often fits into tools they already have (Incognia lists player collusion as a mobile gaming use case). Confirm the legal status of your offering in each state with counsel.
Privacy and Consent Rules to Check Before Collecting Location Data
Location rules come from law and app-store policy, not from Visa or Mastercard. Several U.S. state privacy laws treat precise geolocation as sensitive information with extra notice, consent or opt-out requirements, and the details differ by state. iOS and Android both make the user grant location permission to an app. Either platform's review process can reject an app whose stated purpose doesn't match how it uses location.
One common misunderstanding: a vendor saying its product stores "no PII" does not settle your obligations. Incognia's own solution brief makes that kind of claim. But a long-term record of where a device spends its nights can still count as personal or sensitive data under a state law, depending on how that law defines those terms. Your privacy policy, consent flow and vendor contract need to account for it either way.
Before you sign, get written answers to these questions:
- Does the vendor act only on your instructions, or does it pool your users' data with other clients' data to build a shared graph?
- How long does it keep raw location data, and can you receive only a risk score instead of coordinates?
- What does your privacy notice need to say about using location for fraud prevention, and does your consent prompt match it?
- How are minors' accounts handled, and what happens to the data when a user deletes their account?
This is general information, not legal advice. Have a privacy attorney review the flow for the states where your customers live.
Evaluating Vendors: False Positives, Latency and Integration
Vendors quote accuracy, but what you need is precision at your own fraud rate. Because fraud is rare, a tool can be "99% accurate" and still flag more good customers than criminals.
Here is an illustrative example, not vendor data. Assume 100,000 logins a month, with 0.5% of them takeover attempts. The tool catches 70% of attacks and wrongly flags 1% of legitimate logins.
| Outcome | Count |
|---|---|
| Takeover attempts | 500 |
| Attempts flagged (70%) | 350 |
| Attempts missed | 150 |
| Legitimate logins | 99,500 |
| Legitimate logins flagged (1%) | 995 |
| Total flagged | 1,345 |
Overall accuracy is (350 + 98,505) ÷ 100,000, or 98.9%. But only 350 of the 1,345 flags, about 26%, are real attacks. Block every flag and you lock out 995 customers a month. Send flags to a one-time code instead, and those 995 customers face a short delay while most attackers fail. At this precision, a flag should trigger a challenge, not a block.
Ask vendors for these numbers on data that looks like yours, then test them:
- False positive rate at your chosen threshold, measured on your own traffic during a shadow-mode pilot, where the tool scores logins but doesn't act on them.
- Latency at the 95th and 99th percentile, plus what happens when the tool times out. Decide ahead of time whether the system fails open (lets the user through) or fails closed.
- Coverage when users deny location permission, use the website instead of the app, or travel.
- Integration scope: iOS and Android SDKs, a web script, a server-side API, and whether scores can feed your gateway or order-management rules.
Our guide to what AI fraud detection catches and misses goes deeper on model scoring. Our fixes for false declines show what overly aggressive rules cost you at checkout.
How Location Signals Fit With 3DS, Velocity Rules and Manual Review
Location and device signals work best before the payment, because that's where account takeovers start. Use them at login, password reset, email or phone changes, when a new card is added, and on ticket or balance transfers.
At checkout, other layers take over. Velocity rules in your payment gateway limit attempts per card, account, device or IP. 3-D Secure authentication lets the card issuer verify the cardholder on risky card-not-present payments. Under network rules, a successful authentication can shift liability for certain fraud chargebacks to the issuer. Confirm the details for your card brands and MCC with your processor.
This is the gap location data fills. 3DS confirms identity, and in a scam the identity is real, so the victim passes the challenge. Signals like an active call, a remote-access tool or a first-time payment to a stranger are what catch that case. Our piece on social engineering lessons for merchants covers the human side of these attacks.
A workable routing plan gives each sensitive action a risk score. Low risk goes through. Medium risk gets a one-time code or 3DS. High risk is held for manual review. There, a trained person checks the order details, the account history and, on marketplaces, the buyer-seller relationship before releasing it. Track what reviewers decide and use it to adjust your thresholds every month.
Start with your own losses. Pull 90 days of fraud disputes by chargeback reason code and note whether each one began with a login, a new account or a checkout. If most losses trace back to app logins and account changes, a location tool is worth a shadow-mode pilot. If you sell mainly through a browser, tighten 3DS and velocity rules first. To review how 3-D Secure and gateway controls fit your online payment processing setup, request a free quote. A MannyPay specialist will respond within one business day.
Sources
- Incognia launches real-time scam prevention with location data (The Paypers, Oct. 26, 2026)
- Incognia Launches Real-time Scam Prevention Powered by Patented Location Intelligence (PR Newswire via Yahoo Finance, Oct. 21, 2026)
- Incognia uses location intelligence to detect payment scams before money moves (Biometric Update)
- Preventing and fighting fraud with next-generation identity signal (The Paypers interview with André Ferraz)
- Account Takeover Prevention Using Location Behavior (Incognia)
- Incognia Use Cases
- Incognia Fraud Prevention
- Incognia Account Takeover Prevention Solution Brief
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
