Fraud score thresholds: what 0–39, 40–74 and 75–100 should mean for your campaign

You added a fraud check to your funnel and now every visitor comes with a number between 0 and 100. The hard part is not getting the score. It is deciding what a 52 means on your sweepstakes offer, whether a 78 should be blocked on your finance offer, and how to avoid throwing away good leads while you protect your account.

A score without a decision rule is just another column in your tracker. This guide explains how to read the three risk bands, what to do in each one, and how to tune the cut-offs for each offer you run.

What the fraud score is

The fraud_score is a single 0 to 100 estimate of how risky an IP address is, where higher means riskier. It combines several signals into one number, including whether the address is a proxy, a vpn or a tor exit node, whether a VPN is in active use (active_vpn), whether the address has been linked to abuse recently (recent_abuse), and whether the traffic looks automated (bot_status). The response also includes the country, region, city, ISP, ASN and organization behind the address.

The individual flags tell you why an address is risky. The score tells you how risky it is overall. You need both: the score to sort traffic quickly, and the flags to make decisions that depend on your offer, such as whether a VPN matters on a geo-restricted campaign.

The three bands

A useful way to start is to split the range into three bands.

0 to 39: low risk

Most real visitors fall here: people on home broadband or mobile data, browsing normally, with no recent history of abuse. On most offers you should let this traffic through without friction. Adding extra steps for low-risk visitors costs you conversions and gains you very little.

That does not mean every low score is a perfect lead. A visitor can have a clean IP and still submit a fake email or phone number. The IP score answers one question: does the connection itself look trustworthy?

40 to 74: suspicious

This is the grey zone, and it is where most of your tuning happens. Visitors here may be on a VPN, a shared or corporate network, or a connection with some abuse history. Some are fraud. Many are real people.

Blocking this whole band is usually a mistake, because you will lose genuine leads. Letting it all through is also a mistake, because this is where incentivised and low-effort fraud tends to sit. The best approach is to add a second check: an SMS code, an email confirmation, or a manual review before you forward the lead to the network.

75 to 100: high risk

Traffic here has strong signs of fraud: proxies, active VPNs, Tor, bots or recent abuse, often several at once. On most affiliate offers, leads in this band are the ones that get scrubbed and turn into reversed commissions later.

For most campaigns, block or hold these. If you hold them, review them before forwarding rather than sending them straight on.

These bands are starting points, not rules

The 0–39, 40–74 and 75–100 bands are a sensible default. They are not right for every offer. What counts as acceptable risk depends on how much a bad lead costs you and how much a good one is worth.

Strict offers

Finance, insurance and other high-payout offers with heavy quality checks punish bad leads hard. A single scrubbed batch can cost more than a week of good traffic. On these, consider lowering your block threshold to 60 or 65 and sending everything above 30 or so through a second verification step.

Lenient offers

Low-payout, high-volume offers such as simple email submits or app installs often have looser quality checks and thinner margins. Adding friction to every borderline visitor may cost more in lost conversions than it saves. Here you might only block 85 and above and let most of the middle band through.

Geo-restricted offers

When an offer only accepts certain countries, the proxy, vpn and active_vpn flags matter more than the score itself. A visitor with a moderate score but an active VPN on a Pakistan-only offer is a bad lead because you cannot trust their location. Write a rule for the flag, not just the score.

What to do about it

Start with the defaults and log everything

Use the three bands as your initial rules and store the score and flags next to every lead in your tracker. Without that data you are tuning blind.

Compare against network outcomes

When the network's report arrives, match rejected and approved leads against the scores you recorded. You are looking for the point where rejections start to climb. If almost every lead above 60 is rejected on a particular offer, your block threshold for that offer should probably be 60, not 75.

Tune per offer, not per account

Keep a separate threshold for each offer, or at least for each type of offer. One global cut-off will be too strict for some campaigns and too loose for others.

Use the strictness option carefully

The IP check accepts an optional strictness parameter. Higher strictness makes the scoring more aggressive. If you change it, re-check your thresholds, because the same traffic may score differently. The full range and default are in the docs.

Review your cut-offs regularly

Traffic sources change. A placement that was clean last month can start sending proxy traffic this month. Look at your score distribution by source every week or two, and adjust.

Putting it into practice

Here is a simple request you can run at the moment a visitor lands or submits a form:

curl -H "Authorization: Bearer fn_your_key" \
  "https://fraudnova.com/api/v1/check?ip=192.0.2.123"

Read fraud_score from the response, apply your band rules for that offer, then apply any flag-based rules such as blocking tor or bot_status. Each check costs 1 credit. If you want to audit traffic you already bought, the batch endpoint accepts up to 100 IPs per request, which makes it quick to see how a source's scores are distributed before you scale it.

A worked example

Say you run two offers. Offer A is a finance lead offer in India with strict quality checks. Offer B is a broad email-submit offer.

• On Offer A, you allow 0–34 straight through, send 35–64 to SMS verification, and block 65 and above, plus any active VPN.
• On Offer B, you allow 0–59, send 60–84 to email confirmation, and block 85 and above, plus Tor and bots.

After two weeks you compare with the network reports and adjust. That is the whole process: start with the defaults, measure, and tune.

Next step

See where your current traffic falls. Run a few IPs from recent leads through the free IP checker and note which band each one lands in.

When you are ready to score every visitor, the IP fraud detection API returns the score and every flag in one request. You get 25 free credits after you verify your email, then 1 credit per check with no subscription. Parameters and response fields are documented in the API docs.