Fraud Farm Detection

To a bank, a fraud farm may look like hundreds or thousands of separate users.

Each account can have its own identity, credentials, transaction history, and apparent device. Even suspicious devices can look unrelated when they are analyzed one at a time.

The broader operation becomes clearer when fraud teams look beyond individual accounts and devices to the infrastructure they share.

A single device may access an unusually large number of accounts. Multiple suspicious devices may operate from the same exact location. A new device identity may appear in the same place where a previously blocked device was active.

Location adds physical context to activity that can look unrelated digitally.

A fraud farm is an organized operation that uses shared people, devices, software, or physical infrastructure to conduct fraud or abuse at scale.

There is no single fraud-farm setup.

Some operations use large facilities with many people running scams or managing accounts. Others use racks of physical phones. Smaller operations may rely on only a few devices combined with app cloning, automation, or remote access to rented devices.

The common feature is coordination.

A relatively small physical operation can sit behind a much larger number of digital accounts, identities, and apparent devices.

Fraud farms can support different types of criminal or abusive activity, including mule-account operations, account takeover, scams, promotion and refund abuse, fake-account creation, and other forms of coordinated fraud.

Fraud farms are built to operate more accounts and transactions than the underlying number of people or devices would normally allow.

Fraudsters can increase that scale in several ways:

• App-cloning software can run multiple instances of an application on the same physical device
• Factory resets and reinstalls can change the device identifiers visible to a fraud system
• Physical devices can be rotated or rented
• Automation can reduce the amount of manual work required to operate accounts

As these techniques are combined, one physical device can appear to be multiple devices, and one physical location can support activity across large numbers of accounts.

This makes the digital footprint of the operation much larger and more fragmented than the infrastructure behind it.

AI and automation are making fraud farms easier to scale

Fraud farms increasingly do not require large teams or custom-built infrastructure.

Fraudsters can rent physical devices rather than buy them. App-cloning software can increase the number of accounts that a small number of devices can operate. Automation can take over repetitive tasks.

AI is reducing some of the technical skill and manual effort required to control this infrastructure.

The same physical operation can therefore generate more digital activity.

For banks, that makes understanding shared infrastructure more important. The number of accounts and apparent devices may continue to grow faster than the number of people or locations behind them.

Common fraud farm signals in device and location data

Fraud farms do not always produce one obvious fraud signal.

They are more often visible as a set of relationships across accounts, devices, locations, and time.

Common patterns can include:

• one device associated with an unusually large number of accounts
• multiple accounts appearing across the same devices
• many suspicious devices operating from one precise physical location
• new device identities repeatedly appearing from a location associated with previous suspicious activity
• rapid device turnover or factory-reset behavior
• app cloning, emulation, rooting, or tampering
• coordinated timing across accounts or devices
• infrastructure with previous fraud or risk history

None of these signals proves that a fraud farm exists on its own.

The stronger evidence comes from the way they connect.

One device connected to many accounts

A device that accesses an unusually high number of supposedly independent accounts can be an early indicator of coordinated activity.

The relationship can take several forms.

One physical device may simply be used to access many accounts. App-cloning tools may allow multiple instances of the same application to run on that device. Device manipulation can also make a single physical device appear under multiple digital identifiers.

Account concentration around a device therefore provides a useful starting point for investigation, but fraud teams still need additional context to determine what is happening.

Many devices connected to one precise location

The opposite pattern can also reveal coordinated activity.

A fraud team may see many device identities that appear unrelated digitally but repeatedly operate from the same physical environment.

That concentration becomes more meaningful when those devices also show suspicious account relationships, manipulation, previous risk, or unusual activity.

Precise location can therefore connect devices that would otherwise appear independent.

Device identities that keep changing at the same location

Fraudsters can attempt to break device continuity through factory resets, reinstalls, app cloning, emulation, or device rotation.

A device may disappear from the fraud system and return with a new identifier.

A new device identity on its own may appear clean.

If that device begins operating from the same precise location associated with previous suspicious activity, the physical environment provides another point of continuity.

Coordinated activity across time

Fraud farms may also become visible through changes in a location or device cluster over time.

Fraud teams can look for:

• increasing numbers of devices appearing at the same location
• growing account concentration around those devices
• repeated replacement of device identities
• similar patterns of account access or activity
• previously inactive infrastructure becoming active again

Following those relationships over time can reveal an operation that a single point-in-time risk decision would miss.

Why does account-by-account fraud detection miss fraud farms?

Account-level fraud controls answer an important question: does this particular account or interaction look risky?

Fraud farms create a different problem.

Individual accounts within an operation may use separate identities, devices, credentials, and histories. Each interaction can therefore appear independent when evaluated on its own.

The fraud may only become apparent when those interactions are connected.

For example, ten accounts may each appear to use a different device. Looking at those ten account-device pairs separately may reveal little.

A broader view could show that several devices operate from the same apartment, share manipulation signals, or connect to other accounts already associated with suspicious activity.

That is why blocking accounts one at a time can become a reactive cycle. The infrastructure behind the activity remains intact and can continue operating other accounts.

Fraud-farm detection requires moving from:

Is this account suspicious?

to:

What other activity is connected to the same infrastructure?

Why is location important for detecting fraud farms?

Location helps connect digital activity to the physical world.

Fraudsters can change many of the digital signals that financial institutions use to identify them.

Accounts can be replaced. Device identifiers can change. IP addresses can be hidden behind proxies. Applications and devices can be manipulated.

The people and devices carrying out the activity still have to operate somewhere.

Precise location can help fraud teams determine whether:

• supposedly unrelated devices operate from the same physical environment
• new device identities appear in locations already associated with suspicious activity
• many accounts are being accessed from an unusually concentrated location
• a device is operating from an address or trusted location associated with the customer
• suspicious activity persists at the same location as accounts and devices change

For fraud-farm detection, this makes location more than another isolated risk signal.

It can provide the physical connection between digital entities that otherwise look unrelated.

Why does apartment-level location matter?

Location needs enough precision to distinguish suspicious infrastructure from legitimate activity nearby.

Knowing that many devices are in the same city or neighborhood provides little evidence of coordination.

A large apartment building may contain hundreds of legitimate residents. Treating activity across the entire building as one risk cluster could create significant false positives.

Apartment-level location can distinguish nearby physical environments and isolate the location where suspicious devices are actually concentrated.

That precision helps fraud teams identify a potential fraud farm without treating everyone in the surrounding building or area as part of the same operation.

Incognia detects suspected fraud farms by analyzing relationships across devices, accounts, device integrity, historical risk, and apartment-level location.

Rather than treating every account or apparent device as an isolated event, Incognia can identify patterns such as:

• unusually high numbers of accounts associated with a device
• clusters of suspicious devices operating from the same apartment-level location
• new device identities appearing from locations associated with previous suspicious activity
• app cloning, emulation, rooting, tampering, and other forms of device manipulation
• device and location relationships that persist over time
• connections to previously observed risky infrastructure

Apartment-level location can provide the physical connection between changing digital identities.

Persistent device intelligence helps establish device history and continuity. Device integrity signals provide context about attempts to manipulate the environment. Historical and network intelligence help connect current activity to previously observed risk.

Together, these signals help fraud teams identify the infrastructure behind coordinated activity instead of responding to accounts one at a time.

A fraud-farm investigation often begins with one suspicious account, device, transaction, or location.

From there, fraud teams can expand outward:

1. Identify the accounts and devices associated with the suspicious activity.
2. Look for unusually concentrated account-device relationships.
3. Check for app cloning, emulation, resets, tampering, or other device manipulation.
4. Examine whether suspicious devices share precise physical locations.
5. Review device and location history over time.
6. Expand the investigation to other accounts and devices connected to that infrastructure.
7. Compare timing, previous risk, and account behavior across the broader cluster.
8. Determine whether the combined evidence is more consistent with normal user activity or one coordinated operation.

No single signal should be used to confirm a fraud farm on its own.

The investigation becomes stronger as account, device, integrity, location, and historical evidence begin pointing to the same infrastructure.

One Incognia investigation shows how much of a fraud farm can remain hidden when suspicious devices are analyzed individually.

In just a few months, one operation grew from 8 suspicious devices accessing 153 accounts to 159 devices accessing more than 11,150 accounts.

Several of the devices were already suspicious on their own.

Apartment-level location showed that they were connected.

It started with a few suspicious devices

In May, Incognia was analyzing suspicious device activity across a bank's app.

Several devices immediately stood out.

In 30 days, one device had accessed 1,181 accounts. Another had accessed 1,108 accounts, and a third had accessed 1,040 accounts.

Each device was worth investigating independently.

The device that accessed 1,181 accounts was the highest-volume suspicious device in the analysis, so the team started there.

Apartment-level location revealed a larger cluster

Incognia examined the physical location associated with that device.

At the same apartment, the team found 15 suspicious devices.

Together, those devices had accessed 3,353 accounts.

Those accounts were distributed across the country, but the devices accessing them were concentrated in one place.

The other two high-volume devices from the original analysis were operating from that same apartment as well.

What had looked like several separate suspicious devices was part of a much larger physical cluster.

Looking backward showed that the operation was already growing

The team then reviewed previous activity at the same apartment.

In April, 8 suspicious devices at the location had accessed 153 accounts.

By May, that had grown to 15 devices accessing 3,353 accounts.

Once the physical location was known, the team had something persistent to follow.

The same apartment eventually reached 159 suspicious devices

Over the next several months, more suspicious devices appeared at that apartment and account volume continued to increase.

From April through July:

Suspicious devices grew from 8 to 159.

Accounts accessed grew from 153 to 11,156.

The device population changed substantially.

The apartment remained the common physical connection.

One device inside the farm accessed more than 7,000 accounts

Individual devices within the larger cluster were also being reused heavily.

One device had accessed 1,765 unique accounts in June.

By July, that number had reached 7,096.

That represents roughly fourfold growth in a month for one device inside the broader operation.

The bank blocked the devices associated with the location

By following the same apartment over time, the team was able to identify the larger device-farm operation.

The bank ultimately blocked the devices associated with that suspicious location.

A broader location signal could have grouped legitimate customers in the same apartment building or nearby buildings into the same risk decision.

But apartment-level location allowed the bank to see the operation behind the individual devices and act against the infrastructure it could identify.

Fraud farm describes the infrastructure behind an operation, not the specific fraud being committed.

The same basic model, many accounts or digital identities controlled through shared devices and physical infrastructure, can be used for very different schemes.

Mule account handovers: 200 devices, 4,500+ accounts

During a proof of value with a bank, Incognia uncovered one of the largest mule account fraud farms we had seen.

The bank had originally come to Incognia to investigate broader fraud losses around onboarding. It was not specifically looking for a fraud farm.

As the team analyzed the data, a pattern started to emerge.

Multiple accounts were being created on one device. Shortly afterward, those same accounts were accessed from different devices. The device that had originally created the accounts would not appear again.

Looking at those events individually could make them appear unrelated.

Incognia connected the accounts and devices using apartment-level location and found the larger operation:

200 devices tied to more than 4,500 accounts operating from a single apartment.

The pattern was consistent with a large-scale mule account handover operation.

The bank discovered that roughly 4% of newly opened accounts were being handed over within a week.

The account creation itself was only part of the story. Connecting activity across devices, locations, and time revealed what happened after onboarding and exposed the infrastructure supporting the handovers.

Promo abuse: 60,000 fake accounts in two days

Fraud farms can also be used for large-scale first-party abuse.

In one marketplace operation, fraudsters were systematically exploiting new-user welcome bonuses and promotional codes.

The operation ran from a single apartment using multiple physical mobile devices.

On those devices, the fraudsters used app cloners to run multiple isolated instances of the marketplace app. Each instance could be used to create another account without requiring another physical phone.

Across the operation, the fraudsters created 60,000 fake accounts in two days to repeatedly claim new-user promotions.

The fraud objective was very different from the mule account operation.

The infrastructure pattern was similar: a relatively concentrated physical setup supporting a much larger number of digital accounts.

Blocking individual accounts remains necessary, but fraud farms are designed to replace individual digital identities.

Another account can appear.

A device can be reset or replaced.

The IP address can change.

Fraud teams need enough context to identify what persists across those changes.

Incognia combines apartment-level location, persistent device intelligence, device integrity, historical device and location signals, and network intelligence to connect suspicious activity across time.

Location provides an important physical point of continuity when the surrounding digital identifiers keep changing.

That gives banks another way to identify and disrupt the infrastructure behind organized fraud instead of repeatedly responding to one account at a time.