In just a few months, one fraud farm grew from 8 devices accessing 153 accounts to 159 devices accessing more than 11,150 accounts.
Several of those devices were already suspicious on their own. They were accessing unusually high numbers of accounts.
But apartment-level location is what showed us that they were connected to the same physical operation.
Once we found that location, we were able to look backward and forward in time and see the farm grow.
Here’s how we found it.
Note: This particular farm was in Brazil, but this kind of operation isn’t specific to Brazil. We’ve found similar farms in other markets.
1. It started with a few suspicious devices
In May, our team was analyzing suspicious device activity across one bank’s app.
A few devices immediately stood out. In 30 days, one had accessed 1,181 accounts. Another had accessed 1,108 accounts. And a third had accessed 1,040 accounts.
Those numbers were enough to make each device worth investigating on its own.
The first device (which had accessed 1,181 accounts) was the highest-volume suspicious device in the analysis.
So we started there.
2. Apartment-level location uncovered a much larger cluster
We looked at the physical location associated with that device.
At the same apartment, we found 15 suspicious devices in total.
Together, those devices had accessed 3,353 accounts.
And those accounts weren’t concentrated around that same place. They were spread across the country.
Then we noticed something else.
The other two high-volume devices from the May analysis, the ones that had accessed 1,108 and 1,040 accounts, were operating from that same location too.
What looked like a few separate suspicious devices was starting to look like a much larger operation.
3. Looking back showed the cluster was already growing
We compared activity at the same apartment in April with what we had found in May.
In April, there were 8 suspicious devices accessing 153 accounts.
By May, there were 15 suspicious devices accessing 3,353 accounts.
4. The team kept following the same apartment
From there, the investigation became simpler.
We had a physical place we could keep watching.
Over the next couple of months, more suspicious devices appeared at that same apartment and the number of accounts they were accessing kept climbing.
From April through July, suspicious devices grew from 8 to 159. Accounts accessed grew from 153 to 11,156
While the devices changed and volume grew, the apartment stayed the common point connecting them.
5. One device inside the farm showed how much reuse was happening
One device inside that larger cluster became especially active.
In June, it had accessed 1,765 unique accounts.
By July, that number had reached 7,096.
That’s roughly a 4x increase in one month.
And to be clear, that is one device in the farm, separate from the total for the full location**.**
This gives you a sense of how heavily individual devices inside these operations can be reused.
6. The bank blocked the devices from the suspicious location
By following the same physical location over time, the team was able to identify the larger device farm operation.
The bank ultimately blocked the devices associated with that location.
For this to work, you have to have apartment-level location.
If the location signal is too broad, you risk catching legitimate users who live in the same apartment building or nearby buildings. That creates a false-positive problem very quickly.
Apartment-level location lets you isolate the suspicious location closely enough to act on it without pulling nearby legitimate users into the same decision.
The pattern you may be missing is physical
The team could already see that individual devices were behaving suspiciously.
What they couldn’t see from those device-level signals alone was that several of the highest-volume devices were operating from the same apartment.
Apartment-level location connected those devices to the same physical place.
That changed the investigation from a series of suspicious devices into a view of the larger operation behind them.
That physical connection allowed the team to see the farm, follow its growth over time, and block the devices without affecting legitimate users nearby.
We see fraud farms like this a lot. If this is the kind of visibility you’re missing, we can show you how it works.
