As AI and robotics become an ever-more important presence in everyday life, the use cases are quickly going from science fiction to real life.

One of the most popular areas of interest is autonomous vehicles, self-driving cars able to navigate the roads and get us to our destination without needing to touch the wheel.

Modern fraud attacks look like a relay race where different tools and actors handle each stage of the journey from signup to cash-out.

When you only inspect one signal at a time, such as IP or email, attackers simply shift to a different part of the chain and still succeed.

Anatomy of a Modern Fraud Chain

A typical attack chain starts with automation to create scale. Attackers use bots and scripts to open large numbers of accounts with minimal human effort, often rotating infrastructure to avoid rate limits and simple bot rules.

Those bots are usually powered by “aged” or compromised emails and leaked credentials so that every account looks like it belongs to a long standing user instead of something created yesterday.

Residential proxies then mask traffic behind real consumer IP ranges, making traffic appear like normal home users rather than data centers or known VPN services.

Once those accounts are established, they shift tactics from automation to slower, human driven sessions to blend into normal usage.

At this point the chain reaches account takeover and monetization, using malware links, phishing, and credential stuffing outputs to log in, change details, and push through high value transactions.

Throughout this lifecycle, the tools are mixed and matched. A single actor may move from a headless browser and proxy at signup to a mobile device emulator and different proxy provider at login, then hand off access to another party who specializes in draining funds or exploiting promo campaigns.

This is exactly why a point in time, single signal check rarely tells the full story

False Positives from Siloed Checks

When teams lean on one dominant signal, such as IP reputation, false positives become a daily problem. Legitimate users on shared Wi Fi, mobile carrier NATs, or corporate VPNs can inherit the poor reputation of a small number of bad actors on the same ranges, even though their intent is clean.

Blocking by email alone has similar issues, since free webmail domains are used by both sophisticated attackers and completely normal customers.

Identity centric controls on their own also hit a wall. Static data checks, like simple name and document matches, are easy to spoof for synthetic identities built from real data fragments.

Device centric controls that only look for rooted phones or emulators can miss fraudsters operating on seemingly normal devices that have been compromised earlier in the chain. Even bot specific solutions can create blind spots when they work alone.

Once a credential stuffing campaign ends and attackers pivot to manual logins with the same stolen credentials, pure bot tools see only “human” traffic and approve it. The result is a pattern where high risk users are blocked while determined adversaries adapt and slip through.

Multi-Signal Correlation in Practice

Effective fraud defense comes from correlating IP, identity, device, and behavioral signals at every step of the journey instead of evaluating each one in isolation.

An IP that looks slightly suspicious on its own becomes clearly abusive when tied to dozens of new accounts on the same device fingerprint and similar behavioral patterns during the first session.

Likewise, a user with an apparently normal device and clean email reputation can still be high-risk if login behavior reflects credential stuffing patterns or access follows known malware distribution campaigns.

Modern decision engines improve accuracy by weighing hundreds or thousands of data points together rather than enforcing rigid rules on a single attribute.

For organizations, that means unifying what were once separate views. IP intelligence, device fingerprinting, identity verification, and behavioral analytics should feed the same risk model so that each event is scored in context, not as a disconnected log line.

This multi signal approach is the most reliable way to raise the bar for attackers while reducing friction for genuine customers.

Case Study: Stopping Coordinated Signup Abuse

Consider a self service SaaS platform that offers a generous free tier and trials. As the product grows, abuse appears in the form of thousands of signups used to scrape data, test stolen cards, or resell access under the radar.

Early countermeasures rely on blocking certain IP ranges and obvious disposable email domains, but this only dents the problem and begins to impact small teams and freelancers on shared networks.

By shifting to a multi-signal model, the platform starts scoring signups across IP, device, identity, and behavior together.

New accounts that reuse the same device fingerprint with different emails, come from IPs recently seen in automated traffic, or immediately exhibit scripted behavior are grouped into coordinated abuse clusters instead of being evaluated one by one.

This lets the team apply precise responses, such as challenging only high risk clusters with additional verification or silently limiting their capabilities while letting low risk signups proceed without friction.

Over time, feedback from confirmed abuse and confirmed good users trains the scoring model, driving down false positives while pushing organized attackers to spend more effort for less return.

Outpacing Fraud Trends

Attackers are no longer tied to a single tool or weak point in your stack. They combine proxies, bots, synthetic identities, leaked credentials, and malware infrastructure across multiple stages, which means that single signal defenses will always lag behind.

To keep pace, fraud teams need correlation across IP, identity, device, and behavior in one coherent risk view rather than a collection of disconnected checks.

From here, the conversation shifts to how to operationalize that unified model, integrate it into existing workflows, and measure its impact on both loss reduction and customer experience.

Book a free consultation with a fraud expert today!

About IPQS

IPQS is a founder-led, self-funded company built on a simple principle: fraud prevention should be driven by real intelligence and a multi-layered approach. From day one, we’ve focused on owning the full lifecycle of our technology—developing and maintaining our own global data network, honeypots, and fraud intelligence specialists. This approach gives our customers a distinct advantage: faster insights, greater accuracy, and complete transparency into how decisions are made. By staying independent, we prioritize long-term innovation over short-term gains, continuously evolving our platform to stop fraud before it starts.

Sponsored and written by IPQS.

The next era of software ‘will be built for agents, by agents’, said Jentic CEO Sean Blanchfield.

Irish AI start-up Jentic is jumping on the OpenClaw frenzy with ‘Jentic Mini’, a free, open source, self-hosted offering for developers building with the product.

The months-old OpenClaw project has taken the developer world by storm, but security issues associated with letting personal agents access computers has already led to a number of different iterations from big-name brands such as Nvidia, with its open source stack NemoClaw, and Anthropic, which recently integrated OpenClaw’s text features into Claude.

Jentic Mini also markets itself to be safer to use in real-world software environments. Jentic said that the API execution layer gives developers a better way to govern how agents access tools, APIs and workflows to help reduce risks that come with broad and unmanaged credential exposure.

Jentic Mini is available on the start-up’s website, as well as on GitHub. It can also be used with other general-purpose agents including NemoClaw.

With more than 10,000 APIs, agents created using Jentic Mini will come with a “machine-usable map” of the tools and workflows that can be used, while enabling a more structured and controlled way to connect agents to real systems, the company said. Jentic’s standard model is available as a verified connector in Claude.

“The next era of software will not be built for humans. It will be built for agents, by agents,” said Sean Blanchfield, the CEO and co-founder of Jentic.

“Jentic Mini gives developers a free, open source foundation for that shift, connecting general-purpose agents to real systems through an AI-curated catalogue of more than 10,000 APIs and workflows. We want to make it dramatically easier to deploy agents that do real work.”

Jentic became the first Irish company to be selected for the AWS generative AI accelerator last year. The selection followed a €4m pre-seed raise in 2024, one of the largest in Ireland that year.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Chill, walking simulator-cross-traveling painter game Eastshade has been in my backlog for a while now. If memory serves, it’s because I found mention of it having wonderful virtual landscapes during a time when I was writing about that aspect of games.

Now, years on, I’ve finally made it into the world of EastShade and have fully embraced my role as a visiting painter for hire, intent on fulfilling some last requests by their late mother.