The login came from a quiet residential street, a few kilometers from the customer's home. Right city, right internet provider, ordinary home IP address, reasonable hour. The fraud engine scored it low risk. The fraudster was on another continent - renting that suburban IP address for a few cents.

Residential proxies route internet traffic through real household devices and connections, so that whoever is behind them appears to be an ordinary local consumer. They have legitimate uses - price comparison, ad verification, research. But for fraudsters they solve the single biggest problem of operating at distance: looking like they belong. Sold as subscriptions with country, city, and even ISP-level targeting, they turn "suspicious foreign IP" into "loyal customer's neighborhood".

How fraudsters use residential proxies:

🎭 Impersonating the victim's location - During account takeover, the fraudster picks a proxy in the victim's city. Geolocation checks, impossible-travel rules, and "new location" alerts all stay quiet. The session looks like the customer logging in from home.

🔑 Credential stuffing at scale - The FBI warned already in 2022 that criminals run massive credential stuffing campaigns through residential proxies, rotating thousands of home IP addresses so every login attempt looks like a different genuine customer.^[ref] Datacenter IPs get blocked in bulk; somebody's living room does not.

🛒 Carding and mass account creation - Card-not-present fraud from an IP matching the cardholder's billing area, and fake account farms where every signup arrives from a different household. Promo abuse, bonus abuse, and fake reviews ride the same rails.

📱 Where the IPs come from: "passive income" apps - Bandwidth-sharing apps promise users money for their unused internet. Proxyware SDKs are also bundled into free apps, VPNs, and browser extensions - often without users understanding they've become an exit node for strangers' traffic.^[ref] That stranger might be running card fraud through your kitchen.

🦠 Botnet-built proxy networks - The 911 S5 service, dismantled in 2024, spread malware through free VPN apps and amassed over 19 million infected IP addresses. Criminals who rented them filed over half a million fraudulent US unemployment claims worth $5.9 billion, plus more than 47,000 fraudulent disaster loan applications. The DOJ called it likely the world's largest botnet ever - and its product was residential IP addresses.^[ref]

🌍 Geo-evasion - Appearing inside an allowed country to dodge sanctions screening, regional blocks, and country-based risk rules. Streaming fraud, ad fraud, and ticket scalping bots use the same trick to blend into local audiences.

The uncomfortable implication for fraud teams: a clean residential IP address is no longer a positive signal. It is the camouflage the professional attacker pays for. Meanwhile the "operator" of the IP - a family with an infected router or a bundled SDK - has no idea their address is on the crime scene.

What can we do:

For organizations and fraud teams:

- Retire IP reputation as a standalone control. Treat a residential IP as neutral, never as proof of legitimacy.

- Layer signals that proxies can't rent: device fingerprinting, behavioral biometrics, session telemetry, and account-level (not IP-level) velocity limits.

- Look for the mismatches proxies create: datacenter-grade automation behavior from home IPs, TCP/latency fingerprints inconsistent with the claimed location, IPs that flip between customers of different banks within minutes.

- Use commercial residential-proxy detection intelligence - these networks are mapped and the lists are available.

For individuals:

- Be very skeptical of "passive income" apps that pay for your unused bandwidth - you are selling your home's identity, and you don't get to choose who wears it.

- Download VPNs only from reputable vendors. 911 S5 spread through free VPN apps; their users unknowingly hosted criminal traffic.

- If police-grade trouble ever knocks because of "your" traffic, an infected device on your network may be the reason. Keep routers and devices updated.

- Switch off or disconnect devices that do not need to remain online, particularly overnight or during travel. This can interrupt proxy traffic, but it does not clean an infected router or device - investigate and reset or replace it before reconnecting.

The safest-looking visitor might be a criminal borrowing your neighbor's front door.