MaxMind minFraud Insights checks and risk scores

A chargeback lands on an order your system accepted automatically, and you pull up the decision before anyone has changed the rule. The score was 3.15, comfortably below the accept line you set from MaxMind's example. At first, the result looks reassuring. Then you open the full response that arrived with the order, the one nobody read because the score said yes. The IP points to an anonymous hosting network. The order passed, but the surrounding details look very different from the single value that drove the decision. How much of the decision was hidden by letting the score stand in for the response?

MaxMind Insights response fields

Score returns a risk score and the risk of the IP address. Insights adds information about the IP, email, billing and shipping addresses, card issuer, phone and device, and Factors adds the reasons behind the score.

Those added fields let your rules act on a particular check, rather than only on the combined score. Phone details include whether a number is VoIP, whether its prefix is commonly associated with the billing postal code, and whether it is fixed or mobile. Insights costs $0.015 per query, compared with $0.005 for Score, according to MaxMind’s published pricing.

Scores and flagged details

Three changed orders sit below that line even though Insights flags a detail: the anonymous cloud IP scores 3.15, the New York billing address scores 0.16, and the postal code outside the city scores 0.10. The email changes moved the score more, and the Tor exit moved it to 7.61. The address changes moved it much less. MaxMind gives 5 as an example threshold in its threshold guidance.

Independent fraud checks

These checks can each carry a rule of their own.

• An anonymous IP, is_anonymous with user_type hosting: the Frankfurt cloud order scored 3.15 with it.
• A disposable mailbox, email.is_disposable: the score did rise, to 12.97.
• A billing address far from the IP or outside its country, distance_to_ip_location and is_in_ip_country: the New York billing order was 6,566 km away and scored 0.16.
• A postal code outside the city, is_postal_in_city: 199 km from the IP and a score of 0.10.

IP location is imprecise, and an anonymiser or proxy can prevent it from locating the person who initiated the transaction. MaxMind says IP geolocation should not be used to locate individuals or specific households in its geolocation guidance.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing

Checks alongside scores

One result was unexpected: the invented free-mail address scored 19.95, higher than the disposable mailbox at 12.97. Changing only the email also moved the IP’s own risk from 0.01 to 2.92. The score weighs information together, and the individual checks keep their findings separate, so a rule can read both.

Handle missing values explicitly. A decision table reads a missing number as zero unless a row catches it as null.

Fraud decision flow setup

1. Run your own input checks first, then make the paid Insights call.
2. Send every field you want Insights to assess, because a check for an input you did not send comes back empty.
3. Use single-check rules for anonymous hosting IPs, disposable mailboxes, address mismatches and postal codes outside the city. Those rules can send an order to review regardless of its score.
4. For other orders, use score bands as a starting point. MaxMind’s examples accept scores of 5 or lower, reject scores of 50 or higher, and review the rest. It says to fine-tune thresholds over time.
5. Choose what a failed call means in your rules. A failed source returns absent values with an error flag, and the rules decide what to do. A source is retried only if it is marked repeatable.
6. Report transaction outcomes to MaxMind through its Report Transactions API.

Checks by transaction type

Account creation

Email checks can carry a rule at account creation. In the test calls, Insights marked the disposable mailbox as disposable, and it returned a higher score for an invented free-mail address.

Checkout and payments

Address distance from the IP can carry a rule at checkout. Card issuer information also lets you consider the card’s country alongside the IP and billing details.

Lending

For a credit application, the request can identify the event as credit_application. IP and email checks can then inform the decision rules for that application.

MaxMind Insights FAQs

Is Insights worth three times the price of Score?

Insights costs three times as much per query in MaxMind’s published prices. In the one-change-at-a-time calls, it returned checks that a score under 5 did not surface as a reason to reject or review: an anonymous cloud IP, a distant billing address, and a postal code outside the city. Whether that added detail is worth the difference depends on whether your rules will act on those checks.

How accurate is the IP location?

IP geolocation is imprecise, and anonymisers or proxies can make the end user’s location inaccurate. In the calls, a Prague server IP was typed as a search engine spider, and the Frankfurt IP was an anonymous hosting address. Treat location as one check among several.

What does device tracking add?

Device tracking provides a token to send with the request. Insights can then return a device ID for your own modeling, along with a confidence value. MaxMind says to generate a fresh token for each session or transaction rather than store tokens long-term.

What do the API errors mean?

A 429 was rate-limited and not processed. A 402 means the account has run out of credit.

For setup, the account ID and license key form one HTTP Basic credential, kept in the vault. The assistant configures the data source from MaxMind’s request documentation.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing