Traveller or proxy: how to read country changes on a rewards account
Most fraud tools flag an account the moment its IP country differs from the one it signed up with, and keep flagging it for good. That punishes people who move, travel or spend a month in one country and the next in another, and it misses what matters: proxy users whose real connection shows for a few minutes between sessions in a high-payout country. This guide explains how to read country changes by speed and pattern instead.
Short answer
Compare each connection with where the account was lately, not with where it signed up. A single switch is a trip or a move: give it little weight and let it fade after a few days. Two or more switches within 48 hours, with a high-payout country taking turns with a lower-paying one, are a proxy that drops: that deserves real weight. Ignore neighbouring countries and VPN exits.
- A move
- Two long stays, one switch. Not fraud: it fades after 3 days in the new country.
- A proxy that drops
- A stay of minutes in another country between two in a high-payout one.
- What it predicted
- On one survey site, 71% of the conversions of hopping accounts were reversed.
- Never counted
- Neighbouring countries, VPN and datacenter exits, privacy relays.
Why "the country changed" is the wrong question
The classic rule is simple: remember the country an account first appeared from, and flag every later event from somewhere else. It is easy to build and easy to explain, and it is wrong in both directions.
It flags honest people forever. A user who signs up in Spain and moves to Sweden a month later carries a "country changed" flag on every login, click and cashout from then on, although nothing about them is suspicious. Students, seasonal workers, people who split the year between two homes, digital nomads: rewards and survey sites have plenty of them, and a permanent flag nudges every one of them towards review.
And it says nothing about the pattern that matters. A proxy user signs up through an Australian residential proxy, so the "first country" is Australia. Every time the proxy drops for a minute, the real Nigerian connection shows, then the proxy comes back. The old rule sees that account in its first country almost all the time and barely notices. The question to ask is not whether the country changed, but how fast, how often and between which countries.
Three patterns: a move, a trip and a hop
Group an account's connections into stays: consecutive events from the same country. Read that way, almost every account with more than one country falls into one of three shapes.
| Pattern | What the stays look like | Reading |
|---|---|---|
| A move | Spain for weeks, then Sweden for weeks | One switch, long stays on both sides. Normal. |
| A trip | Germany, five days in Italy, back to Germany | Two switches, days apart. Normal. |
| A hop | Australia, Nigeria for one minute, Australia | Two switches within hours, between a high-payout country and another. A proxy that dropped. |
The difference between the trip and the hop is time. People who travel stay somewhere: a flight takes hours, a holiday takes days. Nobody leaves Australia for Nigeria and comes back within the hour. When the stay in the other country lasts minutes and the account returns to where it was, the account never moved: its connection did.
The direction matters too. Faking a location pays when it moves an account into a country whose offers pay more: the United States, the United Kingdom, Australia, Canada, Germany. Two countries that pay alike, such as Spain and France, taking turns is far more often a border town, a phone roaming between two networks or someone commuting, and deserves much less weight.
What a proxy that drops looks like
Residential and mobile proxies are not as steady as their sellers claim. Sessions expire, an app reconnects before the tunnel is up, a phone switches from Wi-Fi to mobile data. Each of those moments sends one or two requests from the user's real connection. On a rewards site, those requests are logins, offer clicks and page loads, and they arrive from the real country between long stretches in the fake one.
Three things together make that pattern hard to explain innocently: the stay in the other country is minutes long, the account comes back to the same country, and one side is a high-payout country while the other is not. Any one alone is weak. Together they are one of the clearest pictures of a proxy you will get from the server side, and they need no browser script at all, only the IP of each event.
If you do run a browser script, the clock usually agrees: the device keeps the time zone of where it really is, so the Australian sessions come with a West African clock. The hidden VPN guide explains how to read it.
What should never count as a change
Before reading any pattern, remove the connections that say nothing about where the person is. Otherwise every VPN user and every border resident looks like a hopper.
- VPN, datacenter and Tor exits: they are where traffic leaves, not where the user is. They have their own signals; do not also count them as a trip.
- Privacy relays and big platforms: iCloud Private Relay, Google, Cloudflare and similar networks route ordinary users through other countries on purpose.
- Neighbouring countries people commute between: the US and Mexico, Germany and Poland, Austria and its eastern neighbours. A phone near a border can switch countries several times a day.
- Events without an IP of their own: a postback from an offerwall carries the offerwall's server address or none at all. Use the IP of the user's own connections.
What is left are the user's real connections. Only those should be compared with each other, and the comparison should be with the most recent ones, never with the first.
What the data says
We replayed 30 days of a survey rewards site that reports its reversals back to us, comparing the old rule (first country) with the new one (recent stays, speed and pattern). Survey networks reverse a share of conversions every week, so reversals are a fair measure of who was really fraud.
| Accounts | Conversions | Reversed |
|---|---|---|
| Scored higher by the new rule (hopping) | 75 | 53 (71%) |
| Scored lower by the new rule (settled moves) | 35 | 4 (11%) |
| All accounts on the site | 1,060 | 23% |
The accounts the pattern catches were three times as likely to be reversed as the average account; the ones the old rule had flagged only for living somewhere new were half as likely. Accounts that went from a high-payout country to Nigeria and back within hours had 48% of their conversions reversed, against 33% for the rest.
On two other rewards sites, 227 flags that only said "this account once connected from elsewhere" went away, with nothing lost: none of those accounts was hopping.
How CashoutGuard does it
On every event with an IP, CashoutGuard looks at the account's real connections of the last three days. The reason country_changed then works like this:
- One switch: a low weight (15) for three days, with the country it came from and how many hours ago. After three days in the new country the account has moved, and the reason disappears.
- Two or more switches within 48 hours: hopping. A weight of 35 when a high-payout country and a lower-paying one take turns, 15 between two alike. The reason shows the path, for example AU → NG → AU.
- Within three hours, between distant countries of different payouts:
impossible_travelon top, because nobody travels that far that fast.
None of these blocks anyone on its own. They add to the other evidence on the account, such as the clock, the device and the accounts it shares. On each account page, the Countries panel lists the stays with their dates and marks a stay of hours between two in the same other country, so a reviewer sees a move or a hop at a glance. New sites start in shadow mode, and you can check any address with the free IP checker.