--- title: What to do if a risk result comes back as 'High Threat' for Online Fraud Indicators description: "What an \"Online Fraud Indicators - High Threat\" result means, common innocent explanations, and how to resolve or escalate the flag." --- [Skip to content](https://knowledge.easyaml.com/online-fraud-indicators#main-content) English - Australia Show submenu for translations Open main navigation Close main navigation - English - Australia Show submenu for translations How can we help you? - There are no suggestions because the search field is empty. 1. [easyAML Help Centre](https://knowledge.easyaml.com/?hsLang=en-au) 2. [FAQs](https://knowledge.easyaml.com/faqs?hsLang=en-au) 3. [Quick Answers](https://knowledge.easyaml.com/faqs?hsLang=en-au#quick-answers) # What to do if a risk result comes back as 'High Threat' for Online Fraud Indicators ## A failed Online Fraud Check (High Threat) does not automatically confirm that a transaction is fraudulent. The Online Fraud Check assesses the risk associated with a transaction. It works by comparing two key location indicators: - **Device Location:** The geographical location of the device used to complete the verification. - **Internet Service Provider (ISP) Location:** The location registered to the IP address of the internet connection being used. A common cause for a **High Threat** flag is if **iCloud Private Relay** is enabled, which can be found under the **INTERNET PROVIDER DERIVED LOCATION** by clicking **VIEW DETAILS**. This feature is a privacy setting that's switched on by default for a lot of Apple users. It masks the user's true IP address, triggering an alert because the security system detects a location mismatch. It cannot verify that the digital location (IP address) aligns with their physical identity, however the use of Location Services provides their true GPS coordinates. ![](https://knowledge.easyaml.com/hs-fs/hubfs/image-png-Aug-14-2026-04-28-56-2072-AM.png?width=670&height=781&name=image-png-Aug-14-2026-04-28-56-2072-AM.png) An analysis of the IP address is also conducted to identify potential red flags: - The use of services designed to obscure location, like Virtual Private Networks (VPNs), relays or firewalls. - An origin from a country with a high-risk profile for fraudulent activities. - Inclusion in databases of IP addresses previously linked to fraudulent behaviour. An IP address can be flagged as a "high threat" due to a poor IP reputation based on historical behaviour. This often has nothing to do with the current user's actions.  For a low-risk transaction, both the device location and the ISP location should be in the same country and in close geographical proximity to one another.  You can find further information from our geolocation provider [https://db-ip.com/](https://db-ip.com/) and entering the IP address.   Overall, it means the verification session showed potential signs where connection or location signals are associated with fraud risk - such as VPN use, mismatched geolocation, or suspicious device behaviour - ***not*** that your client failed verification. These are items to just be aware of when looking at the overall result.  1. Don't dismiss it automatically - treat it as a risk signal to resolve, like a screening match. 2. Consider innocent explanations first: a client overseas, on a corporate VPN, or on a work device commonly triggers these flags. 3. Ask the client where and how they completed the check - routine questions aren't tipping off. 4. If unresolved, escalate to your Compliance Officer and consider Enhanced Due Diligence. *Further reading:* [Does easyAML check whether the client is using a VPN?](https://knowledge.easyaml.com/does-easyaml-check-whether-the-client-is-using-a-vpn?hsLang=en-au) - [easyAML Set-up Checklist](https://knowledge.easyaml.com/easyaml-set-up-checklist?hsLang=en-au) - [Training Videos](https://knowledge.easyaml.com/training-videos?hsLang=en-au#main-content) - [Register for Upcoming Webinars](https://knowledge.easyaml.com/training-videos?hsLang=en-au#register-for-upcoming-webinars) - [Previously Recorded Webinars](https://knowledge.easyaml.com/training-videos?hsLang=en-au#previously-recorded-webinars) - [FAQs](https://knowledge.easyaml.com/faqs?hsLang=en-au#main-content) - [General](https://knowledge.easyaml.com/faqs?hsLang=en-au#general) - [AML/CTF basics](https://knowledge.easyaml.com/faqs?hsLang=en-au#aml-ctf-basics) - [Getting started](https://knowledge.easyaml.com/faqs?hsLang=en-au#getting-started) - [Compliance Program](https://knowledge.easyaml.com/faqs?hsLang=en-au#compliance-program) - [Customer Due Diligence (CDD)](https://knowledge.easyaml.com/faqs?hsLang=en-au#customer-due-diligence-cdd) - [Training](https://knowledge.easyaml.com/faqs?hsLang=en-au#training) - [Reporting](https://knowledge.easyaml.com/faqs?hsLang=en-au#reporting) - [Sector Coverage](https://knowledge.easyaml.com/faqs?hsLang=en-au#sector-coverage) - [Pricing & Plans](https://knowledge.easyaml.com/faqs?hsLang=en-au#pricing-plans) - [Sales & Onboarding](https://knowledge.easyaml.com/faqs?hsLang=en-au#sales-onboarding) - [Trusts & Complex Structures](https://knowledge.easyaml.com/faqs?hsLang=en-au#trusts-complex-structures) - [Reliance & KYC Sharing](https://knowledge.easyaml.com/faqs?hsLang=en-au#reliance-kyc-sharing) - [ACMA SMS Sender ID Register](https://knowledge.easyaml.com/faqs?hsLang=en-au#acma-sms-sender-id-register) - [Quick Answers](https://knowledge.easyaml.com/faqs?hsLang=en-au#quick-answers) - [How-to Guides](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#main-content) - [Tasks](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#tasks) - [Transactions](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#transactions) - [Entities](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#entities) - [Insights](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#insights) - [Training](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#training) - [Compliance](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#compliance) - [Reports](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#reports) - [Account Settings](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#account-settings) - [Billing & Plans](https://knowledge.easyaml.com/how-to-guides?hsLang=en-au#billing-plans) - [KYC Information](https://knowledge.easyaml.com/kyc-information?hsLang=en-au#main-content) - [Client Resources](https://knowledge.easyaml.com/kyc-information?hsLang=en-au#client-resources) - [Person being verified](https://knowledge.easyaml.com/kyc-information?hsLang=en-au#person-being-verified) - [Glossary](https://knowledge.easyaml.com/glossary?hsLang=en-au) - [Integrations](https://knowledge.easyaml.com/integrations?hsLang=en-au#main-content) - [General](https://knowledge.easyaml.com/integrations?hsLang=en-au#general) - [Action Step](https://knowledge.easyaml.com/integrations?hsLang=en-au#action-step) - [Clio](https://knowledge.easyaml.com/integrations?hsLang=en-au#clio) - [XPM](https://knowledge.easyaml.com/integrations?hsLang=en-au#xpm) - [Scantek](https://knowledge.easyaml.com/integrations?hsLang=en-au#scantek) - [News Feed](https://knowledge.easyaml.com/news-feed?hsLang=en-au#main-content) - [Latest Release Notes](https://knowledge.easyaml.com/news-feed?hsLang=en-au#latest-release-notes) - [Support](https://knowledge.easyaml.com/support?hsLang=en-au) [![easyAML-Logo\_Magenta](https://knowledge.easyaml.com/hs-fs/hubfs/easyAML-Logo_Magenta.png?width=200&height=47&name=easyAML-Logo_Magenta.png "easyAML-Logo_Magenta")](https://easyaml.com/) Copyright © 2026, easyAML