Shipping Anomalies

The Shipping Address Anomalies module detects fraud patterns that show up in where orders ship rather than what customers buy. It catches address hopping (many different shipping destinations), billing/shipping country mismatches, and bursts of new addresses that don’t match legitimate customer behavior.

Module ID: shipping_anomalies. Default: enabled. Free tier (complete detection; Pro adds the multi-country reshipping rule and diversity-trend detection).

---

What It Observes #

The module reads the address fingerprints that TrustLens records when each order is placed — the same keyed-hash shipping and billing address rows the Linked Accounts module writes, each stored with its country and the date it was first and last used. Every time an order is completed, the module:

1. Queues a score recalculation for the customer
2. Works out the customer’s current shipping-anomaly signal (see below)
3. If the signal is negative, logs an address_anomaly_detected event with the penalty and the rules that fired, and fires the trustlens/shipping_anomaly action (a Pro automation trigger)

Address hashes use the same keyed HMAC-SHA256 approach as the Linked Accounts module — raw addresses are never stored in the fingerprint table. The hash is built from address lines 1 and 2, city, postcode and country, normalized (lowercased, punctuation removed, common abbreviations expanded). Because the address rows come from Linked Accounts, turning that module off stops new address data reaching this one.

---

What It Signals #

Like the other history modules, Shipping Anomalies waits until the customer reaches the Full-confidence Order Threshold (default 3 orders). The rules below add into one signal, capped at -50.

Address Hopping (Address Diversity) #

Compares the number of distinct shipping addresses with the number of counted orders.

Trigger	Score	Reason Shown on Profile
Distinct addresses ÷ orders above 0.8	-15	“Very high address diversity: 6 unique shipping addresses”
Above 0.5	-10	“High address diversity: 4 unique shipping addresses”
Above 0.3	-5	“Elevated address diversity: 3 unique shipping addresses”

Country Mismatch #

Trigger	Score	Reason Shown on Profile
Shipping country differs from billing country	-3	“Billing/shipping country mismatch detected”
Mismatched shipping country on 2+ addresses	-10	“Billing/shipping country mismatch across 2 orders”
Pro: 2 shipping countries with a single billing country	-10	“Multiple shipping countries with single billing country”
Pro: 3+ shipping countries with a single billing country	-15	“Shipping to 3 different countries with single billing country (reshipping pattern)”

Only the most severe matching row applies. TrustLens does not use a list of “high-risk country corridors” — severity comes from how many countries are involved and how often.

Address Change Velocity #

Trigger	Score	Reason Shown on Profile
5+ new shipping addresses first used within the velocity window	-10	“5 new shipping addresses in 30 days”
3–4 new shipping addresses within the window	-5	“3 new shipping addresses in 30 days”

Diversity Trend (Pro) #

Pro compares the customer’s new addresses in the last 30 days with their lifetime average per 30 days (customers with 5+ orders and at least 2 addresses):

Trigger	Score	Reason Shown on Profile
Recent addresses at 3× the lifetime average or more	-10	“Sudden spike: 4 new addresses in last 30 days (3x above average)”
At 2× or more	-5	“Rising trend: 3 new addresses in last 30 days (2x above average)”

---

The Velocity Window #

The default lookback window for the address-change velocity rule is 30 days. Configurable from 7 to 90 days in the Shipping Address Anomalies card in Settings → Detection. (The Pro diversity trend always uses 30 days.)

Window Size	When to Use
7 days	Tight — catches very recent bursts; good for stores with stable customer addresses
30 days (default)	Balanced — catches typical hopping patterns without over-flagging customers with monthly relocations
60–90 days	Loose — counts new addresses over a longer stretch, so slower hopping is caught too; consider the false positives below before widening it on gift-heavy or B2B stores

---

Settings #

Setting	Default	Description
Velocity window	30 days	Lookback window for the address-change velocity rule (7–90 days)
Detect sudden behavioral shifts in address patterns (Pro)	On	Turns the diversity-trend rule on or off
Module enabled	On	Master toggle

The address counts that trigger each rule are fixed; there is no separate hopping-threshold setting.

---

Common Patterns #

The Reshipping-Fraud Customer #

Signature: Different shipping address on every order, often in a different country from the billing address. Card sometimes shows up later in disputes.

Detection: Address diversity (-10 to -15) + country mismatch (-3 to -10, or up to -15 with Pro’s multi-country rule) + velocity (-5 to -10). Often paired with Chargebacks signals.

Profile: Risk or Critical depending on history.

The Drop-Shipper / Reseller #

Signature: Many orders, many different shipping addresses (the reseller’s customers), same billing card and address.

Detection: Address diversity and velocity fire hard. No country mismatch usually.

Profile: Caution or Risk. Often legitimate (drop-shipping business) — allowlist if confirmed, since the pattern is operational rather than abusive.

The Carding / Stolen-Card User #

Signature: A handful of orders, country mismatch, sometimes several shipping countries. The first dispute lands within 30–60 days.

Detection: Country mismatch -3 to -10 (up to -15 in Pro when several shipping countries share one billing country), once the customer reaches the Full-confidence Order Threshold. May be the first signal before any dispute is filed.

Profile: Caution, or lower when combined with Card-Testing module signals if the card was tested first.

The Gift-Sender #

Signature: Multiple shipping addresses (gifts to friends/family) but consistent billing address. Holiday-season spikes.

Detection: Address diversity and velocity fire. Country mismatch may or may not.

Profile: Likely false positive. Allowlist known gift-buyers, or shorten the velocity window so a holiday burst ages out quickly.

---

False-Positive Watch List #

• Gift purchases. Especially around holidays. A customer buying 8 gifts at once with 8 different shipping addresses looks like address hopping but is normal seasonal behavior.
• Drop-shippers and resellers. Legitimate businesses ship to many addresses. Allowlist confirmed business customers.
• Travelers / digital nomads. Customers who order during travel can show country mismatches and rapid address changes.
• Multi-property owners. Customers with a primary residence and a vacation home will rotate addresses without abuse.
• Office-and-home orders. Many customers order both to home (for deliveries when working from home) and to office (for in-office days). Two addresses isn’t hopping.

---

Disabling the Module #

Reasonable to disable for stores that:

• Ship to a single country only and rarely see country mismatches
• Have many gift-buying customers and find the address-hopping signal noisier than helpful
• Are pure-digital (no physical shipping)

When disabled, no shipping anomaly signals fire and no address_anomaly_detected events are logged. Address fingerprints keep being recorded as long as Linked Accounts is on.

---

Reading the Shipping Anomalies Section of a Profile #

• Signal breakdown shows one Shipping anomalies signal listing every rule that fired
• Linked Accounts panel shows any other accounts that share one of the customer’s addresses
• Event timeline shows address_anomaly_detected events with the penalty applied and the specific rules that fired

The reason text is the easiest way to understand the customer’s pattern at a glance — it gives the number of distinct addresses, countries and recent new addresses behind each rule.

---

Privacy Considerations #

Like Linked Accounts, the Shipping Anomalies module works from keyed HMAC-SHA256 hashes of addresses. Raw address text is never stored in the fingerprint table. Two-letter country codes are stored in cleartext (they’re not personally identifying on their own).

Customer-initiated GDPR export requests include the customer’s fingerprint records. Erasure requests delete them.

---

Pro Enhancements #

Pro extends Shipping Anomalies in two ways:

Multi-Country Reshipping Rule #

When a customer ships to two or more countries while billing from a single country — a classic reshipping pattern — the country-mismatch rule fires at -10 (two countries) or -15 (three or more) instead of the free -3 / -10.

Diversity-Trend Detection #

An additional rule that fires when a customer’s recent address activity jumps above their own history — 2× or 3× their lifetime average of new addresses per 30 days. This catches resellers and drop-ship-fraud-rings whose individual orders look fine in isolation but show a building pattern of new destinations. It can be switched off in Settings → Detection.

Both Pro enhancements complement, rather than replace, the Free rules.