---
title: Shipping Anomalies
description: "The Shipping Address Anomalies module detects fraud patterns that show up in *where* orders ship rather than *what* customers buy. It catches address hopping (many different shipping destinations), billing/shipping country mismatches, and bursts of new addresses that don't match legitimate…"
url: "https://webstepper.io/docs/trustlens/detection-modules/shipping-anomalies/"
updated: "2026-10-18"
category: Detection Modules
---

# Shipping Anomalies

The Shipping Address Anomalies module detects fraud patterns that show up in *where* orders ship rather than *what* customers buy. It catches address hopping (many different shipping destinations), billing/shipping country mismatches, and bursts of new addresses that don't match legitimate customer behavior.

Module ID: `shipping_anomalies`. Default: enabled. Free tier (complete detection; Pro adds the multi-country reshipping rule and diversity-trend detection).

---

## What It Observes

The module reads the address fingerprints that TrustLens records when each order is placed — the same keyed-hash shipping and billing address rows the Linked Accounts module writes, each stored with its country and the date it was first and last used. Every time an order is completed, the module:

1. Queues a score recalculation for the customer
2. Works out the customer's current shipping-anomaly signal (see below)
3. If the signal is negative, logs an `address_anomaly_detected` event with the penalty and the rules that fired, and fires the `trustlens/shipping_anomaly` action (a Pro automation trigger)

Address hashes use the same keyed HMAC-SHA256 approach as the Linked Accounts module — raw addresses are never stored in the fingerprint table. The hash is built from address lines 1 and 2, city, postcode and country, normalized (lowercased, punctuation removed, common abbreviations expanded). Because the address rows come from Linked Accounts, turning that module off stops new address data reaching this one.

---

## What It Signals

Like the other history modules, Shipping Anomalies waits until the customer reaches the Full-confidence Order Threshold (default 3 orders). The rules below add into one signal, capped at -50.

### Address Hopping (Address Diversity)

Compares the number of distinct shipping addresses with the number of counted orders.

| Trigger | Score | Reason Shown on Profile |
| --- | --- | --- |
| Distinct addresses ÷ orders above 0.8 | -15 | "Very high address diversity: 6 unique shipping addresses" |
| Above 0.5 | -10 | "High address diversity: 4 unique shipping addresses" |
| Above 0.3 | -5 | "Elevated address diversity: 3 unique shipping addresses" |

### Country Mismatch

| Trigger | Score | Reason Shown on Profile |
| --- | --- | --- |
| Shipping country differs from billing country | -3 | "Billing/shipping country mismatch detected" |
| Mismatched shipping country on 2+ addresses | -10 | "Billing/shipping country mismatch across 2 orders" |
| Pro: 2 shipping countries with a single billing country | -10 | "Multiple shipping countries with single billing country" |
| Pro: 3+ shipping countries with a single billing country | -15 | "Shipping to 3 different countries with single billing country (reshipping pattern)" |

Only the most severe matching row applies. TrustLens does not use a list of "high-risk country corridors" — severity comes from how many countries are involved and how often.

### Address Change Velocity

| Trigger | Score | Reason Shown on Profile |
| --- | --- | --- |
| 5+ new shipping addresses first used within the velocity window | -10 | "5 new shipping addresses in 30 days" |
| 3–4 new shipping addresses within the window | -5 | "3 new shipping addresses in 30 days" |

### Diversity Trend (Pro)

Pro compares the customer's new addresses in the last 30 days with their lifetime average per 30 days (customers with 5+ orders and at least 2 addresses):

| Trigger | Score | Reason Shown on Profile |
| --- | --- | --- |
| Recent addresses at 3× the lifetime average or more | -10 | "Sudden spike: 4 new addresses in last 30 days (3x above average)" |
| At 2× or more | -5 | "Rising trend: 3 new addresses in last 30 days (2x above average)" |

---

## The Velocity Window

The default lookback window for the address-change velocity rule is 30 days. Configurable from 7 to 90 days in the Shipping Address Anomalies card in **Settings → Detection**. (The Pro diversity trend always uses 30 days.)

| Window Size | When to Use |
| --- | --- |
| 7 days | Tight — catches very recent bursts; good for stores with stable customer addresses |
| 30 days (default) | Balanced — catches typical hopping patterns without over-flagging customers with monthly relocations |
| 60–90 days | Loose — counts new addresses over a longer stretch, so slower hopping is caught too; consider the false positives below before widening it on gift-heavy or B2B stores |

---

## Settings

| Setting | Default | Description |
| --- | --- | --- |
| **Velocity window** | 30 days | Lookback window for the address-change velocity rule (7–90 days) |
| **Detect sudden behavioral shifts in address patterns** (Pro) | On | Turns the diversity-trend rule on or off |
| **Module enabled** | On | Master toggle |

The address counts that trigger each rule are fixed; there is no separate hopping-threshold setting.

---

## Common Patterns

### The Reshipping-Fraud Customer

**Signature:** Different shipping address on every order, often in a different country from the billing address. Card sometimes shows up later in disputes.

**Detection:** Address diversity (-10 to -15) + country mismatch (-3 to -10, or up to -15 with Pro's multi-country rule) + velocity (-5 to -10). Often paired with Chargebacks signals.

**Profile:** Risk or Critical depending on history.

### The Drop-Shipper / Reseller

**Signature:** Many orders, many different shipping addresses (the reseller's customers), same billing card and address.

**Detection:** Address diversity and velocity fire hard. No country mismatch usually.

**Profile:** Caution or Risk. Often legitimate (drop-shipping business) — allowlist if confirmed, since the pattern is operational rather than abusive.

### The Carding / Stolen-Card User

**Signature:** A handful of orders, country mismatch, sometimes several shipping countries. The first dispute lands within 30–60 days.

**Detection:** Country mismatch -3 to -10 (up to -15 in Pro when several shipping countries share one billing country), once the customer reaches the Full-confidence Order Threshold. May be the first signal before any dispute is filed.

**Profile:** Caution, or lower when combined with Card-Testing module signals if the card was tested first.

### The Gift-Sender

**Signature:** Multiple shipping addresses (gifts to friends/family) but consistent billing address. Holiday-season spikes.

**Detection:** Address diversity and velocity fire. Country mismatch may or may not.

**Profile:** Likely false positive. Allowlist known gift-buyers, or shorten the velocity window so a holiday burst ages out quickly.

---

## False-Positive Watch List

- **Gift purchases.** Especially around holidays. A customer buying 8 gifts at once with 8 different shipping addresses looks like address hopping but is normal seasonal behavior.
- **Drop-shippers and resellers.** Legitimate businesses ship to many addresses. Allowlist confirmed business customers.
- **Travelers / digital nomads.** Customers who order during travel can show country mismatches and rapid address changes.
- **Multi-property owners.** Customers with a primary residence and a vacation home will rotate addresses without abuse.
- **Office-and-home orders.** Many customers order both to home (for deliveries when working from home) and to office (for in-office days). Two addresses isn't hopping.

---

## Disabling the Module

Reasonable to disable for stores that:

- Ship to a single country only and rarely see country mismatches
- Have many gift-buying customers and find the address-hopping signal noisier than helpful
- Are pure-digital (no physical shipping)

When disabled, no shipping anomaly signals fire and no `address_anomaly_detected` events are logged. Address fingerprints keep being recorded as long as Linked Accounts is on.

---

## Reading the Shipping Anomalies Section of a Profile

- **Signal breakdown** shows one Shipping anomalies signal listing every rule that fired
- **Linked Accounts panel** shows any other accounts that share one of the customer's addresses
- **Event timeline** shows `address_anomaly_detected` events with the penalty applied and the specific rules that fired

The reason text is the easiest way to understand the customer's pattern at a glance — it gives the number of distinct addresses, countries and recent new addresses behind each rule.

---

## Privacy Considerations

Like Linked Accounts, the Shipping Anomalies module works from keyed HMAC-SHA256 hashes of addresses. Raw address text is never stored in the fingerprint table. Two-letter country codes are stored in cleartext (they're not personally identifying on their own).

Customer-initiated GDPR export requests include the customer's fingerprint records. Erasure requests delete them.

---

## Pro Enhancements

Pro extends Shipping Anomalies in two ways:

### Multi-Country Reshipping Rule

When a customer ships to two or more countries while billing from a single country — a classic reshipping pattern — the country-mismatch rule fires at -10 (two countries) or -15 (three or more) instead of the free -3 / -10.

### Diversity-Trend Detection

An additional rule that fires when a customer's recent address activity jumps above their own history — 2× or 3× their lifetime average of new addresses per 30 days. This catches resellers and drop-ship-fraud-rings whose individual orders look fine in isolation but show a building pattern of new destinations. It can be switched off in Settings → Detection.

Both Pro enhancements complement, rather than replace, the Free rules.