## TL;DR
VPN users look like they teleported: the IP says one country, the account says another, and the agent flags a mismatch that is just a VPN. Treat VPN as a known signal, not an anomaly: detect VPN exit nodes, downgrade the geo-mismatch weight when VPN is present, and lean on device and behavior signals instead. False positives drop sharply without losing real travel-fraud detection on non-VPN sessions.

```text
fraud agent failed on geolocation mismatch for vpn users
```

## Use this when
- Legitimate users on VPNs get flagged for impossible travel.
- Geo-mismatch alerts spike after a VPN provider adds exit nodes.
- The agent has no VPN indicator in its signal set.

## Not for this skill when
- The mismatch is real travel fraud with no VPN involved. That is the signal working.
- Location data itself is wrong. That is a geo-IP database problem.

## Steps
1. Add VPN detection to the signal set: known exit-node lists plus VPN heuristics. Verify: test traffic through a commercial VPN is labeled as such.
2. Gate the geo-mismatch rule on the VPN flag: mismatch plus VPN becomes a weak signal, mismatch without VPN stays strong. Verify: false positives on VPN users drop in a backtest while true positives hold steady.
3. Shift weight to device fingerprint and behavior for VPN sessions. Verify: a real account takeover over VPN still scores high enough to trigger review.
4. Keep the exit-node list fresh: refresh weekly and monitor for new providers. Verify: the list update is automated and logged.

## Variant phrasings
### vpn causing false geo mismatch alerts
False-positive phrasing.
### impossible travel flag on vpn user
Travel-rule phrasing.
### geolocation wrong for vpn exit node
Data phrasing.

Compatibility: Works with any geo-IP provider. The VPN-gating pattern applies to rules and models alike.

## Why it happens
Geo rules were written for a world where IP location meant user location. VPN adoption broke that assumption, and the rules never got the memo, so millions of normal sessions look like teleportation.

## Edge cases / pitfalls
- Some fraud runs over VPNs too. Never zero the signal, only downgrade it.
- Corporate VPNs have stable exit nodes. Allowlist them separately.
- Geo-IP databases lag on new exit nodes. Expect a detection delay of several days after a provider launch.
- Privacy-focused users rotate exits fast. Per-session checks beat cached labels.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_S2tQTRk3aPH5ACUJKG9bDw