Location technology

Location intelligence is the ability to use the real physical location of the user, derived from signals in the environment (mobile networks, Wi-Fi and IP, with GPS as a contrast signal), as an identity factor that is very hard to forge. It is the technology behind Ironchip’s identity platform and fraud detection.

Gartner identifies location intelligence as one of the emerging pillars of authentication and identity systems (location identity proof). The premise is that location is a unique piece of context, hard to forge and highly predictive of legitimate behavior.

Why cybercriminals hide their location

Attackers use several techniques to mask their real location:

• VPNs and proxies: they change their IP address to appear to be somewhere else.
• TOR network: it routes traffic through several encrypted nodes and hides its origin.
• Fake GPS (FakeGPS): apps that spoof the device’s GPS to report false coordinates.
• SIM swapping: they swap the device’s SIM to simulate a different carrier or country.

How Ironchip’s technology works

Every place has its own radio environment: the Wi-Fi and mobile networks visible from that point, with their strength and how they relate to each other. That wave pattern is as distinctive as a fingerprint, and it is what Ironchip learns. The fingerprint is neither coordinates nor personal data. An attacker can steal a password, clone a SIM or spoof coordinates, but cannot reproduce the full electromagnetic environment of a specific place.

The process has four phases:

1. Capture. On each operation, the SDK measures the visible spectrum: antennas, Wi-Fi, GPS, IP, latencies and ISP. Capture is passive and transparent to the user.
2. Signature modeling. Repeated captures of the same point are grouped and condensed into an anonymous signature, with no coordinates or personal data.
3. Comparison on every access. Each new access generates its own capture, which is measured against the stored signature. If they are similar enough, the location factor is met; if not, the access does not pass.
4. Continuous learning. The system learns each user’s usual places and detects geographic anomalies, without the limits of static zones.

Signals that are captured

Every time a user interacts with a mobile or web application, Ironchip captures and analyzes these signals from the physical environment. None of them identifies the user on its own: it is their combination, and how it varies, that describes a place.

Signal	What is analyzed
Mobile networks	Visible 2G, 3G, 4G and 5G antennas and their carrier.
Wi-Fi	Networks in the environment and the user’s favorite network.
GPS	Device coordinates, only as a contrast signal and never as sole proof.
IP	IP address and Internet service provider (ISP).
Geolocation	Based on network latency.
Native SIM	Carrier and country of the SIM actually in use.
Cell towers	Connectivity with the antennas.
Antispoofing	Detection of VPN, TOR, proxies and fake GPS.

None of the concealment techniques can forge all the signals of the physical environment at the same time and in real time. That is the key to Ironchip.

How a safe zone is generated

A safe zone is the core of Ironchip’s location intelligence technology: a unique, usual and anonymous place associated with each user. It is not a point on a map.

Concept	Description
What it is	A unique, familiar place for each user. It represents where the legitimate user usually operates.
How it is generated	By AI, which captures and analyzes the signals of the environment (mobile networks, Wi-Fi and IP, with GPS as contrast) on every interaction with an application.
Continuous learning	Each interaction teaches Ironchip’s AI the relationship between places and devices over time.
Privacy by design	Safe zones are anonymous: the exact address is not stored, only patterns of encrypted signals.
Dynamic updates	The model adapts without friction to the user’s legitimate changes (moving house, regular trips, and so on).

A safe zone is an anonymous signature of the radio environment, bound to the device key, and a factor that detects spoofing, VPNs, TOR, virtual SIMs and impossible travel. It is not a set of GPS coordinates or a history of the user’s movements, and it is not personal information: a street or a building cannot be deduced from the signature.

To learn how safe zones are managed in the console, see Safe zones. Data handling is detailed in Location data privacy.

Why location is the best predictor

Internal data and market studies indicate that location is the identity factor that best tells legitimate behavior from fraudulent behavior:

Type of operation	Result
User registration	92% of users register from known locations.
E-commerce and purchases	74% of purchases are made from usual places.
Sign-in	68% of sign-ins happen from familiar locations.
High-value transactions (over €10,000)	More than 94% are made from trusted places.
Fraudulent patterns	98% of attacks happen remotely from locations unknown to the user.
Repeat fraud	99% of fraudsters repeat the fraud from the same location at least twice.

Types of fraud it detects

Type of fraud	How Ironchip detects it
SIM swapping	Detects SIM carrier changes, ISP changes and inconsistent geolocations in real time.
Phishing and AiTM	The browser extension (Phishing Shield) blocks fraudulent sites before the user signs. It validates the destination.
Vishing	Detects whether the user is on a call during critical actions, such as validating a PIN.
Synthetic identities	New accounts from blacklisted locations or with atypical behavior from the first access.
Money mules	Detects a combination of impossible travel, SIM or carrier changes and VPN use.
Malware and RAT	Detects debugging processes, overlays and active keyloggers on the device.
GPS spoofing	Automatic detection when RF geolocation (Wi-Fi and 5G) does not match the reported GPS.
Device swapping	Detects a sudden device change from an untrusted location with a fraud pattern.
Rooted or jailbroken devices	Identifies devices with root access and automatically flags them as high risk.

How these signals are combined into a score is explained in Risk assessment.

Technical integration: SDK and API

Ironchip offers two components to integrate location intelligence into any application:

Component	Function	Details
Datasource SDK	Signal capture	Platforms: Android, iOS, Flutter and web. It integrates into any mobile or web application to capture environment signals in real time.
Fraud Detection API	Results and decisions	Protocol: REST HTTP API. Compatible with any BPM or SIEM. Sub-second SLA for real-time alerts.

See the fraud detection SDK and the fraud detection API.

Integrate location as a service

Location has many use cases: checking where your employees work, isolating access to the company’s most critical systems or encrypting communications. You can integrate it into any use case with the API:

• Secure third-party connectivity: control supplier access to the company’s most sensitive systems.
• Secure, user-friendly authentication: authenticate the user with a push notification that analyzes three proofs of identity (device, biometrics and location) and integrates into any service for high-security requirements.
• Service isolation and protection: protect access to different systems by restricting it to assigned places.

To add location verification to your own application, see the identity HTTP API. To score transactions, use the fraud detection API.

Sectors

Sector	Applications
Banking and finance	Secure transactions, fraud detection and NIS2 and ENS compliance.
Government and public sector	Access to critical services, employee authentication and ENS compliance.
Industry	Protection of access to OT and IT systems and supplier monitoring.
Pharmaceutical and healthcare	Protection of patient data and secure remote access.

What sets Ironchip apart

Ironchip brings these elements together in a single platform:

Differentiator	Detail
RF-based location	Combines Wi-Fi, 2G/3G/4G/5G and IP signals at once, with GPS as contrast, for a geolocation that is very hard to forge.
No credential storage	It stores no credentials (zero credential storage), which removes the most common attack vector (theft of password databases).
Real-time detection	Sub-second SLA from signal capture to the block or access decision.
Universal integration	SAML, OIDC, RADIUS, LDAP, SSH and RDP, with modern cloud applications and legacy on-premises systems.
No mandatory hardware	OpEx model (pay per use), with no physical stock or hardware logistics for ENS.
ENS High	Product listed in the CCN-CERT catalog at the HIGH level of the Spanish National Security Framework (ENS), suitable for critical environments. More in Security.
Fraud behavior	99% of fraudsters repeat the same location: Ironchip learns and blocks from the second time.

Frequently asked questions about the technology

What is location-based authentication?

It means using the place an access comes from as one more factor. Ironchip does not depend on coordinates: it compares the radio signature of the environment, made up of the visible mobile and Wi-Fi networks, with that of the authorized zones. GPS is just one more signal, and the engine detects when it is spoofed.

Does it work inside buildings, where GPS does not reach?

Yes. The signature is based on mobile and Wi-Fi network signals, which are present indoors. GPS is used only as contrast.

Can it be fooled with a VPN or fake GPS?

It is very hard. To impersonate a place, you would have to reproduce its full electromagnetic environment. The engine also detects spoofed GPS, VPNs, TOR, proxies and inconsistencies between the IP, the SIM and the place’s signature.

What data is stored about the place?

An anonymous signature of the radio environment, bound to the device key. No addresses or movement history are stored, and the signature cannot be turned into a specific location. More detail in Location data privacy.