Residential proxies undercut the geolocation exemption that keeps 2FA out of the way

The exemption exists to protect conversion. "Because the 2FA code is a hassle, it makes users less likely to log in," Pinto wrote, and the common fix is to skip the code when a login's geolocation matches the user's history ^[7][6]. The rule has two owners: the security team that wrote it and the growth team that benefits from it. Whoever retires it moves a cost onto the second one.

IP addresses have been fakeable for a long time. The exemption survived because the faking was coarse. Early VPNs dropped a user somewhere random in their own country, and later releases offered a pick-list of major cities, so a provider with no data center in Dayton, Ohio could not sell a customer Dayton ^[10]. Residential proxy networks have nodes in Dayton ^[11].

The path Pinto describes has three steps. Obtain a leaked credential list that also carries IP addresses, run a geo lookup on the address, then route through a residential proxy in the same place; he says this applies to identity and access management platforms, retailers and banks ^[9]. The nodes come from consumers who never knowingly agreed to host them: millions of people became proxy nodes after installing free VPNs or dubious browser extensions, according to Pinto ^[3].

A skeptic will point at the byline first. Pinto is CEO and co-founder of Fingerprint, and the piece ran as a Forbes Tech Council column ^[1][14]; his own list of fraud signals puts behavioral biometrics and device intelligence alongside network data ^[15]. He states the claim at full strength: "In short, the geolocation-based login rules that every IT department uses across company systems are now essentially useless" ^[8]. Google's disruption of IPIDEA and the FBI's warning are the two items in the column that do not originate with his company, and both reach the reader through his account of them ^[4][5].

There is a separate reason a clean-looking address proves little. A single residential IP assigned to a time zone in Des Moines, Iowa can be used by browsers from time zones all over the globe ^[12]. That spread makes it hard to know how often the address has been used across services. Pinto says proxy traffic can be detected, though not easily; the one technique the published passage describes is a check on whether the network time zone differs ^[13].

This quarter's version of the decision is narrow. The choice is which rules waive a factor on an IP match, and what the abandonment they save is worth against the unchallenged logins they grant. Pinto does not quantify either side. The first number is available to any operator from its own login data; the second, in my view, arrives only with an incident.