Address Tumbling: Why Deterministic Keys Matter for AI Fraud Models

By Malcolm Treanor, Co-founder & COO, WINR

The Problem: Address Tumbling

Fraud teams know the trick. The same bad actor signs up for multiple accounts using small tweaks to an address:

• “123 Main St, Apt 4”
• “123 Main Street, Apartment #4”
• “123 Main, Unit 4B”

To a human, it’s obvious these all point to the same place. To most systems, they appear different. This is address tumbling, the deliberate manipulation of address strings to evade detection.

In BNPL, gig economy, and ecommerce platforms, tumbling is a favourite tactic for inflating promotions, bypassing velocity checks, and slipping past KYC.

And while cleaning up addresses in the US or UK is relatively straightforward, the real challenge lies in scaling this globally. Outside English-speaking markets, address formats vary dramatically, scripts change, and cultural nuances in data entry make tumbling even harder to spot. Fraud rings know this and exploit it — using messy international data to slip past onboarding, inflate promotions, and hide in the noise.

Why AI Alone Struggles

Most fraud detection platforms lean heavily on machine learning. Models analyse:

• Velocity – how many sign-ups occur in a given timeframe.
• Recency – how fresh the activity is.
• Frequency – how dense the events are compared with baseline.

When address data is inconsistent, even the most advanced AI models can’t join the dots. Instead of spotting fraud, they misclassify the activity, letting bad actors through while wrongly flagging legitimate customers.

The challenge multiplies in global contexts. A model trained on neat US/GB address data quickly loses precision when faced with address strings from Brazil, Malaysia, or the Netherlands. The same tumbling tricks become harder to detect, and false negatives spike.

Deterministic Keys as Anchors

This is where WINR Atlas shifts the playing field. Instead of leaving models to interpret messy strings, Atlas generates deterministic keys at three levels:

• Street Key – normalises the road and locality.
• Premise Key – locks a building or block into a single reference.
• Household Key – distinguishes unique units in multi-tenant premises.

By collapsing tumbling variations into the same key, Atlas ensures fraud patterns stay visible – whether in London, São Paulo, Kuala Lumpur, or Amsterdam..

AI Models with Clarity

Deterministic keys give AI models cleaner signals to work with:

• Velocity features: Count of new sign-ups per Household Key over a rolling 24 hours.
• Recency features: Fresh activity weighted more heavily than stale events.
• Frequency features: Benchmarked against expected regional averages.

These features are stable, interpretable, and reproducible. In practice:

• All the variations of “Apartment 4B” resolve to one Household Key.
• All units at “123 Main St” roll up under one Premise Key for anomaly detection.
• Street-level patterns remain visible without being diluted by nearby tumbling tricks.

And critically, these features remain stable across international address systems, giving fraud models clarity, no matter the market.

Before vs After WINR Atlas

Without Atlas:
A fraud ring spins up 15 fake accounts across one block, each with a different address variant. The system treats them as independent. Fraud passes.

With Atlas:
All 15 collapse under a single Household or Premise Key. Velocity spikes. The anomaly is caught with high confidence.

Now scale this example globally, across markets with different alphabets, formats, and rules. Without a unifying key system, fraud thrives. With WINR Atlas, the patterns converge and fraud is exposed.

Where WINR Atlas Stands Apart

Most providers respond to tumbling by piling on extra models or verification steps. But if the input data is flawed, those models are simply learning from noise. Faster or fancier AI won’t change the outcome, the fraud still slips through.

WINR Atlas takes a different approach. By fixing the data foundation first, it gives every downstream system a cleaner, more reliable signal to work with. That means higher precision, fewer false negatives, and a stronger defence against fraud. And unlike legacy address hygiene tools designed for single markets, WINR Atlas was built to handle global diversity in address systems making fraud patterns visible everywhere.

WINR Atlas doesn’t compete with your existing fraud stack, it makes it smarter.

Availability

WINR Atlas is live today as a Snowflake Native App, with zero data movement required. Keys are generated directly inside your Snowflake environment, where your data already lives.

Next Steps

International address tumbling isn’t just a local inconvenience, it’s a global fraud strategy. From São Paulo to Kuala Lumpur to Amsterdam, the challenge is the same: messy, inconsistent data that blinds even the smartest fraud models.

With WINR Atlas, you don’t just clean data, you anchor it. Deterministic keys make tumbling tricks visible, improve match rates, and give your fraud stack the clarity it needs.

Atlas is available today in the Snowflake Marketplace.
Start building cleaner, global-ready KYC and fraud prevention workflows now

FAQs: Address Tumbling and KYC Fraud Prevention

Q1. What is address tumbling in fraud detection?

Address tumbling is when fraudsters make small variations to the same address to bypass identity or fraud controls. Without normalisation, systems may treat near-identical strings as separate records, allowing fraudulent accounts to slip through.

Q2. Why does address tumbling cause problems for AI fraud models?

AI models rely on clean inputs. Inconsistent address data pollutes features such as velocity, recency, and frequency, leading to false negatives (fraud passes undetected) and false positives (legitimate households wrongly flagged).

Q3. Why is international address data harder to manage?

Outside the US and UK, address formats vary dramatically. Different languages, scripts, and cultural conventions make standardisation complex and fraudsters exploit these gaps to hide in the noise.

Q4. How can businesses prevent address tumbling fraud?

Normalise and standardise address data before fraud checks. By collapsing variations of the same location into a single reference, tumbling tricks no longer split the signal and anomaly patterns remain visible.

Q5. What makes deterministic keys important in fraud prevention?

Deterministic keys (Street, Premise, and Household Keys) act as stable anchors. They group all address variations under consistent identifiers so fraud systems can see the true pattern of activity and flag anomalies with confidence.

Q6. How does WINR Atlas help reduce address tumbling risk?

Atlas generates deterministic keys and validates address data inside Snowflake. This gives fraud models cleaner inputs, higher match rates, and stronger anomaly detection. Instead of replacing existing fraud platforms, Atlas makes them more accurate and effective.