How to Verify a User's Real Location (Past VPNs and Proxies)
IP geolocation is easy to fake with a VPN or proxy. Learn how to verify a user's real location by combining geolocation with anonymiser detection.
Plenty of decisions depend on where a user really is — licensing, tax, compliance, fraud rules. The problem is that the easiest signal, IP geolocation, is also the easiest to fake. Here's how to verify location you can actually trust.
Why raw geolocation isn't enough
IP geolocation is accurate at country level — until someone puts a VPN or proxy in the way. Then the location you see belongs to the anonymiser's server, not the user. Since relocating your apparent location is the entire point of a VPN, you can't trust geolocation without first asking whether it's being masked.
Check whether a location is masked by a VPN
The two-step verification
- Look up the location with IP geolocation — country, region, ISP.
- Check for anonymisers with the VPN detection API and proxy detection API. If the IP is a VPN, proxy or Tor exit, the location is untrusted.
Only a location with no anonymiser present should be treated as the user's real location — and even then, trust country level over city.
Decision matrix
| Geolocation | Anonymiser? | Verdict |
|---|---|---|
| Country X | None | Trust country X |
| Country X | VPN/proxy/Tor | Untrusted — location likely masked |
| Mismatched signals | Any | Investigate / challenge |
Where this matters
- Licensing & content — enforce regional rights; VPNs are the main bypass tool. See how to geo-restrict content.
- Compliance / KYC — confirm a user's stated country isn't masked.
- Fraud rules — a masked location on a payment is a risk signal worth scoring with an IP fraud score.
Handling masked locations
Don't necessarily block — decide by context. For content, you may block the bypass. For signups or payments, challenge or verify. Always log the anonymiser flag for audit.
Bottom line
To verify a user's real location, never trust geolocation on its own — first detect whether a VPN or proxy is masking it. A clean (non-anonymised) country-level location is reliable; a masked one should be treated as untrusted and routed into your fraud or compliance rules.