What Is Visitor ID & Why IP Blocking Isn't Enough

Here is a scenario that plays out every day across thousands of Shopify stores:

You notice a suspicious order — maybe a stolen card, maybe a fake address. You look up the IP address, add it to your block list, and feel like you handled it. The next morning, the same person is back. Different IP address, same tricks. You block that one too. They come back again.

This is not bad luck. This is how the internet works.

• VPNs give anyone a new IP in seconds. A VPN (Virtual Private Network) lets someone appear to be browsing from a completely different city or country. It costs about $5 a month, and millions of people use them — including every serious fraudster.
• Proxies are even cheaper. Proxy services sell IP addresses for pennies each. A fraudster can rotate through hundreds of different IPs in a single afternoon.
• Your home internet IP changes on its own. Most internet providers give you a different IP address every few days. The IP you blocked yesterday might belong to a completely innocent person today.
• Mobile networks share IPs. When someone uses their phone on a cellular network, they share an IP address with thousands of other people. Blocking that IP could block real customers in the same city.

The bottom line: an IP address tells you where a connection is coming from right now, not who is behind it. It is like trying to identify someone by the taxi they are riding in — they just get out and hail a different one.

A Visitor ID is a digital fingerprint of someone's device and browser. Instead of looking at their internet connection (which changes all the time), it looks at the device itself — things like:

• Their screen size and resolution
• What fonts are installed on their computer
• How their graphics card renders certain images
• Their browser version and settings
• Their timezone and language preferences
• Dozens of other small technical details

Each of these details on its own is not unique. But when you combine all of them together, the combination is. It is like a fingerprint — no two are exactly alike.

Here is the key difference:

An IP address is like a phone number — easy to change, easy to get a new one. A Visitor ID is like a fingerprint — it stays with you no matter what phone number you use.

This means that when a fraudster:

• Turns on a VPN — their Visitor ID stays the same
• Clears their cookies — their Visitor ID stays the same
• Opens an incognito window — their Visitor ID stays the same
• Switches from WiFi to mobile data — their Visitor ID stays the same
• Uses a different email address — their Visitor ID stays the same

You are no longer tracking a connection. You are tracking the actual device.

You have probably heard these terms thrown around, but here is what they actually mean in plain English:

VPN (Virtual Private Network): Think of it as a tunnel between your computer and the internet. Instead of websites seeing your real location, they see the VPN server's location. A person in Vietnam can look like they are browsing from New York. Cost: about $5 per month. Millions of regular people use VPNs for privacy, but fraudsters use them to hide where they really are.

Proxy: Similar idea, but simpler and cheaper. A proxy is just a middleman server that passes your traffic along. Some proxies cost pennies per IP address. Fraudsters buy access to thousands of proxy IPs and rotate through them automatically, getting a fresh IP for every order attempt.

TOR (The Onion Router): The most extreme option. TOR bounces your internet traffic through multiple random computers around the world, making it nearly impossible to trace back to you. It is completely free. Almost no regular shopper uses TOR to buy products online — but people who want to be untraceable use it constantly.

Here is the problem for store owners:

• A VPN costs less than a cup of coffee per month
• A residential proxy costs less than $1 per IP
• TOR is completely free

Blocking IP addresses when fraudsters have access to these tools is like changing your lock when the thief has a master key. They will always have another IP. You need to identify the person, not the connection.

Let us walk through real scenarios that happen every day on Shopify stores and see how Visitor ID handles each one:

Scenario 1: Same device, new IP address.

A fraudster places a fake order from one IP address. You block that IP. They turn on a VPN and come back from a completely different IP. With IP blocking, they look like a brand new visitor. With Visitor ID, Browsify sees the exact same device fingerprint and flags them instantly.

Scenario 2: Incognito mode.

A bad actor clears all their cookies and opens an incognito (private browsing) window, thinking this makes them invisible. Incognito mode stops cookies from saving — that is all. The device fingerprint stays exactly the same. Browsify recognizes them immediately.

Scenario 3: The VPN hopper.

Someone tries to place fraudulent orders from five different VPN locations in one hour — appearing to be from the US, then Canada, then Germany, then the UK, then Australia. Five different IP addresses. But Browsify sees one Visitor ID making all five attempts and blocks the device after the first suspicious order.

Scenario 4: The repeat offender.

A customer files a chargeback claiming they never received their order (they did). You mark their Visitor ID as a known fraud risk. Two months later, the same person tries to order again with a new email address, a new credit card, and a different IP address. Browsify recognizes the device and blocks their checkout before they can place the order.

In every case, the IP address changed but the device did not. That is why Visitor ID works where IP blocking fails.

Getting Visitor ID protection on your store takes about five minutes and does not require any technical knowledge:

1. Install Browsify from the Shopify App Store. The app adds itself to your store automatically — no theme editing, no code to paste, no developer needed.
2. Open your Browsify dashboard. Within minutes, you will start seeing real visitor fingerprints appearing. Each visitor gets a unique Visitor ID that you can track across all their visits, regardless of what IP address they use.
3. Block by Visitor ID instead of IP address. When you spot a fraudster, block their Visitor ID. This blocks their actual device, not just their current connection. They cannot get around it by switching IPs, clearing cookies, or using incognito mode.
4. Set up automatic blocking rules. Tell Browsify what to watch for: too many failed card attempts from the same device, visitors using known fraud proxies, devices that have been linked to chargebacks before. Browsify handles the blocking automatically — you do not have to watch the dashboard all day.
5. Review flagged visitors when you have time. Browsify's risk scoring shows you which visitors look suspicious so you can review borderline cases. Most fraud is caught and blocked automatically, but you always have the final say.

Browsify's free plan includes Visitor ID tracking and basic blocking. Paid plans add advanced fraud scoring, automatic rules, and detailed analytics showing exactly how many fraud attempts were stopped and how much money you saved.