For most sites, a VPN alone is a weak reason to block a visitor

Keshia Rose of Fingerprint, a fraud-detection company, argued that for most sites a VPN alone is a weak reason to block a visitor. She spoke on Software Engineering Daily, in a 12 November 2026 episode on fraud prevention and AI agents. Sites with regional rules, such as content limited to certain areas, may rightly block VPNs, she said.

What was said

Host Gregor Vand gave his own case. He is a UK citizen living in Singapore who needs UK government sites for official business. A VPN is a tool that hides where a connection really comes from. He said he uses one on public networks, and its server is still in Singapore. He said: "I'm being blocked from doing things." He is also blocked without a VPN, he said, for being in Singapore. He did not say which sites blocked him or what technology they used, so his case shows the problem but names no product.

Rose called VPN use "a very normal thing to use." From memory, she said a Fingerprint report showed VPNs flagged at about 17%, which she rounded to almost one in five. She asked not to be quoted on it. Separately, she said the firm did over 23 billion identifications last year. Her view: "VPN on its own is probably not really going to tell you much."

Fingerprint's tool blocks nothing by default. Each customer writes its own rules. If a VPN is the only oddity, Rose said, it is probably fine. At most, ask for an extra verification step.

Why it matters

Our reading: a rule built on IP address or location sees a network, not a person. A VPN or a trip abroad changes it, so the rule cannot tell an expat from an attacker. Cookies, the small files a browser keeps to recognise a visitor, are no better, since the show notes say a bad actor can clear them. Fingerprint instead looks at the device and its history. A signal is one fact about a visit, such as VPN use or a tampered browser. One signal is a weak test because honest people trigger it often. Several together say more. Vand said bots can already solve many CAPTCHAs, so he questioned who those puzzles really stop.

The other side

Rose did not say a VPN is never a problem. Where regional rules matter, she said, blocking may be right. She works for a vendor that sells the alternative, so the episode is no neutral test. The excerpts give no data on how often honest users are wrongly blocked, or how well combined signals stop fraud. An extra verification step also adds friction for honest users. The conversation left the balance between too strict and too lax to each business.