On the internet, everything is measurable, and fraudsters leave behind tracks they’re not even aware of. What IP address is the user coming from?
edit: oh, you probably mean 'why do you think (random business) refusal is IP based'.