Diurnal activity checks for transport SP survey fraud detection

When do genuine transport survey respondents complete surveys? Not at 3am. Unusual completion timing is one of the simplest fraud signals available.

This article explains diurnal activity checks for transport SP surveys - how to export and analyse completion timestamps in SurveyEngine to detect offshore or bot-based fraud.

Ben White, 07.07.2026

The diurnal activity signal

Genuine survey respondents complete surveys during their waking hours. For a UK transport survey targeting commuters, the expected completion pattern shows peaks in the morning (7–9am), lunchtime (12–2pm), and evening (6–9pm), with very low completion rates between midnight and 6am.

An anomalous diurnal pattern - large numbers of completions at unusual hours, particularly late at night - suggests that completions are coming from a different time zone than the target population. This is a common signature of offshore panel fraud, where respondents in lower-cost markets claim to be in the target country while completing surveys during their own daytime hours.

Why diurnal checks work for transport surveys

Transport surveys are particularly amenable to diurnal analysis because genuine transport survey respondents are commuters - people with predictable daily schedules. Their survey completion behaviour should cluster around commuting-related times. Completions at 3am local time from claimed commuters in London are inherently suspicious.

The diurnal check is especially powerful in combination with IP geolocation. If a respondent's IP address resolves to a UK location but their completion timestamp is at 3am UK time, this is a strong fraud signal. If their IP resolves to South Asia and their completion is at 3am UK time (which is 8:30am India Standard Time), the pattern is consistent with offshore fraud.

SurveyEngine records completion timestamps and IP addresses for all survey responses, providing the data needed for diurnal analysis without any additional survey design changes.

TLDR Quick links

Fraud detection toolkit

Forum: data quality

Open a free account

Conducting diurnal analysis in SurveyEngine

Step 1: Export completion timestamps and IP data. In SurveyEngine's data export, include the completion_timestamp field and ip_address field. Ensure timestamps are in UTC so they can be converted to local time for analysis.

Step 2: Convert to target local time. Calculate the local time of each completion by adding the UTC offset for the target population's time zone. For UK surveys, add 0 hours (GMT) or 1 hour (BST) depending on the time of year.

Step 3: Plot the diurnal distribution. Create a histogram of completions by hour of day (local time). Compare the observed distribution to the expected distribution for your target population.

Step 4: Flag anomalous completions. Flag respondents who completed between midnight and 6am local time. If this group represents more than 5–10% of completions, investigate further. Cross-reference with IP geolocation to identify geographic anomalies.

Step 5: Combine with other fraud signals. Diurnal analysis is most powerful in combination with incidence rate monitoring, speeder detection, and ISM. Respondents flagged by multiple fraud signals have a higher probability of being fraudulent.

Worked example - London commuter survey diurnal analysis

A London commuter mode choice survey shows an unusual diurnal pattern: 23% of completions occur between midnight and 6am (UK time), compared to an expected 2–3% based on previous surveys. IP geolocation shows that 78% of the midnight-6am completions resolve to IP addresses in South Asia.

These 89 completions are excluded as probable offshore fraud. The remaining sample shows a normal diurnal pattern (midnight-6am: 3.1%) and produces coherent utility estimates consistent with prior transport research. The ISM analysis confirms that the excluded group showed significantly different preference parameters from the retained sample.