John Wyatt
Over the past three years, a growing number of countries have written remote workers into their visa systems. Portugal launched the D8 in 2022. Spain opened a digital nomad visa in early 2023 under its Startup Law. 2024 brought a wave of new programs: Japan introduced a six-month digital nomad visa in March, Indonesia opened the E33G remote worker visa in April, Italy’s digital nomad visa took effect the same month, and Thailand’s DTV went live on July 15, issued for five years with stays of up to 180 days per entry.
These policies say the same thing in different words: you can live in Lisbon, Chiang Mai, Fukuoka, or Bali and work for a company based in San Francisco, Singapore, or Berlin, legally.
A visa settles your right to be there. It doesn’t settle the other half of the problem: your network identity is still in the wrong country.
And most remote jobs now run through third-party platforms as much as company tools. Instagram, Amazon Seller Central, Google Ads. Those platforms restrict access far more aggressively than your own company’s systems do.
01 Six Months in Lisbon
The First Two Weeks
She ran growth for a US DTC brand: Instagram, the YouTube channel, the Amazon seller account, and Meta and Google ad spend, all on her own. She moved to Lisbon on a D8 visa and settled near Alfama.
The first two weeks went well. Mornings were quiet, uninterrupted time for content and analytics. Afternoons overlapped with headquarters, so meetings clustered into the evening. Output was higher than it had been back in the US office.
The Easy Problem
Starting in week three, Okta asked for a second factor once a day, sometimes twice. Slack signed her out overnight. The internal dashboard occasionally threw a 403.
The timing wasn’t a coincidence. Microsoft’s anomaly detection policy runs a seven-day learning period to build a model of a user’s normal activity. During her first two weeks, the system was still collecting that baseline. The friction started once it was set.
At the time she assumed it was a network problem. She upgraded the apartment’s broadband, bought a coworking membership, hit 300 Mbps on a speed test. Nothing changed. She spent weeks fixing a speed problem, and the problem was never speed.
Week seven, a Wednesday, her IT lead messaged her directly:
Your account triggered an impossible travel alert. Where are you right now?
She told him the truth: Lisbon, on a D8 visa, HR already looped in.
His reply wasn’t what she expected. The company didn’t care where she lived. The contract and tax setup had already been squared away. What he cared about was something else:
You’re logging in from a new address every day. I can’t whitelist something that keeps moving. Give me one fixed address, I’ll add it as a trusted location, and this is done.
A week later she had one, and IT added it as a named location and marked it trusted. The company side of this was over, faster than she expected.
It turned out to be the easiest of four problems. There was someone on the other end who could actually act on it.
No One to Call
Nothing after this had a help desk.
Instagram. The brand’s account, over two hundred thousand followers. Logging in from Lisbon triggered an identity check. The posting schedule went dark for a day and a half, and that week’s launch content slipped with it. The platform logs the location and device behind every login and scores the account on that history.
YouTube and Google Ads. The channel dashboard kept asking her to re-verify. The ad account got flagged as a security risk. A two-hour suspension on an ad account isn’t a formality; it’s spend that never happened.
Amazon Seller Central. The worst of the three. A login from a new location put the account under review. Anyone who has run a seller account knows what that means: it hits cash flow directly, and there’s no telling how long an appeal takes. For a few days, checking the inbox was the first thing she did every morning.
Only the company’s own system came with a person attached to it.
The Wrong Fix
She bought an annual plan from a well-known VPN and locked it to a US server.
Instagram’s identity checks got more frequent, not less. Amazon’s dashboard demanded she log in again. Google flat-out rejected one login attempt.
The cause was the exit IP. That VPN routed through a datacenter address, and its whois and ASN records showed a hosting registration. To these platforms, a login from a datacenter block reads as more suspicious than one from Portuguese home broadband, because home broadband at least looks like a real user, and a datacenter address unambiguously isn’t one. The exit also changed on every reconnect, with hundreds of other people behind the same address at any given moment.
She’d fixed the country and broken something worse in its place.
What Actually Worked
She switched to a Surflare residential IP: a fixed, dedicated address registered under a US residential ISP, run on both the laptop and the phone.
Instagram and YouTube stopped asking for verification. Amazon’s login history settled into one US address, day after day. Google Ads dropped the security flag. She moved the company whitelist over to the same address, and IT didn’t have to touch anything, because the only thing that mattered to them was that it stayed fixed.
Now she doesn’t do anything before the workday starts. The app is already connected.
02 What External Platforms Actually Check
The company side is already solved above. It only needed an address that doesn’t move, because a whitelist can only hold fixed entries. Restricting access by country isn’t an obscure setting; it’s a standard feature across the major identity providers. Okta does it through dynamic zones, and Microsoft Entra ID blocks by location through Conditional Access. An admin sets the allowed countries, and anything outside that range gets blocked or challenged.
The logic behind impossible travel is spelled out in Microsoft’s own documentation: two activities on the same account, from locations too far apart, in less time than travel between them would actually take. Location is calculated at the country or region level, so activity within one country, or between neighboring countries, won’t trip it. Los Angeles to Lisbon will.
The harder limit sits on the other side. Instagram, Amazon Seller Central, Google Ads, brokerages, banks: none of them have an admin who can make an exception for one account. The call comes from a risk score instead.
That score runs on two signals: what country the IP is in, and how the IP is registered.
The second one is what most people miss. Platforms run whois and ASN lookups and can see exactly who an address is registered to. An address registered to a hosting provider is a hard negative signal, because real users generally don’t connect through a datacenter. That’s exactly why the VPN in the story above backfired: it fixed the country and got the registration type wrong, and registration type carries more weight in these systems than country does.
Financial institutions carry KYC obligations on top of this, which raises the stakes. Among the documented reasons US brokerages and banks restrict or close accounts for clients living abroad is a sustained pattern of logins from a foreign IP, according to both Creative Planning and a Forbes Finance Council article. Institutions infer a move abroad from login behavior, then restrict or freeze the account, no questions asked.
Which is why a qualifying address needs four things at once: fixed, dedicated, residentially registered, and located in your company’s country. Drop any one, and you’re back in one of the scenes above.
03 Two Conditions, Not One
A residential IP is registered under a residential ISP, so whois and ASN lookups return a home broadband provider, not a hosting company. Physically, most of these addresses still run on datacenter infrastructure: residential registration, datacenter hardware. That’s worth stating outright, because it’s exactly the point. Platform risk systems judge an address mainly by registration type, and datacenter hosting delivers the speed and uptime a home line can’t. The address is dedicated, so no one else is behind it while you’re working. It’s static: the same address in June and December, from a coworking space or a hotel room.
The second condition is usability.
Identity checks land on a phone more often than not: Instagram’s verification, Amazon’s re-login, a bank’s or brokerage’s two-factor prompt. A residential proxy is built for software, not people. It means loading an IP and a port into a fingerprint browser or a script, one app at a time, and it’s close to unusable on a phone. That setup cost makes sense for large-scale data collection. It doesn’t make sense for someone whose only goal is keeping Amazon from flagging a seller account.
Surflare delivers the same kind of address through the app itself. Pick a dedicated IP, tap connect, and every app on the device routes through it: browser, Slack, Instagram, and whatever verification prompt comes up on the phone. macOS, Windows, iOS, and Android all work the same way.
Setup is the real cost here, not the monthly price.
| Residential proxy | Residential IP VPS | Surflare Residential IP | |
|---|---|---|---|
| Before it works | Configure every app individually, usually with a fingerprint browser | Spin up a cloud machine, log in over RDP, build out the environment | Buy it, tap connect in the app, nothing else |
| Coverage | Only the apps you configured | Only what’s running on that remote machine | Every app on the device |
| Works on a phone | Barely | No | Yes, same IP as the laptop |
| Traffic encryption | Not provided by the proxy protocol | Depends on the setup | Full encrypted tunnel |
| Built for | Automation at scale | Unattended workloads that stay online | A person doing their job |
04 Setting It Up
- Pick the company’s country, not the nearest server. Working for a Singapore company out of Bangkok means choosing Singapore. A local exit is faster and solves nothing here.
- Leave the work laptop connected during work hours. Don’t cycle it on and off; the whole point is an address that never moves.
- Run the same IP on the phone. Microsoft’s documentation is explicit that impossible travel only stands down when both ends are trusted, and a single untrusted side is enough to trigger it. A laptop on a US address with a phone on local mobile data is that exact scenario, and it matters more because identity checks tend to land on the phone anyway.
- Keep personal devices separate, and put it on the router for a longer stay. Surflare installs directly on a router, so everything in the home routes through the same address automatically, including devices that can’t run an app.
- Leave local services on the local network. Banking, delivery, and rides in the country you’re actually in work better on a local connection.
05 FAQ
If the company just needs a whitelist, why not a cheaper datacenter IP?
For the company system alone, that works fine. Its identity system needs an address that doesn’t move and doesn’t care what type it’s registered as. But work rarely stays inside company systems. Instagram, Amazon Seller Central, Google Ads, and brokerages have no whitelist to add to. They score by registration type, and a datacenter block is a hard negative. The exit used in the first attempt above was exactly this kind of address, and it made the problem worse.
These accounts belong to the company. Who pays?
Worth raising with the company directly. A verification hold on the brand account, a suspended ad account, a seller account under review: those losses sit on the company’s side of the ledger, not on personal inconvenience. Against the cost of a single account review, a dedicated IP’s monthly fee is small, and most remote workers expense it. Surflare can issue an invoice for every charge, so submitting it for reimbursement is straightforward.
Won’t a connection across continents be noticeably slower?
Intercontinental latency is a physical limit; no product removes it. Two things soften it in practice. A residential IP runs on datacenter infrastructure, so the line itself is steadier than typical home broadband, and most work traffic (email, documents, dashboards, calls) already routes through servers in that region regardless. Keep local services on a local connection and the gap is smaller than it sounds.
I move around a lot. Should the IP move with me?
No, that defeats the point. The IP marks where your work identity lives, not where you are. Vietnam in March, Georgia in May, the address stays in your company’s country the whole time.
Ready to Put a Residential IP to Work in Your Company’s Country?
A fixed address, registered under a residential ISP. Same IP on your laptop and phone, one login history for both company systems and outside platforms.
