Only 76% of transactions from the IP address had previously been authorised

Sounds like a self fulfilling prophecy, if they use these rules to authorize transactions.