Skip to main content

Device Fingerprinting

Prerequisites

Before implementing device fingerprinting, ensure you understand:

  • Risk scoring concepts (fingerprinting feeds into scores)
  • Velocity rules (fingerprinting enables device-based velocity)
  • Privacy compliance requirements (GDPR, CCPA)
  • Account takeover patterns you're trying to detect
TL;DR
  • Device fingerprinting = Collecting device/browser attributes to create unique identifiers
  • Use cases: multi-account detection, fraud linkage, velocity rules, ATO detection
  • High-risk signals: device on 3+ fraud accounts, emulator/spoofing detected, Tor exit node
  • Build vs. buy: vendors have consortium data but require data sharing
  • Privacy: GDPR/CCPA may require disclosure and consent—consult legal

Identifying and tracking devices for fraud detection.

What is Device Fingerprinting?​

Device fingerprinting collects attributes about a user's device and browser to create a unique identifier, enabling:

How It Works​

Collected Attributes​

CategoryExamples
BrowserUser agent, plugins, timezone, language
ScreenResolution, color depth, pixel ratio
HardwareCPU cores, memory, GPU renderer
CanvasRendering patterns (creates hash)
AudioAudio processing fingerprint
FontsInstalled font list
WebGLGPU vendor, renderer string
BehaviorTouch support, DNT setting

Fingerprint Types​

TypePersistenceAccuracy
Cookie-basedLow (cleared easily)High when present
Browser fingerprintMedium (changes with updates)Medium
Device fingerprintHigh (hardware-based)High
BehavioralMedium (learned over time)Medium-High

Use Cases​

Fraud Detection​

Use CaseApplication
Multi-accountingSame device, different accounts (see promo abuse)
Fraud linkageConnect fraud cases across accounts
Velocity rulesTransactions per device
Risk scoringDevice reputation input

Account Security​

Use CaseApplication
ATO detectionNew device accessing account
Step-up authTrigger MFA on unknown device (see 3DS)
Session managementLimit active devices
Trust buildingRecognize returning devices for compelling evidence

Signals for Fraud​

High-Risk Device Indicators​

Use these as Tier 1 and Tier 2 indicators in your fraud decisions:

SignalRisk Level
Device seen on 3+ fraud accounts🔴 High (Tier 1)
Device spoofing detected🔴 High (Tier 1)
Emulator detected🔴 High
VPN/proxy detected⚠️ Medium
Device age < 1 hour⚠️ Medium
Tor exit node🔴 High

Device Anomalies​

SignalDescription
Impossible combinationsiOS user agent + Windows fonts
Timezone mismatchBrowser TZ ≠ IP geolocation TZ
Language mismatchSystem language ≠ expected for location
Automation indicatorsHeadless browser, automation flags

Implementation Approaches​

Build vs. Buy​

See vendor selection guide for evaluation criteria.

ApproachProsCons
In-houseFull control, no data sharingEngineering cost, maintenance
VendorQuick deployment, consortium dataCost, dependency, data sharing
HybridBalance of control and capabilityComplexity
  • Fingerprint.js (open source and pro)
  • Iovation
  • ThreatMetrix (LexisNexis)
  • Device Authority
  • Castle

In-House Considerations​

// Basic fingerprinting signals
const fingerprint = {
  userAgent: navigator.userAgent,
  language: navigator.language,
  screenResolution: `${screen.width}x${screen.height}`,
  timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
  cookiesEnabled: navigator.cookieEnabled,
  // ... more attributes
};

Privacy Considerations​

Compliance Required

Device fingerprinting may be subject to:

  • GDPR (consent requirements)
  • CCPA (disclosure requirements)
  • ePrivacy Directive
  • Local regulations

Consult legal before implementation. See compliance overview for related requirements.

Best Practices​

  1. Transparency – Disclose in privacy policy
  2. Purpose limitation – Use only for fraud/security
  3. Data minimization – Collect only what's needed
  4. Retention limits – Don't keep forever
  5. Consent where required – Cookie banners, etc.

Next Steps​

Implementing device fingerprinting?

  1. Evaluate build vs. buy - Vendor vs. in-house
  2. Review privacy requirements - GDPR, CCPA compliance
  3. Integrate with risk scoring - Combine signals

Already have fingerprinting?

  1. Build velocity rules - Device-based limits
  2. Enhance ATO detection - New device alerts
  3. Prepare for CE 3.0 - Chargeback evidence

Detecting fraud with device data?

  1. Check high-risk signals - What to flag
  2. Review evidence framework - Tier 1/Tier 2 indicators
  3. Manual review - Link fraud cases