Device Fingerprinting

What Is Device Fingerprinting?

Device fingerprinting is a technique for recognizing a device by combining many small pieces of information about its hardware, operating system, browser and network setup. No single attribute identifies a device on its own, but together they form a profile that is often distinctive enough to tell whether the same phone or computer has been seen before.

Unlike a cookie, which is stored on the device and can be deleted, a fingerprint is calculated from characteristics the device exposes whenever it connects. That makes it useful for fraud prevention, where attackers routinely clear cookies, use private browsing or reinstall apps to look like new users.

Typical inputs include:

• browser type and version, user agent string and supported features
• operating system and version
• screen resolution, color depth and pixel ratio
• time zone and language settings
• installed fonts and plugins
• how the device renders graphics, for example canvas and WebGL output
• on mobile apps, device model and app installation details
• network signals such as IP address, connection type and whether a proxy or VPN is in use

Why Device Fingerprinting Matters

Fraud usually scales through reuse. One criminal or one group runs many accounts from a small number of devices. Device fingerprinting makes that reuse visible.

For banks, payment firms and fintechs, it helps answer questions that identity data alone cannot:

• Has this "new" customer applied before under a different name?
• Is this login coming from the customer's usual device or from somewhere unfamiliar?
• Are dozens of accounts being controlled from the same machine?
• Is the device showing signs of emulation, automation or tampering?

These questions are central to stopping synthetic identity fraud, account takeover and networks of money mule accounts.

How It Is Used in Practice

At Onboarding

A device seen across many applications with different names, dates of birth or addresses is a strong sign of identity fraud or application farming. Firms often combine device signals with email, phone and IP checks before running full KYC, so that obviously bad applications are stopped cheaply and early.

At Login and During Sessions

Comparing the current device against the devices previously linked to an account helps flag possible account takeover. A login from a new device is not suspicious in itself, but a new device combined with a password reset, a change of phone number and an immediate payment to a new payee is a classic takeover pattern.

In Transaction Monitoring

Device and session data can enrich transaction monitoring by linking accounts that appear unrelated on paper. Shared devices among accounts receiving and forwarding funds can point to mule networks or smurfing.

Red Flags From Device Data

• one device associated with many accounts or applications in a short period
• emulators, rooted or jailbroken devices, or automation frameworks
• inconsistencies, such as a time zone or language that does not match the claimed location or IP address
• frequent changes to attributes that normally stay stable
• traffic through anonymizing proxies, hosting providers or known high-risk networks

Limitations

Device fingerprinting is probabilistic. Two people with the same popular phone model and default settings can look similar, and one person's fingerprint can change after a browser update. Privacy-focused browsers deliberately reduce or randomize the attributes they expose. Sophisticated fraudsters use anti-detect browsers designed to present a fresh, plausible fingerprint each time.

For these reasons, device signals work best as one input to a broader risk score, together with behavioral, identity and transaction data, rather than as a single block-or-allow rule.

Regulatory and Privacy Considerations

AML rules do not require device fingerprinting, but regulators generally expect firms to manage the higher risk of non-face-to-face relationships and to have effective fraud controls. In the EU and UK, strong customer authentication rules for payments also make device recognition relevant, because a recognized device can serve as a possession factor when the binding is secure.

Device data is often personal data. Under the EU and UK GDPR, firms need a lawful basis, a clear purpose and proportionate retention. European data protection authorities have taken the view that the ePrivacy rules on accessing information from a user's terminal equipment can apply to fingerprinting techniques, not only to cookies, so firms should consider whether consent or an exemption applies in their context and explain the processing in their privacy notices.

Best Practices

• Treat the fingerprint as a risk signal with a confidence level, not as a definitive identity.
• Link device data to outcomes, such as confirmed fraud cases, so that rules and models can learn which patterns matter.
• Watch for device sharing within legitimate households and businesses to avoid unfair declines.
• Limit collection to attributes that serve a defined fraud or security purpose.
• Review rules regularly, because the attributes browsers expose change over time.

How on8.ai Helps

on8.ai's Pre-KYC checks screen applicants before onboarding with email, phone and IP risk checks, VAT validation, velocity controls and bot detection. These signals complement device data by catching repeated, automated or high-risk applications before full KYC begins.

Related Terms

• Account Takeover (ATO)
• Synthetic Identity Fraud
• Identity Spoofing
• Money Mule
• Zero-Day Fraud
• Phishing