Device FingerprintingA Great Addition to Any Anti-Fraud Strategy IF Used Wisely

Device Fingerprinting: A Crucial Tool in the Fight Against Fraud

Tracking the device and browser a customer uses — when disclosed properly in compliance with regulations like GDPR, of course — can help you provide more personalized and tailored shopping experiences.

But, did you know the information gleaned from device fingerprinting can also help you keep track of suspicious activities and the fraudsters behind them? That's right; device fingerprinting can be a big help in the fight against checkout and post-transaction fraud.

In this article, we provide an introduction to device fingerprinting and explain how it works. We also explore use cases, go over pros and cons, discuss future trends, and share some best practices for implementation.

What is Device Fingerprinting?

Device Fingerprinting

[noun]/ˈdə • vīs • fiN • Gər • print • iNG/

Device fingerprinting is a forensic technique used to identify a device. The methodology can gather unique information based on device configurations, as well as hardware and installed software. Each piece of data helps create a unique picture of the device in question, like the lines of a human fingerprint.

Device fingerprinting, also known as machine fingerprinting, is a method of collecting unique information about a remote computer or mobile phone. You can collect details about a device’s hardware and software, including screen sizes, timestamps, installed plugins, and geolocation data, to create unique device fingerprints.

Device fingerprinting can help you identify the devices that interact with your website, even if the user switches browsers. This allows you to provide personalized user experiences; for example, by showing retargeting ads to a user who has previously accessed your website, or by displaying a specific language based on the region the user is in.

This same forensic technology can also be used to keep bad actors at bay. For instance, device fingerprinting can help you track and block devices or IP addresses that appear to engage in suspicious activities, like card testing, new account fraud, or account takeover (ATO) attacks.

How Device Fingerprinting Works

Device fingerprinting services compile a variety of data points about a device’s hardware and software, which can be used to quickly identify information about a particular device.

These data points are then compiled into fixed-length outputs called hashes, which are used to create a comprehensive profile about each device that can be combined with machine learning techniques to identify trends, detect anomalies, and extract behavioral insights.

Why Device Fingerprinting is More Secure Than Other Validation Methods

Device fingerprinting can be thought of as a more comprehensive alternative to traditional techniques that use browsers, cookies, IP addresses to track users.

Browser fingerprinting, which tracks visitors using only data points gleaned from browses, provides limited hardware and behavioral information and cannot detect browser changes. Cookies can expire or be deleted, and cannot be used to track users over long periods of time. IP addresses can be spoofed.

This means that merchants who rely on these legacy tools may get incomplete or inaccurate information about the users and devices that interact with their online storefronts.

Use Cases for Device Fingerprinting

Device fingerprinting can be used to accomplish a lot of different functions. Use cases include:

Strengths & Weaknesses of Device Fingerprinting

Device fingerprinting services leverage a wide range of data points, and provide persistent identification across different browser sessions, even if cookies are cleared. It can identify devices and users even if they try to spoof their IP address.

Device fingerprinting also works in real time. Fraud analysts can review and reverse suspicious logins and checkout attempts before they morph into chargebacks or refund scams.

That said, device fingerprinting is not a perfect fraud prevention solution. For starters, merchants will need to make sure that they are compliant with data privacy regulations like the EU’s GDPR and the California Consumer Privacy Act (CCPA), which allow users to opt out of data sharing and device tracking.

Bad actors can also evade device fingerprinting by deploying anti-fingerprinting tools, using VPNs, browsing in incognito mode, or accessing your site using privacy-focused browsers. It’s also not foolproof; false positives are possible, and devices or checkout attempts that are flagged as suspicious should undergo risk scoring and manual review.

Perhaps the biggest weakness with device fingerprinting is that it cannot prevent friendly fraud, which is a form of first-party fraud carried out by customers who file chargebacks out of convenience, error, or ill will.

Device Fingerprinting Datapoints

Device Fingerprinting & Privacy

I talked a bit about privacy in the last section. However, I want to take another minute to really delve into that topic, since it’s one of the main concerns that people tend to have with device fingerprinting.

Device fingerprinting is capable of revealing a lot about a user at first scan. So, it’s no surprise that privacy advocates and legislators have raised objections. The reason for this is a general lack of specified protections with regard to online data privacy in the US.

This is a potential issue because it isn’t immediately obvious to US users that they are being fingerprinted if they are on a mobile device. They may not know to respond or turn off the technology before their data can be collected.

In the UK and EU, General Data Protection Regulations mandate that merchants must obtain explicit user consent before attaching cookies to a particular session. Device fingerprinting is not mentioned specifically in the law. However, the GDPR does define “the processing of personal data” in a very broad manner, so you’ll need to comply with the following criteria:

• 1. Express user consent is given to utilize the platform
• 2. The information collected must be strictly used to protect the user’s private data
• 3. The information collected cannot pertain to marketing or promotional purposes without express consent

Future Trends in Device Fingerprinting

Device fingerprinting isn’t a static technology; it’s evolving rapidly. From AI technology to new legislation, here are a few of the primary trends shaping the technology:

Best Practices for Implementing Device Fingerprinting

The most effective way to implement device fingerprinting is to take a flexible, regulation-conscious approach that prioritizes integration with your existing fraud prevention tools. Specifically:

#1  |  Combine Fingerprinting With Current Fraud Detection Methods

Device fingerprinting works best when it’s used as part of a multi-layered security strategy. Integrating it with behavioral analytics, multi-factor authentication (MFA), and transaction monitoring techniques can help you gain a fuller picture of who your users are.

#2  |  Comply With Data Privacy Laws

Data privacy regulations change by jurisdiction. But, common requirements include clearly disclosing data collection practices, giving users the opportunity to opt-out, protecting personally identifying information using security techniques like encryption, and using customer data only for legitimate and specified purposes.

#3  |  Adapt Fingerprinting Strategies to Evolving Fraud Tactics

Fraud isn’t a static threat. Your device fingerprinting strategy, and the role it plays in your broader fraud and chargeback management plan, must be agile, too. For example, you can retool your existing arsenal against anti-fingerprinting tactics by incorporating machine learning to detect novel evasion techniques and refine your models based on emerging threats.

#4  |  Be Wary of False Positives

Device fingerprinting is a good indicator, but it’s not foolproof. Treat it as just one factor when deciding whether to approve or reject customers.  Doing so can help you reduce both false positives and false negatives, which can allow you to target bad actors without banning legitimate customers.

A Multi-Layered Strategy is Best

Here’s the bottom line: device fingerprinting is a useful and effective tool for reactive fraud management. But, while it can stop some bad actors, it won’t be able to intercept every scammer.

Fraud is a dynamic and constantly-evolving problem. Fraudsters can use a variety of different tactics and approaches to steal from you and your customers.

Device fingerprinting should be one part of a more comprehensive strategy to identify and stop fraud. It’s designed to work alongside other fraud tools and tactics, including (but not limited to):

• Address Verification Service (AVS)
• CVV Verification
• Geolocation
• Velocity Checks
• Biometrics
• Affiliate fraud screening

Data from all these fraud management tools and tactics should be examined in context by submitting each transaction to dynamic fraud scoring. This will produce a simple, data-driven figure determining the relative risk posed by each transaction. You can then reject risky transactions either automatically or on a case-by-case basis.

Learn more about fraud detection

Have additional questions about device fingerprinting as part of your fraud management plan? Want to learn more about how to build a comprehensive strategy to tackle fraud and abuse before and after each sale? Click below to speak with one of our experts.