How device binding works
During enrolment the app generates a key pair inside the phone's secure hardware. The private key cannot be exported, and the public key is registered against the customer on the server.
From then on the server sends a challenge, the device signs it, and a valid signature shows that the request comes from the enrolled device. Use of the key can be made to depend on a fingerprint, a face or a passcode, which adds a second factor in the same step. Copying the app's data to another phone does not copy the key, so a new phone is bound afresh.
What the EU rules require of device binding
The EU's technical standards on strong customer authentication do not use the term, but they regulate the thing. Possession elements are subject to measures designed to prevent their replication (Delegated Regulation (EU) 2018/389, Article 7). Where authentication runs on a multi-purpose device such as a phone, the provider uses separated secure execution environments and mechanisms to ensure that the software or device has not been altered (Article 9).
Article 24 covers the moment of binding: the association of a user with authentication devices and software is carried out in secure environments, and uses strong customer authentication when it is done through a remote channel.
Why fraud concentrates on device binding
An attacker who talks a customer into approving a new device controls the account from then on. Products therefore treat a new binding as a high-risk event, with step-up checks, lower limits for a first period, a notice to the old device and a list of bound devices that the customer can revoke.
Device binding or device fingerprint?
- Device fingerprint
- A profile inferred from a device's settings and behaviour, used to recognise it in fraud scoring. A fingerprint is a probability and proves nothing cryptographically.
- Device token
- The card schemes' version of the same idea: a card token provisioned to one phone's wallet, which works only from that device.
Where device binding shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- NotificationsEmail, SMS, push and in-app messages in your brand, through the providers you choose.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.