How a device fingerprint is made
A script on a web page, or an SDK inside a mobile app, reads attributes that the device exposes. No single attribute identifies a device, but the combination is rare enough to act as an identifier, and it is hashed into one value.
- Browser and operating system versions
- Screen size, time zone and language
- Installed fonts and graphics rendering
- IP address and network type
- In apps: hardware model and an app-scoped device ID
- Signs of tampering: emulators, rooted devices, automation tools
How fraud teams use a device fingerprint
The fingerprint answers questions an account name cannot. Has this device been seen with fifty cards this week, does it belong to a customer in good standing, was it used in an earlier chargeback? It feeds fraud scoring, account takeover checks at login, and limits on new accounts per device.
Fingerprints drift as software updates, so matching is a probability and not a certainty.
Device data in card payments
Card schemes use device data too. EMV 3-D Secure passes device information to the issuer for its risk decision. Visa's Compelling Evidence 3.0 accepts a device ID as one of the data elements that tie a disputed payment to the cardholder's earlier purchases, which gives merchants a reason to store it with every order.
Device fingerprint, cookie or device binding?
- Cookie
- A value the site stores in the browser and reads back. A user can delete a cookie, while a fingerprint is recomputed from the device itself.
- Device binding
- Ties an app installation to a cryptographic key held in the device's secure hardware. Binding proves possession of the device; a fingerprint estimates likeness.
Where a device fingerprint shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.