Skip to main content
Commerce Security Authority
Category: Fraud Detection Analytics

Device Fingerprinting

Also known as: Device Fingerprint, Machine Fingerprint
Simply put

Device fingerprinting is a method of collecting information about a remote computing device's software and hardware in order to recognize that device when it accesses a website or application. It is commonly used to help identify devices for fraud prevention, and the same techniques can also be used by third parties to recognize and track users across different websites. It helps distinguish devices but does not by itself confirm the identity of the person using the device.

Formal definition

Device fingerprinting is the practice of gathering a combination of software and hardware attributes from a remote computing device to derive an identifier that can be used to recognize that device across sessions or sites. In a fraud-prevention context, it is intended to help identify devices interacting with a web or application session and may assist in detecting suspicious or anomalous access patterns; the same attribute-collection techniques may also be leveraged by third parties for cross-site tracking and profiling. As a detection signal it is probabilistic rather than definitive: fingerprints can change or collide, and the technique identifies a device rather than authenticating a user, so it should be treated as one input among others rather than a standalone control. Its effectiveness and false-positive/false-negative trade-offs depend on the attributes collected and the implementation.

Why it matters

Device fingerprinting matters because much of today's fraud occurs in card-not-present channels, where a merchant or processor cannot rely on physical card presence or EMV chip authentication to help establish trust. Recognizing the device behind a session gives fraud teams an additional signal to spot anomalous or suspicious access patterns, such as a single device attempting many accounts or a known-bad device reappearing under a new identity. Because it identifies a device rather than authenticating a person, it is best treated as one input among several rather than a standalone control.

The technique is inherently probabilistic, and that has practical consequences. Fingerprints can change over time as software and hardware attributes shift, and different devices can produce colliding fingerprints, so both false positives and false negatives are possible. The magnitude of these trade-offs depends on which attributes are collected and how the implementation derives and compares identifiers. Fraud teams that treat a fingerprint match as definitive proof of a returning legitimate or fraudulent user risk either blocking good customers or missing genuine fraud.

The same attribute-collection techniques also carry privacy implications. Because third parties can use device fingerprinting to recognize users across different websites where their trackers are present and build detailed profiles, the practice sits at the intersection of fraud prevention and user tracking. Organizations deploying it should be aware that the underlying methods are not limited to their own fraud use case and may raise privacy and regulatory considerations depending on jurisdiction and implementation.

Who it's relevant to

Fraud Analysts and Merchant Risk Teams
Device fingerprinting gives fraud and risk teams an additional signal for identifying devices accessing a website or application and for flagging anomalous access patterns, particularly in card-not-present scenarios. Analysts should combine it with other inputs and account for its probabilistic nature, since fingerprints can change or collide and identify a device rather than a user.
Payment Processors and Acquirers
Processors and acquirers evaluating fraud-prevention tooling may encounter device fingerprinting as one component of a layered detection approach. Its value lies in recognizing devices across sessions, but it should not be relied upon as a standalone authentication mechanism, since it does not confirm the identity of the person using the device.
Security Engineers
Engineers implementing or integrating device fingerprinting must understand that effectiveness and false-positive/false-negative trade-offs depend on which software and hardware attributes are collected and how identifiers are derived and compared. They should also recognize that the same attribute-collection techniques used for fraud prevention can enable cross-site tracking.
Compliance and Privacy Officers
Because device fingerprinting techniques can be leveraged by third parties to recognize and profile users across different websites, compliance and privacy officers should assess the privacy and regulatory implications of collecting device attributes. The appropriate treatment depends on jurisdiction, implementation, and the specific attributes gathered.

Inside Device Fingerprinting

Device Attributes
Data points collected from a user's device or browser, such as operating system, browser version, installed fonts, screen resolution, language settings, and time zone, which together form a distinguishing profile.
Network and Connection Signals
Contextual identifiers such as IP address, connection type, and related network metadata that supplement device attributes to improve the accuracy of a derived fingerprint.
Derived Identifier
A composite value or probabilistic score generated from collected attributes, intended to recognize a returning or suspicious device across sessions without necessarily identifying the individual user.
Behavioral and Session Context
Supplementary signals such as navigation patterns or session characteristics that some implementations combine with static device data to strengthen risk assessment.
Risk and Fraud Signal Integration
The use of the fingerprint as one input within a broader fraud detection or risk-scoring system, typically for card-not-present transactions, account takeover detection, or velocity checks.

Common questions

Answers to the questions practitioners most commonly ask about Device Fingerprinting.

Does device fingerprinting uniquely and permanently identify a device?
No. Device fingerprinting builds a probabilistic identifier from attributes such as browser configuration, operating system, screen characteristics, language settings, and network signals. These attributes can change over time, be shared across similar devices, or be deliberately altered, so a fingerprint is a statistical likelihood rather than a guaranteed, permanent, one-to-one device identity. It is best treated as one risk signal that may drift and should not be relied on as a definitive unique identifier.
Can device fingerprinting on its own prevent fraud?
No single control prevents fraud, and device fingerprinting is not an exception. It is intended to help detect suspicious patterns, such as many accounts or transactions sharing one device, or a known device associated with prior abuse. It may reduce certain fraud attempts, but it produces both false positives and false negatives and can be evaded through anti-fingerprinting tools or environment changes. It is most effective as part of a layered approach alongside other authentication and detection measures, not as a standalone safeguard.
Where in the transaction flow is device fingerprinting typically applied?
It is commonly applied at points where a device interacts with a merchant or service, such as account creation, login, checkout, or other risk-relevant events. It can feed into risk scoring and step-up decisions, and it may be used to inform other flows such as data collected during a 3-D Secure exchange. The specific placement depends on the merchant's architecture, risk model, and the events they choose to instrument.
How does device fingerprinting relate to the data handled under PCI DSS?
Device fingerprinting focuses on device and environment attributes rather than on cardholder data or sensitive authentication data. Whether a fingerprinting implementation affects PCI DSS scope depends on how it is deployed, what data it collects, and whether that collection interacts with systems that store, process, or transmit account data. Teams should evaluate the specific implementation and validate scope against the current published standard rather than assuming fingerprinting is automatically in or out of scope.
What privacy and consent considerations apply when implementing device fingerprinting?
Because fingerprinting collects information about users' devices and environments, it can raise privacy and regulatory obligations that vary by jurisdiction and may involve notice, consent, and data-handling requirements. Implementers should review applicable privacy laws and platform policies for the regions in which they operate. Exact requirements depend on the jurisdiction, the data collected, and how it is used, so legal and compliance review is advisable before deployment.
How should teams tune device fingerprinting to balance detection and customer friction?
Tuning generally involves treating the fingerprint as one input to a broader risk decision and adjusting thresholds so that only higher-risk cases trigger additional friction, such as step-up authentication. Because the signal drifts and can be evaded, teams should monitor false-positive and false-negative trade-offs, review outcomes over time, and combine it with other signals rather than blocking solely on fingerprint matches. Appropriate settings depend on the population, risk tolerance, and observed performance in the specific environment.

Common misconceptions

Device fingerprinting uniquely and permanently identifies a specific device or person.
Device fingerprinting is generally probabilistic rather than definitive. Attributes can change with software updates, browser settings, or privacy controls, and multiple devices may share similar profiles. It helps recognize likely returning or suspicious devices but does not guarantee a unique or persistent identity.
Device fingerprinting prevents fraud on its own.
Device fingerprinting is one signal among many in a layered fraud strategy. It may help reduce certain card-not-present fraud and account takeover risks, but it does not replace controls such as 3-D Secure, strong customer authentication, or transaction monitoring, and it carries false-positive and false-negative trade-offs.
Device fingerprinting is a PCI DSS control or satisfies a specific PCI DSS requirement.
Device fingerprinting is a fraud and risk technique, not a defined PCI DSS control. Its handling of any collected data still falls under applicable data protection and privacy obligations, and readers should confirm scope implications against the current published standard rather than assuming it maps to a fixed requirement.

Best practices

Treat device fingerprinting as one input within a layered fraud program alongside authentication controls and transaction monitoring, rather than as a standalone defense.
Tune thresholds and scoring logic to balance false positives against false negatives, and monitor the impact on legitimate customers over time.
Combine device signals with complementary controls such as 3-D Secure or strong customer authentication for higher-risk card-not-present flows where appropriate.
Review the data collected for privacy and applicable data protection obligations, and minimize collection to what is needed for the intended risk assessment.
Account for attribute instability by validating that fingerprints remain useful as browsers, operating systems, and privacy features change.
Document how fingerprint data is stored, retained, and secured, and confirm any scope implications against the current published PCI DSS rather than assuming it is out of scope.