What is device fingerprinting?

Device fingerprinting is a way of recognising a returning browser or phone by the combination of characteristics it presents, rather than by an identifier stored on it. A cookie is a label handed to a visitor. A device fingerprint is a recognition of the device itself, which is why the technique is used for fraud prevention, account security and abuse control.

#How does device fingerprinting work?

A device fingerprint is built from the answers a browser or app gives while it goes about its ordinary work. It reports what software it runs, which language and time zone it is set to, how large its screen is, and how its hardware draws graphics and handles sound. Any single answer is shared by millions of devices. The combination is far more distinctive.

A fingerprinting system reads those answers, usually in a fraction of a second, and compares the result with what it has seen before. If the combination matches a device it already knows, the visitor is recognised as returning. If it does not, the visitor is new. No cookie is needed, and nothing has to be stored in the browser.

Fingerly does not publish the exact characteristics it reads. Knowing which checks exist teaches a fraudster what to hide, so the detail stays on the server side. What matters to the team integrating it is the outcome: a stable visitor ID, and a measure of how sure the match is.

#What is device fingerprinting used for?

Most deployments use it to answer one question at the moments that matter: have we seen this device before, and does this session look normal? The common uses are:

• Sign-up abuse: spotting one device creating many accounts to harvest welcome offers.
• Account takeover: noticing a login from a device the account has never used.
• Promotion and referral abuse: limiting one reward to one device, however many emails it uses.
• Payment risk: adding device context to a checkout so that a risky order can be reviewed rather than guessed at.
• Automation: telling scripted traffic from people, and spotting tampered or emulated environments.

#Why is an IP address not enough on its own?

An IP address describes a connection, not a device. Many unrelated people share one address in an office, a school or behind a mobile carrier, and one person’s address changes as they move between networks. A VPN can give a single device many addresses in an afternoon. Rules built only on addresses therefore block the wrong people and miss the right ones.

Device fingerprinting adds continuity on the device side, and the address adds context on the network side. Fingerly reports both: the visitor ID for the device, and network details such as country, the network the connection belongs to and whether it comes through Tor, a VPN or a proxy. Used together, they answer a better question than either does alone.

#How is a device fingerprint different from a cookie?

A cookie is stored on the visitor’s device and read back later, so the visitor can delete it, block it or never accept it. A fingerprint is inferred from what the device shows, so clearing storage does not remove it. That makes fingerprinting more useful against people who deliberately start fresh, and it is also why it deserves more care in how it is disclosed. The separate guide on browser fingerprinting versus cookies compares the two in detail.

#What does a device fingerprinting result look like?

With Fingerly, an identification returns a visitor ID, a confidence value from 0 to 100, whether the visitor is new to your organization, and a suspect score with a level of low, medium or high. Your backend can also read the signals behind the score, such as a Tor connection, a VPN, automation or tampering, and the network context of the session.

The visitor ID is an opaque string that Fingerly issues, not a hash of the device’s data, so it reveals nothing about the device. It is also scoped to your organization: the same device has a different visitor ID on another customer’s site. The public session demo on the Fingerly site runs a real identification of the browser you are reading it in, so you can see a result without writing code.

#Does device fingerprinting work on phones?

It works differently. Mobile platforms restrict what an app may read about a device, so a native app cannot lean on the browser techniques a website uses. Fingerly’s iOS and Android SDKs recognise an installed app by a random install identifier it keeps on the device, and use device checks for integrity and scoring instead. The guide on mobile device fingerprinting for iOS and Android explains the details.

#What are the limits of device fingerprinting?

Device fingerprinting is a probabilistic match, not proof of identity. Two near-identical devices can look alike, a major update can change what a browser reports, and privacy-focused browsers may reveal so little that no device can be recognised. A visitor ID also identifies a device, not a person: several people can share a phone, and one person can own several.

This is why a good integration treats the result as evidence rather than a verdict. It adds friction a real customer can pass, such as a second factor, before it blocks anyone, and it makes the final decision on its own server. The guide on how accurate device fingerprinting is covers collisions, resets and private browsing honestly.

A general explainer. It describes the technique, not a claim about any specific accuracy figure.