Device Fingerprinting and IP Analysis for Fraud

Information from a customer’s computer, mobile device, and internet connection can help to separate trusted behaviors from suspicious. Device fingerprinting and IP analysis are two of the most common ways to do it, and both have changed as browsers, privacy rules, and fraudster tactics have evolved. This guide covers how each one works, where each one breaks down, and how to use them together.

Ways to tell one device from the next

The ability to uniquely identify a specific device can prove advantageous in the fight against fraud. On one hand, if for the past two months loyal customer [email protected] consistently uses the same computer to access a merchant’s site, the merchant may feel fairly certain that it’s the same person accessing their site today as it was two months ago. On the other hand, if device information indicates that [email protected], [email protected], and [email protected] are all accessing the merchant’s site from the same computer, they might reason that the user behind these accounts is up to something sneaky.

Specificity vs. persistence

The primary issue with device identification (also known as device fingerprinting) is the trade-off between specificity and persistence. A specific identification will uniquely identify a single device and no other devices. A persistent identification is unlikely to change even if device settings change.

The simplest method of identifying a device is by depositing a cookie on a user’s machine upon their arrival at a specified site. This cookie contains information related to its creation time and date, as well as user details (as desired). Pros of cookies are that each cookie is unique, making it as device-specific as possible. Cons of cookies is that users can erase the cookie, and thereby appear as a new unique visitor each time. It is almost too easy to erase a cookie: legitimate customers may be in the habit of erasing cookies due to privacy concerns, while fraudsters can easily avoid being tracked with the click of a button.

Browsers are making cookies less durable, too. Safari’s Intelligent Tracking Prevention caps cookies created through JavaScript at seven days, so a returning iPhone visitor can look brand new after a week. Chrome decided in April 2025 to keep third-party cookies available. In Europe, GDPR and ePrivacy rules can also require consent before a cookie or device identifier is stored, so teams should confirm how those rules apply to their fraud prevention use case.

Another method of device profiling is to use the browser session to determine usage information. A system, program, or person can read system information from the browser session, stringing together this information, which we call user agent. Each browser session can provide a lot of data. For example, the information pulled might indicate the user’s operating system name and version number, browser name and version number, and the browser language. A user agent can look something like Windows10/Chrome140/English-US.

While this example is not very specific, it is persistent. All users running that version of Windows, that version of Chrome, and with English as their only defined browser language will appear as the same device. However, the signature for a given user remains the same until they change operating system versions, browser versions, or set languages. More advanced device fingerprinting methods use a wider array of indicators, such as browser version, IP address, screen resolution, etc., to increase specificity while accounting for those factors that change the most frequently. The configuration determines exactly how specific and persistent the signature will be for a given user base.

Newer browsers share less in the user agent by default. Chrome has been shrinking the user agent string since version 101, and detailed values now have to be requested through User-Agent Client Hints.

Modern fingerprinting goes further, drawing on signals such as canvas and WebGL rendering, installed fonts, time zone, and network-level characteristics. No single value is trusted on its own. Systems compare many signals and match devices probabilistically, so a device can stay linked to the same fingerprint even when a few attributes change.

The table below summarizes how the main methods compare.

Method	Specificity	Persistence	Easy to evade?
Cookie	High	Low	Yes, users can clear it
User agent	Low	High	Moderate, strings can be spoofed
Multi-signal fingerprint	High	Medium to high	Harder, but anti-detect browsers try
IP address	Low	Low	Yes, with proxies and VPNs

In addition to which device, how about where is the device?

When a user connects to a website, their IP address becomes known. The IP address is a string of numbers separated by periods, like this: 54.86.209.249. The address indicates where on the internet the traffic originates. This information can be used in several different ways:

First, like a device signature, the IP address can be used to identify a user between sessions. Unfortunately, IP addresses tend to be both very broad and very changeable. For example, everyone connecting to a merchant’s website from UC Berkeley’s servers will have the same IP address. On the other hand, every time someone connects to a website on a mobile device through AT&T, their IP could be different depending on how their connection is routed through AT&T’s mobile towers (or if they’re using a coffee shop’s Wi-Fi, with its own IP shared by everyone connecting to it). The picture is more complicated now that IPv6 gives devices many more addresses, carrier-grade NAT puts large numbers of mobile users behind a single address, and privacy relay services such as iCloud Private Relay swap a user’s IP for a shared one. Despite all this, tracking velocity of purchases made or different accounts accessed from a particular IP address can be a useful signal for detecting fraudulent behavior.

In addition, certain IP addresses belong to certain registered organizations, which operate out of certain geographical locations. Some of this information is publicly available, while other factors must be extrapolated and researched. There are a variety of paid and free resources that take in an IP address and output organization name, carrier code, connection type, IP country, and geographical coordinates for that specific connection. This can allow merchants to make broader observations about fraud they’ve encountered. For instance, rather than targeting specific IP addresses in a game of whack-a-fraudster, merchants can look for broader patterns, such as a sudden country change on an established account or an IP location that doesn’t match the billing or shipping address. Country alone is not a verdict, since blocking by region can decline legitimate customers.

Fraudsters can take steps to obscure their true IP address, such as using proxies, VPNs or accessing the connections of virus-infected computers connected to botnets. There are methods that can pierce or mitigate this to some extent, but in short it’s best to use IP as one signal among many.

Residential proxies and anti-detect browsers

Residential proxies have changed the IP picture the most. They route traffic through real household connections, often through infected devices or free apps that quietly enroll them, so a login can look like an ordinary customer on an ordinary internet provider. In a GreyNoise analysis of four billion malicious sessions over three months, roughly 39% appeared to come from home networks, and 78% of that residential traffic was invisible to reputation feeds. Most residential IPs were used once or twice and then disappeared.

Fraudsters are also getting more precise. In March 2026, the FBI warned that criminals can choose residential proxy addresses down to the city level, including matching the victim’s city to avoid geolocation checks on bank accounts. Underground guides often pair these proxies with anti-detect browsers that spoof fingerprints, time zones, and language settings. That is why consistency matters more than any single value: a clean residential IP paired with a browser profile that contradicts itself still gives the fraudster away.

Device signals on mobile

Mobile apps work differently from browsers. There are no cookies, so apps rely on identifiers such as Apple’s identifier for vendors or an ID the app generates and stores on the device, and these can reset when the app is removed or the device is wiped. Apple’s App Tracking Transparency requires permission to use the advertising identifier, and Android users can reset or delete their advertising ID, so fraud teams can’t count on either. Platform attestation, such as Apple App Attest and Google Play Integrity, helps confirm that a request comes from a genuine app on a genuine device, which is useful against emulators, device farms, and modified apps.

Putting device and IP signals to work

A few patterns show up again and again when these signals are combined:

• Many accounts, one device. Several accounts created or accessed from the same device point to account farming or multi-accounting.
• Established account, new device, new location. A password reset or payout change from an unfamiliar device on an unfamiliar network is a classic account takeover pattern.
• Velocity across a network, not just an IP. Counting attempts by ASN or device cluster catches the rotation that per-IP limits miss.
• Contradictions inside a session. A time zone, language, or screen size that doesn’t match the claimed location or browser suggests spoofing.

Despite the caveats associated with device and IP identification, this information is still extremely useful and can be used to distinguish legitimate user activity from fraudulent. Typically, trusted activity has some semblance of consistency, while fraudsters tend to mix up tactics in order to obscure their true identities and avoid detection. For example, using an incognito browser that refreshes cookies each time is not necessarily suspicious if the browser and operating system remain the same, while fraudsters may use many different VPNs and devices to thwart detection systems.

Prevent all types of online fraud and abuse with a single fraud detection solution for end-to-end protection.

Frequently asked questions