How Device Fingerprinting Detects and Stops Fraud in 2026

A single device can sit behind dozens of accounts that look completely unrelated on paper. Device fingerprinting shows you this: it recognizes devices across sessions using browser, hardware, and software signals, adding context that account data alone can't provide.

That context matters more each year. Sumsub's 2025-2026 Identity Fraud Report found a 180% year-on-year increase in sophisticated fraud involving advanced deception, social engineering, and AI-generated identities. Fraudsters now arrive with better documents, better stories, and, increasingly, automated agents doing the work at scale.

In our previous guide, we looked at device intelligence as a broader approach to assessing device-related risk. Here, we'll focus on one of its foundational technologies, device fingerprinting: how it works, what it can reveal, and where its limitations lie.

Device fingerprinting: Definition and core attributes

Device fingerprinting is a technology that identifies and tracks individual devices based on unique combinations of attributes, without relying solely on stored identifiers such as cookies. These attributes include hardware specifications, software configurations, operating system details, browser settings, and other distinctive features such as screen resolution, plugins, and installed fonts. 

How device fingerprinting works

Device fingerprinting involves gathering extensive information about a device's hardware and software configurations, such as:

• Browser and software information. Browser and operating-system versions, language, time zone, and supported browser features
• Display and device characteristics. Screen dimensions, color depth, touch support, and reported processing or memory capabilities
• Rendering characteristics. Differences in how the environment processes canvas graphics, WebGL content, fonts, or audio
• Network and protocol information. IP address, HTTP or Transport Layer Security (TLS) characteristics, IP-derived location, and VPN or proxy indicators
• Mobile app signals. Device model, operating system build, app installation information, and integrity or attestation results, where supported

From raw data to a matched device identifier

Once the signals are collected, the system extracts the attributes most likely to be useful: those that stay stable for a given device across sessions while still varying widely between devices. A signal that shifts on every visit can’t support recognition, and one that looks identical on every device can’t support distinction.

These attributes combine into an identifier, often called a device ID, that represents the fingerprint. The identifier can be hashed, which reduces exposure of the underlying raw attributes and supports pseudonymization. No single attribute is unique to one device, so the identifier reflects the strength of the combination rather than a guaranteed one-to-one match.

Device tracking and analysis

When a device accesses a website or application, the system observes the available signals and calculates or updates a fingerprint based on the current data points. Depending on the system, it may return an assigned device ID, a similarity score, or a confidence level that the interactions came from the same device. 

Advanced fingerprinting techniques: Canvas, WebGL, audio, and TLS

Effective device fingerprinting relies on a range of data collected using different techniques.

• Canvas fingerprinting instructs a browser to render hidden text or shapes and reads back the resulting pixel data. Tiny differences in GPU, drivers, and font rendering produce a potentially distinguishing output for each device (although the result is not necessarily unique to one device)
• WebGL fingerprinting uses information the browser makes available, such as renderer strings, supported extensions, and shader precision. These vary significantly across hardware and driver combinations, so they add another layer of identifying data
• Audio fingerprinting uses the Web Audio API to generate a sound wave and analyze how it's processed without playing a sound out loud that would alert the user. Subtle variations in audio hardware and software create a “signature” that can help to identify a specific device
• TLS fingerprinting analyzes the unencrypted parameters exchanged during the TLS handshake, the negotiation that establishes an encrypted channel between client and server before any sensitive data moves. Browsers, operating systems, and network stacks each structure that handshake differently. This makes TLS particularly good at recognizing browsers, apps, scripts, and automated tools, though it rarely identifies a physical device on its own

A robust approach combines these techniques to build a stable device identifier that resists simple evasion tactics like clearing cookies or switching IP addresses. Because these techniques probe hardware and rendering behavior rather than stored identifiers, the data they target is much harder for fraudsters to spoof consistently across sessions.

Device fingerprinting vs. cookies

Cookies are small text files that websites store on a user’s device, usually acting as session identifiers. They allow sites to recognize returning users and tailor experiences, such as keeping items in a shopping cart. Cookies also support targeted advertising by tracking user behavior across different websites.

There are two main types: first-party cookies, set by the website you’re visiting, and third-party cookies, set by other sites mainly for advertising, analytics, or other purposes. Because of privacy concerns, many users delete or block cookies, and browsers are increasingly limiting their use.

Both cookies and digital fingerprinting can track and identify users, but there are fundamental differences between the two methods:

• Functionality: A cookie allows a browser to present a previously stored identifier. Fingerprinting calculates a profile from the signals available during each interaction and compares it with earlier observations
• Storage: Cookies are small files stored on a user's device that websites can access and update over time. In contrast, device fingerprinting doesn’t require any information to be stored on the device, as it relies on the data that the device automatically shares when interacting with websites or applications
• Persistence: Cookies can be deleted or blocked by users, limiting their effectiveness. Device fingerprints, on the other hand, are challenging to erase, as they rely on inherent device attributes rather than data saved on the device. This makes them more persistent and harder for users to control
• User control: Browsers provide visible controls for managing cookies. Fingerprinting can be harder for users to detect or manage, although browsers increasingly restrict the information used to build fingerprints

Both cookies and digital fingerprints are tools used for tracking users online, but device fingerprints are generally more persistent and sophisticated than cookies.

Google's Privacy Sandbox reversal and what it means for fingerprinting

Google spent years preparing to phase out third-party cookies in Chrome, replacing some of their advertising and measurement functions through Privacy Sandbox. In 2025, it reversed course, confirming that third-party cookies stay on by default and shutting down most Privacy Sandbox APIs. With Chrome at roughly 70% of global browser usage (StatCounter, mid-2026), cookies remain a fixture of the web for the foreseeable future.

For fraud prevention, this keeps cookies and fingerprints complementary rather than competing. A cookie identifies a browser while it survives. A fingerprint maintains continuity when a cookie doesn't. Both are affected by browser protections and software updates; that’s why neither works well without account, network, behavioral, and transaction signals.

Use cases of device fingerprinting across industries

Banking and financial security

• Account takeover detection. An unfamiliar device or one previously associated with suspicious activity can increase the risk score for a login, password reset, or payment
• Credential stuffing defense. Device fingerprints can help connect repeated login attempts, even when attackers change IP addresses or target multiple accounts
• Transaction risk assessment. Financial institutions can compare the device used for a transaction with the customer’s previous activity and request additional verification when the context appears unusual

E-commerce and marketplace fraud prevention

• Promotion and referral abuse. Linking multiple accounts to the same or closely related device environment can reveal attempts to claim the same welcome offer repeatedly
• Payment fraud detection. A device associated with previous chargebacks or suspicious orders can contribute to the risk assessment of a new transaction
• Seller and buyer abuse. Marketplaces can use device links to investigate coordinated accounts, fraudulent listings, fake reviews, or attempts to return after suspension

Online gaming and gambling

• Multi-accounting detection. Recognizing devices used across several accounts can help identify attempts to obtain unfair advantages, evade limits, or bypass a previous ban
• Bonus abuse. Operators can investigate cases in which multiple accounts connected to the same device claim welcome bonuses or other restricted rewards
• Bot and emulator detection. Fingerprinting can reveal unusual or inconsistent device environments. It should be combined with app-integrity and behavioral signals before action is taken

Suggested read: Bonus Abuse in Gambling: Types, Risks & How to Prevent It

Subscription services and geo-restriction

• Account sharing investigation. Device history can show how many devices access an account and whether access patterns differ substantially from normal use
• Device limit enforcement. Services can recognize registered devices and apply contractual limits, while allowing for legitimate device replacements
• Location risk analysis. A fingerprint can be evaluated alongside IP, proxy, VPN, and location data when access appears inconsistent with an account’s usual activity

VPN and browser tampering detection trends in 2026

Historically, fraud teams saw VPN use as potentially suspicious, but now that it's so common, that perception is shifting. VPN detection should be viewed in the context of broader fraud signals, where inconsistencies matter more than individual data points.

Agentic browsers add another potential complication. These are AI-powered browsers that can understand user instructions and perform multi-step tasks on their behalf, such as navigating websites, filling out forms, and completing online workflows. Unlike traditional browsers, they can plan and execute actions autonomously, with varying levels of user oversight.

Their automated behavior may resemble suspicious activity, even when the browser is used for legitimate purposes, making it harder for fraud detection systems to distinguish genuine users, AI-assisted activity, and malicious automation.

Mobile device fingerprinting for apps

Mobile fingerprinting is harder than web fingerprinting. Any given handset model ships in the millions, all running the same OS build with the same screen dimensions and the same hardware, so the attributes that distinguish one laptop from another have little distinguishing power on phones. App sandboxing adds a second constraint: both iOS and Android restrict what an app can read about the device it runs on, and those restrictions have tightened with each release.

So, mobile fingerprinting depends on a wider range of weaker signals rather than a few strong ones. These include device model and OS build, screen metrics, sensor calibration offsets, boot time, carrier and SIM state, and Keychain or Keystore-anchored identifiers.

OS-level device identifiers appear to be a simpler alternative, but they come with limitations. Platform identifiers are typically scoped to a single app or vendor rather than exposed to third parties. Users can reset advertising identifiers, and a factory reset clears others. They are useful as one signal among several, but not reliable enough to identify a device on their own.

Probabilistic graphs are one common response to this limitation. Rather than matching on a single attribute, the graph combines several partial signals to estimate how likely separate devices or accounts are to belong to the same person or entity.

Device attestation serves a different purpose. It does not identify which device is present; it verifies that the device is running genuine hardware and uncompromised software, using cryptographic proofs rooted in tamper-resistant hardware: the Secure Enclave on iOS, the Trusted Execution Environment or StrongBox on Android.

Device fingerprinting and privacy regulations worldwide

GDPR requirements for device fingerprinting

Device fingerprinting raises privacy concerns, particularly in regions where regulations like the General Data Protection Regulation (GDPR) apply. The requirement to obtain consent before accessing or storing information on a user's device stems from the EU's ePrivacy Directive (Article 5(3)), while GDPR governs the fingerprint itself once collected, since device fingerprints that can identify an individual qualify as "personal data" under GDPR. In practice, the two laws work together. The ePrivacy Directive triggers the consent requirement, and GDPR sets the standards for how that data must then be handled: transparency, purpose limitation, data minimization, and user rights.

Here’s how the two frameworks affect device fingerprinting:

• Consent requirement: Explicit, informed consent is generally required before fingerprinting is used for tracking, per the ePrivacy Directive's rule on accessing device information
• Transparency: GDPR requires organizations to inform users what data is being collected and why – an obligation that carries extra weight for fingerprinting, which runs invisibly in the background
• User control: Users can delete cookies but have limited ability to detect or block fingerprinting, so businesses must build in genuine opt-out mechanisms to comply
• Data minimization: GDPR discourages collecting more data than necessary, so overly broad fingerprinting could violate this principle even when consent has been obtained

Upcoming EU regulatory changes

In November 2025, the European Commission proposed the Digital Omnibus, a plan to simplify and modernize EU privacy rules, including how cookie and tracking consent works. It would not remove the requirement to get user consent before fingerprinting or tracking, but it would fold today's separate cookie rules into GDPR itself and push for simpler, less repetitive consent prompts, such as equal-sized "Accept" and "Reject" buttons and not re-asking for consent for months after someone declines. This is still just a proposal moving through EU negotiations, so nothing has changed yet, but it could reshape how fingerprinting consent is handled across Europe sometime in 2026 or 2027, and is worth monitoring for future compliance updates.

CCPA and US state privacy laws

The California Consumer Privacy Act (CCPA) and its 2020 update, the California Privacy Rights Act (CPRA), which took full effect in 2023, govern how businesses collect personal data. Together, they give California residents the right to opt out of data collection and sharing for personalized advertising, device fingerprinting included. Neither law forbids fingerprinting outright. Both impose transparency and user-rights obligations. 

Similar state-level privacy laws across the US enforce data rights for consumers, typically including the right to confirm what data businesses hold about them, access that data, correct or erase it, and stop its use or sale.

Examples of US state privacy laws currently in effect include: 

• Colorado Privacy Act. In effect from July 1, 2023
• Connecticut Data Privacy Act. In effect from July 1, 2023
• Delaware Personal Data Privacy Act. In effect from January 1, 2025
• Florida Digital Bill of Rights. In effect from July 1, 2024
• Indiana Consumer Data Protection Act. In effect from January 1, 2026
• Iowa Consumer Data Protection Act. In effect from January 1, 2025
• Kentucky Consumer Data Protection Act. In effect from January 1, 2026
• Maryland Online Data Privacy Act. In effect from October 1, 2025
• Minnesota Consumer Data Privacy Act. In effect from July 31, 2025
• Montana Consumer Data Privacy Act. In effect from October 1, 2024, and updated on October 1, 2025, by Senate Bill 297
• Nebraska Data Privacy Act. In effect from January 1, 2025
• New Hampshire Data Privacy Act. In effect from January 1, 2025
• New Jersey Data Protection Act. In effect from January 15, 2025
• Oregon Consumer Data Privacy Act. In effect from July 1, 2024
• Rhode Island Data Transparency and Privacy Protection Act. In effect from January 1, 2026
• Tennessee Privacy Protection Act. In effect from July 1, 2025
• Texas Data Privacy and Security Act. In effect from July 1, 2024
• Utah Consumer Privacy Act. In effect from December 31, 2023
• Virginia Consumer Data Protection Act. In effect from January 1, 2023

The following state-level privacy laws will take effect soon:

• Alabama Personal Data Protection Act. Will take effect from May 1, 2027
• Louisiana Data Privacy Act. Will take effect from January 1, 2027
• Oklahoma Data Privacy Act. Will take effect from January 1, 2027
• Vermont Data Privacy and Online Surveillance Act. Will take effect from January 1, 2028

Suggested read: CCPA vs. CPRA: Understanding California's Data Privacy Laws

LGPD, PIPL, and PIPA rules outside the US

Brazil’s LGPD (Lei Geral de Proteção de Dados) aligns closely with GDPR in terms of scope and regulation. Device fingerprinting falls under its definition of personal data processing, meaning companies must obtain consent, inform users of data collection, and provide opt-out mechanisms.

China’s Personal Information Protection Law (PIPL) requires explicit consent for data collection, especially for personal information that can identify an individual, including device fingerprints. PIPL emphasizes user rights, consent, and transparency.

In South Korea, the Personal Information Protection Act (PIPA) requires companies to disclose any collection of data that can identify an individual, including device fingerprinting, and to obtain user consent.

Fighting fraud with device fingerprinting

Supporting bot and automation detection

Bots are a well-established type of software program designed to automatically perform predefined digital tasks, often involving repetitive actions. AI agents are more advanced autonomous software systems that can carry out more complex tasks, using machine learning techniques to adapt and improve over time.

While both bots and AI agents have many legitimate uses, fraudsters can also deploy them to carry out rapid, large-scale cyberattacks and fraud attempts. AI agents in the hands of criminals are a particular concern, as they can execute sophisticated fraud methods, such as synthetic identity fraud, at a speed and scale that often overwhelm traditional defenses.

Suggested read: From AI Agents to Know Your Agent: Why KYA Is Critical for Secure Autonomous AI

Device fingerprinting can surface signs of automation in the browser or software environment: headless browsers, emulators, unusual configurations, inconsistencies between reported device characteristics, or the same environment recurring across many accounts. Network and connection fingerprints expose tools that behave differently from ordinary browsers, and they hold up when a bot rotates accounts and IP addresses but keeps the same client environment.

These signals earn their keep when combined with behavioral data: request frequency, unusually rapid submissions, improbable navigation patterns, and activity continuing around the clock. Behavioral analytics is a separate discipline, but the two belong in the same detection system.

Recognizing new and previously seen devices

A device that has appeared during earlier legitimate activity may provide continuity when the same customer returns. Conversely, a new device (or one previously associated with confirmed abuse) can raise the risk score for a login, registration, or transaction.

For example, an account login from an unfamiliar device and a new location may justify additional verification. Both of those signals may have a legitimate explanation, such as travel or a replacement phone.

Connecting related activity

Fingerprinting can help identify links that are difficult to see from account information alone. Several accounts using the same or closely related device environment may indicate promotion abuse, coordinated account creation, or an attempt to return after suspension.

A shared device does not prove that the accounts are controlled by one person. Households, workplaces, and public facilities may have legitimate reasons for sharing devices, so other account and behavioral evidence is needed.

Informing proportionate responses

The device fingerprint can contribute to a risk score alongside account history, network information, identity data, behavior, and transaction details. Depending on the combined evidence, a business might allow the activity, monitor it, request additional verification, limit a particular action, or send the case for review.

Device fingerprinting may support an organization’s risk-based security controls, but it does not guarantee regulatory compliance. Businesses must also establish an appropriate legal basis, provide required transparency, minimize the information collected, and protect retained device data.

Fraud prevention with Sumsub

Sumsub’s Fraud Prevention solution combines device, identity, behavioral, network, and transaction signals in one platform. This allows businesses to assess risk at different points in the customer journey, including registration, identity verification, login, account changes, and payments.

Sumsub’s Device Intelligence provides device and network signals that can help businesses recognize new or previously seen devices, connect multiple accounts using the same device, and identify potentially risky environments. The results can be assessed alongside identity and account history rather than treated as proof of fraud on their own.

Behavior Monitoring adds information from platform events supplied by the business, such as sign-ups, logins, password changes, and other defined account actions. Transaction Monitoring can evaluate payment and transaction data separately. Bringing these sources together helps identify patterns such as unusual account access, multi-accounting, promotion abuse, and suspicious transactions.

Businesses can use preconfigured or custom rules to combine relevant signals, set risk thresholds, and determine an appropriate response. Depending on the configuration, Sumsub can return results through its API and webhooks, route a case for manual review, or support actions such as requesting additional verification, placing a transaction on hold, or rejecting high-risk activity.

Sumsub also integrates fraud prevention with identity verification, AML screening, and transaction monitoring. These tools can support a business’s identity and financial crime compliance processes, but the customer remains responsible for configuring them appropriately and meeting the legal requirements that apply to its activities.

Learn more about Sumsub’s Fraud Prevention solution

Unlock the power of our advanced ML algorithms to tackle all types of fraud at every user interaction.

Find out more

Device fingerprinting FAQ

• How does device fingerprinting work?

  Device fingerprinting combines attributes from a device and browser into an identifier for that environment. Typical inputs include browser type and version, operating system, screen resolution, installed fonts and plugins, time zone, language settings, and hardware indicators such as GPU details. No single attribute is unique, but the combination is distinctive enough to separate one device from millions, and unlike a cookie, it survives basic evasion such as clearing browser data.

• How does device fingerprinting prevent fraud?

  Device fingerprinting helps prevent fraud by letting businesses identify individual devices and link them to user activity, even if the user changes their email, IP address, payment details, or other basic identifiers. Devices previously flagged for suspicious activity can be rapidly detected, so they can be automatically blocked or challenged. Device fingerprinting can also help spot organized fraud, such as fraud rings and bot networks, where large numbers of "different" accounts originate from the same handful of devices.

• What is the best device fingerprinting API?

  There's no single "best" device fingerprinting API, as the choice will depend on your use case. Critical features to consider include accuracy and stability, coverage across both web and mobile, resistance to spoofing and tampering, and low latency. Key capabilities should include VPN and proxy detection, bot and AI agent detection, velocity checks, and risk scoring. Regulatory alignment with data minimization and regional privacy requirements should also be weighed.