June 2025 Summaries

Automated bots, which constituted 51% of internet traffic in 2024, pose significant challenges for website owners, as they can degrade site performance, skew analytics, and facilitate fraudulent activities. While some bots, like search engine crawlers, are benign, others are malicious, targeting sites with credential stuffing attacks, content scraping, and more. Effective bot detection is crucial for maintaining site security, user experience, and data integrity, utilizing techniques such as interaction-based verification, behavioral analysis, and machine learning to identify and block harmful bots. Solutions like Fingerprint provide advanced tools to distinguish between human and bot activity, enabling businesses to safeguard their digital assets by integrating multi-layered detection and response strategies. As the tactics of fraudsters evolve, ongoing updates and the adoption of robust bot detection measures are essential to protect online platforms from potential threats and ensure compliance with regulatory standards.

High Recall ID is a newly launched beta identifier designed to enhance the recognition of anonymous users, complementing the standard visitor ID, which focuses on precision to prevent fraud. While precision is crucial for sensitive areas like login or checkout pages, High Recall ID aims to improve user experience on other site areas by reducing friction and offering personalized interactions, thus increasing conversion opportunities. This tool is particularly effective in recognizing returning users even after cookie clearance or extended absences, and it can detect account sharing by integrating insights from both identifiers. Early adopters have reported a significant increase in the recognition rate, with one customer experiencing a 27% improvement. The beta version is available to Enterprise customers, allowing them to compare recognition rates and accuracy between the two identifiers, with the opportunity to provide feedback to refine the feature.

Guest checkout is a popular feature in e-commerce as it simplifies the purchasing process by allowing customers to complete transactions without creating an account, thereby increasing conversion rates. However, this convenience can also facilitate fraud, as it lacks persistent identifiers that help track suspicious activity, making it harder to detect and prevent fraudulent behavior such as stolen credit card use or chargeback fraud. Fraudsters exploit this anonymity by using tactics like VPNs and browser tampering to mask their identities. To combat this, the article highlights the use of device intelligence, specifically Fingerprint's technology, which assigns a unique visitor ID to recognize devices even if cookies are cleared or IP addresses change. This tool provides insights into potentially risky behavior, allowing merchants to flag and block fraudulent transactions without disrupting the guest checkout experience for legitimate customers. By integrating such device intelligence, businesses can maintain the benefits of guest checkout while effectively preventing repeat fraudsters from exploiting the system.

The Events Search API by Fingerprint offers a new way for users to programmatically query and filter historical visitor event data, such as IP addresses and timestamps, directly within their own tools and workflows, thereby reducing reliance on manual dashboard checks and internal tooling. Built in response to customer demand for more control and integration capabilities, the API is designed to enhance fraud investigations, streamline reporting, and power internal tools by offering faster access to critical data. Security teams can automate investigations by filtering events with high Suspect Scores and combining Smart Signals to detect and isolate specific attack strategies, such as account takeover attempts. The API facilitates long-term analysis by allowing analysts to flag and revisit suspicious events, enabling more precise and efficient fraud detection at scale. Now available to all Fingerprint customers, the Events Search API supports deeper integrations and offers improved visibility, automation, and control over user behavior data.

New account fraud, also known as signup fraud, involves the creation of fake or duplicate accounts by fraudsters using synthetic data and automated scripts, often on a large scale, to exploit promotions, evade bans, or manipulate systems. This type of fraud can significantly impact businesses by draining resources, skewing metrics, and eroding trust, as fake accounts are used for activities such as incentive abuse, ban evasion, spam, and manipulation. Detecting and preventing such fraud is challenging because fraudsters can easily reset or spoof IP addresses, user agents, and cookies, often mimicking legitimate user behavior to avoid detection. To combat new account fraud, businesses are advised to implement multi-layered security measures, including device and browser fingerprinting, email or phone verification, and monitoring for high-risk signals, while balancing these strategies with maintaining a positive user experience. The Fingerprint platform offers a robust solution by providing accurate device identification and smart signals to detect suspicious activities, allowing businesses to effectively manage fraud prevention and maintain the integrity of their platforms.

Matched betting is a popular but controversial strategy where individuals exploit promotional bonuses from online gambling sites to secure risk-free profits, often through techniques like gnoming and multi-accounting. Gnoming involves using the identities of friends or family members to create new accounts and collect additional bonuses, complicating detection efforts due to the use of genuine identity information. This practice, while not always illegal, typically violates terms of service and poses a significant challenge for gambling companies trying to prevent fraud without deterring legitimate customers. Advanced fraud detection measures such as device intelligence and browser fingerprinting are recommended to identify and prevent matched betting and gnoming by tracking device usage and behavioral patterns, allowing companies to differentiate between fraudulent activities and legitimate gameplay without adding friction to the customer experience. These tools provide long-term visibility and high accuracy, offering a strategic advantage in curbing sophisticated fraud tactics while maintaining customer satisfaction.

Chargebacks are a common risk for merchants accepting credit card payments, as they provide consumers with a safety net against unauthorized purchases or merchant exploitation. While third-party fraud involving stolen cards is typically a losing battle for retailers, first-party fraud, or "friendly fraud," offers merchants the opportunity to dispute claims by providing evidence of legitimate transactions. Mastercard's First-Party Trust and Visa's Compelling Evidence 3.0 are frameworks designed to aid merchants in proving the authenticity of disputed transactions through data such as device fingerprints. UnionPay employs a two-step verification process that reduces chargebacks by shifting fraud prevention responsibility to consumers, though it lacks formal criteria for dispute resolution. JCB, the dominant network in Japan, allows only one opportunity for merchants to defend against chargebacks, emphasizing the importance of strong evidence collection. Utilizing device intelligence tools like Fingerprint can enhance a merchant's ability to win disputes by providing comprehensive and persistent identification data.

Online gambling companies frequently use bonuses and welcome promotions to attract new customers, but these incentives have become targets for fraudsters engaging in new account fraud. This form of fraud involves creating multiple accounts, often with stolen identities, to exploit promotional offers without any intention of long-term engagement. Such fraudulent activities not only strain promotional budgets and skew marketing metrics but also negatively impact customer lifetime value and the gaming experience for legitimate users. The presence of fraudulent accounts can damage a platform's reputation, discourage genuine customer acquisition, and lead to stricter withdrawal requirements that alienate new users. Device intelligence, including browser and device fingerprinting, is a crucial tool for detecting and preventing repeat sign-ups, offering long-term visibility and accuracy in identifying fake accounts. The implementation of advanced fingerprinting technology helps gambling platforms maintain integrity by distinguishing between legitimate and fraudulent users, thereby protecting both their promotional investments and their user base.

Google's new beta feature, Device Recall, within the Play Integrity API, aims to assist developers in identifying repeat abuse on Android devices even after a reset, but it faces several limitations that might restrict its effectiveness. While it offers persistence, privacy-preserving features, and easy integration for Android-first teams, it is limited by its capacity to only provide three custom bits per device and its applicability solely within the Android ecosystem, excluding web, iOS, or regions where Google services are restricted. Fingerprint, a company specializing in device identification, argues that while Device Recall is a useful tool for basic abuse prevention, it lacks the comprehensive insights and cross-platform capabilities necessary for more nuanced fraud detection. Fingerprint's solutions offer broader device intelligence, including cross-platform identification and deeper insights, allowing for a more detailed understanding of device-based abuse and user behavior. Ultimately, Device Recall is seen as a complementary tool to broader solutions like Fingerprint, which offer more flexibility and accuracy for teams requiring a more holistic approach to fraud prevention.

New account fraud, a prevalent challenge for banks and fintechs, involves the creation of multiple accounts using false or stolen information to exploit financial systems, resulting in significant financial and compliance risks. Unlike account takeover attacks, new account fraud is often less detectable and offers fraudsters a relatively low-risk, high-reward opportunity to gain unauthorized access to funds. The advent of generative AI, the availability of stolen credentials on the dark web, and the use of sophisticated bots have made it easier for fraudsters, including teenagers and young adults, to engage in this type of fraud. The impact on financial institutions includes monetary losses, reputational damage, compliance risks, and restricted growth. However, fintechs are employing strategies like multi-factor authentication, machine learning, blocklists, and advanced device intelligence platforms to combat this fraud. These measures aim to identify suspicious behavior and prevent the creation of fraudulent accounts by leveraging techniques such as device fingerprinting and anomaly detection during the sign-up process.