Device fingerprinting
Also called device intelligence, device ID
Device fingerprinting identifies a phone, tablet or computer from a combination of its technical attributes, such as operating system, browser version, screen size, fonts, time zone and network details. Banks and payment firms use the resulting fingerprint to recognise returning customers and to flag devices linked to fraud, account takeover or multiple identities.
How it works
When a customer opens an app or website, a script or software development kit collects dozens of attributes from the device and its connection. These are combined into an identifier that stays fairly stable even when cookies are cleared. The firm checks whether the device is known for this customer, whether it has been seen on other accounts, and whether it shows signs of emulators, rooting, remote access tools or location masking.
The result feeds a fraud risk score at login, onboarding and payment. A trusted device can support a lower-friction journey, while a new or risky device triggers step-up authentication or manual review. One device linked to many applications points to synthetic identities or mule networks. Because fingerprinting reads information from the user's device, privacy law applies: in the EU and UK it needs consent unless it is strictly necessary, for example to prevent fraud or secure the service.
The rules
Requires consent to store or access information on a user's device unless it is strictly necessary to provide a service the user requested; the EDPB treats fingerprinting as within scope.
Anyone storing or accessing information on a user's terminal equipment in the EURequires transaction monitoring mechanisms that detect unauthorised or fraudulent payments, taking into account risk factors including signs of malware and abnormal use of the access device.
Payment service providers in the EURequires consent to store or access information on a device, with exceptions for what is strictly necessary for a requested service, including preventing or detecting fraud and authenticating the user.
Anyone storing or accessing information on a user's device in the UKCommon questions
Is device fingerprinting the same as a cookie?
No. A cookie is a file stored on the device. A fingerprint is calculated from attributes the device already exposes, so it survives cleared cookies and private browsing. Privacy law covers both because both involve accessing information on the device.
Do firms need consent for device fingerprinting?
In the EU and UK, consent is needed unless the access is strictly necessary for a service the user asked for. UK law now lists fraud prevention and user authentication as examples of strictly necessary purposes. Using the same data for marketing needs consent.
How does device fingerprinting catch fraud?
It recognises when a login comes from a device the customer has never used, when one device is behind many accounts or applications, and when a device hides its identity with emulators or proxies. These are common signs of account takeover, mule networks and synthetic identities.
