Device fingerprinting explained: what it can and cannot tell you about repeat signups

What a device fingerprint actually is

A device fingerprint is a set of characteristics that a browser exposes while loading a page: screen size, time zone, language, installed fonts, graphics hardware details, and how the browser renders certain drawings. Each value is ordinary on its own. Combined, they often describe a specific browser on a specific machine.

Fingerprints are usually paired with a stored identifier, such as a value saved in the browser's storage. If the stored identifier is still there, recognising a returning device is easy. If someone clears storage or opens a private window, the fingerprint is what remains.

Why it is useful against credit farming

Most farmers do not own a warehouse of phones. They use one or a few machines and create accounts in a loop: sign up, use the free credits, clear cookies, change the email, sign up again. Email changes are free, but the hardware stays the same, so the device is often the strongest link between accounts.

Device signals are also hard to fake consistently. Spoofing tools change some values but forget others, which creates combinations that real browsers never produce. That inconsistency is itself a useful signal.

Where fingerprints fail

Identical hardware is common. A school lab, a company that buys the same laptop model for everyone, or a popular phone model with default settings can produce near-identical fingerprints for different people. Treating every fingerprint match as the same person would merge strangers.

That is why Unfarm only re-attaches a fingerprint-only match to an existing device when the network also matches closely and the visit is recent. Otherwise it records a possible link worth zero points, visible to analysts but never used alone to block anyone.

Fingerprints also drift. Browser updates, new monitors or a changed time zone shift some values. A good system tolerates small changes rather than treating each as a new device.

Private windows and cleared storage

A private window by itself is not evidence of fraud. Many people browse privately out of habit or for privacy reasons. Penalising it would mostly hurt careful, honest users.

What matters is the pattern: the same hardware returning with storage cleared, followed by a new account with a new email. That combination is meaningful. A single private visit is not, and in Unfarm it scores zero on its own.

Privacy and fairness

Fingerprinting for fraud prevention should be limited to that purpose. Do not use the same data for ad targeting or cross-site tracking. Hash identifiers where possible, keep retention reasonable, and mention fraud prevention in your privacy policy. In many jurisdictions, preventing fraud is a recognised legitimate interest, but you still need to be transparent about it.

Fairness matters as much as privacy. Every decision based on device data should list the reason in plain language, so a support agent can see that a block came from three accounts on one device in a week, not from an opaque score.

How to use device signals well

Combine, do not rely. Use the device together with mailbox normalisation, network, timing and behaviour. Prefer review over block when only one signal fires. Count links over a time window rather than forever, so a reused laptop bought second-hand is not punished years later. And always keep the evidence visible, so mistakes can be corrected quickly.