Overview
Today, the prevalence of identity theft and hackers has meant that it is much harder to verify that the person you are doing business with is who they say they are. That new customer could be a compromised computer transacting on behalf of a sophisticated eastern European crime gang or an opportunistic thief that has lifted personal details from Facebook. It’s clear that online identity verification is a significant challenge and concern to all business owners. In this Knol, Learn what Device Fingerprinting is; Why it valuable for online credit card and account login fraud protection; Limitations; Fraud detection techniques using Device Fingerprinting; Methods for Device Fingerprint collection and generation, and things to consider during implementation .
What is Device Fingerprinting?
Device Fingerprinting is the measurement of anonymous browser, operating system and connection attributes in order to generate a risk profile of a device in real-time. Device Fingerprinting (sometimes called PC Fingerprinting) is part of a broader class of technologies called Device Identification and Analytics used to determine whether the computer you are doing business with should be trusted.
Why is Device Fingerprinting Valuable?
With personal identity information such as credit cards and login passwords now a commodity on the black market, companies need to look to alternative methods for verifying identities and transactions online. This problem is compounded by the fact that fraudsters now routinely evade IP Address Blacklisting and IP Address Geolocation tools using proxies. Proxies can be special purpose servers used to masquerade a fraudsters real IP Address, but are now increasingly likely to be one of the millions of compromised computers, also called botnets , that are under the control of criminal gangs. Device Fingerprinting is a powerful tool for recognizing a returning fraudster even if they change their name, IP Address or cookies.
Device Fingerprinting and Fraud Prevention
A Device Fingerprint is a valuable tool because it enables a fraudster’s device to be recognized even when they change their identity through the use of proxies and stolen credit card or account password information. Depending on the business, typically four main strategies are used to leverage a Device Fingerprint to combat fraud.
1. Device Velocity – when fraudsters find a hole in your defenses they will try to extract the maximum value as fast as they can. Creating velocity filters based on a Device Fingerprint will enable you to minimize fraud costs even when names, credit card details and IP Addresses are changed.
2. Transaction linking – a Device Fingerprint is a powerful tool for finding related transactions either as an identifier in itself or as a means of finding transactions with related characteristics e.g. finding related transactions performed from the same ISP and location.
Device Fingerprinting Trade-offs
The tradeoffs that need to be considered are the uniqueness, persistence, resistance, friction and fit of the Device Fingerprinting approach.
1. Uniqueness is the measure of how accurately and confidently you can identify a return computer and differentiate it from other computers on the internet. It depends on the amount of entropy, or information, that is contained in the fingerprint. For example, screen-resolution by itself is does not represent a unique fingerprint while the MAC address of a computer is generally considered unique.
2. Persistence is the measure of how long you can expect to uniquely identify a device based on the fingerprint technique used. For example, the operating system would be a persistent fingerprint attribute, while javascript version used by the browser would change more frequently.
3. Resistance is a measure of how well the Device Fingerprinting technique stands up to tampering by a hacker or fraudster. For example, a browser cookie may be unique, but it is easy to delete or copy.
4. Friction: is a measure of the disruption to the customer's experience. For example, requiring a user to have a hardware token or to download software in order to uniquely identify them is inconvenience and not practical for most online businesses. Ideally the Device Fingerprinting method should be transparent to the end user
5. Fit is the measure of how seamlessly the Device Fingerprinting technology integrates with your business and technology requirements. Is there server technology that needs to be installed? Is the technology scalable? How easily does it integrate with your organization's existing decision systems? What is the increased overhead placed on your infrastructure? Is there any latency or delay introduced
Device Fingerprinting methods
The two major types of Device Fingerprinting methods are client-based and server-based Remote Device Profiling solutions.
Client-based Device Fingerprinting
Client-based methods require installing a software executable on an end computer. The advantage of client-based methods is that they have access to otherwise hidden operating system information such as the hard drive serial number and MAC address of the network card. This information is highly unique, persistent and harder to tamper with. The major disadvantage of this method that excludes it from practical use in most ecommerce transactions is that the process requires some action or permission on behalf of the user. This may be ok if you are a bank, but not if you are an ecommerce website, media or retail financial services business. The other issue is of course that most corporate computers won’t allow anything to be installed from an external website.
Remote Device Profiling
Comments
Write New Comment ▼
Write New Comment
Sorry! This knol's owner(s) have blocked you from editing, making suggestions, or commenting here.