FraudEG Device Intelligence: Fingerprinting and Bots

Device intelligence is FraudEG’s layer of protection that runs before a user ever submits a transaction. By collecting and analyzing device attributes the moment a session begins, FraudEG builds a persistent device fingerprint — a stable identifier for the device that persists across sessions even when cookies are cleared. This fingerprint feeds directly into the transaction risk score and surfaces device-level signals that indicate bots, emulators, account takeover tooling, and other automated threats.

What FraudEG Collects

FraudEG gathers a broad set of device attributes to construct each fingerprint:

Attribute Category	Examples
Browser / app attributes	User-agent, browser version, installed fonts, canvas rendering, WebGL renderer
Hardware fingerprint	Screen resolution, CPU core count, memory size, touch support
IP reputation	ISP, ASN, data center detection, known malicious IP ranges
Proxy / VPN detection	Known VPN exit nodes, datacenter IPs, Tor exit relays
Bot signals	Headless browser indicators, automation framework artifacts (Selenium, Puppeteer)
Emulator detection	Android/iOS emulator artifacts, virtual machine indicators

None of these attributes are personally identifiable on their own. FraudEG combines them into a probabilistic fingerprint that identifies the device without relying on cookies or device IDs that users can easily reset.

Device Sessions

A device session ties a user’s device fingerprint to a specific visit on your application. Create a device session at the start of each critical user flow (login, checkout, account settings) and attach the returned session_id to your transaction scoring request. This links the device intelligence data collected during the session to the transaction FraudEG scores.

Creating a Device Session

<script>
  window.FraudEG = window.FraudEG || {};
  window.FraudEG.apiKey = 'feg_test_pk_xxxxxxxxxxxx';
</script>
<script src="https://cdn.fraudeg.com/v1/device.js" async></script>

curl -X POST https://api.fraudeg.com/v1/device/session \
  -H "Authorization: Bearer feg_test_sk_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "page_url": "https://yourapp.com/checkout",
    "user_id": "usr_8f3k2p"
  }'

After the JavaScript snippet loads, it automatically collects device attributes and posts them to FraudEG. The snippet exposes a FraudEG.getSessionId() method you can call client-side to retrieve the session_id, which you then pass to your backend to include in transaction scoring requests.

// After the snippet has loaded
const sessionId = await window.FraudEG.getSessionId();

// Pass sessionId to your backend alongside the transaction
await submitCheckout({ sessionId, cartId: 'cart_xxx' });

Device Trust Score

FraudEG computes a device trust score (0–100, where 100 is fully trusted) for each session. This score contributes directly to the overall transaction risk score. A low device trust score elevates the transaction score even if other signals appear normal — for example, a known user logging in from a fresh emulator with a VPN active will see a higher transaction risk score than usual.

Device Signals

The following device-level signals appear in the signals array of transaction responses:

Signal	Meaning
`device_trusted`	The device has a positive history and matches the user’s known device profile.
`new_device`	FraudEG has not seen this device associated with this user before.
`bot_detected`	Headless browser or automation framework artifacts found in the session.
`emulator_detected`	The session originated from a software-emulated device environment.
`vpn_detected`	The device’s IP resolves to a known VPN or proxy service.
`ip_datacenter`	Traffic originates from a cloud or datacenter IP rather than a residential or mobile network.
`device_compromised`	The device fingerprint matches a fingerprint previously associated with confirmed fraud.

Web Integration

Place the JavaScript snippet in the <head> of every page that precedes a critical user action — login, checkout, account update, and password reset pages are the most important. The snippet is lightweight (<10 KB gzipped) and loads asynchronously so it does not affect your page load performance.

<!DOCTYPE html>
<html>
  <head>
    <title>Checkout</title>
    <!-- FraudEG Device Intelligence -->
    <script>
      window.FraudEG = window.FraudEG || {};
      window.FraudEG.apiKey = 'feg_test_pk_xxxxxxxxxxxx';
    </script>
    <script src="https://cdn.fraudeg.com/v1/device.js" async></script>
  </head>
  <body>
    <!-- your checkout UI -->
  </body>
</html>

Mobile SDK

For native iOS and Android applications, use the FraudEG mobile SDKs instead of the JavaScript snippet. The mobile SDKs collect platform-specific device attributes (hardware identifiers, OS version, jailbreak/root detection) and create device sessions using the same POST /v1/device/session API. Contact FraudEG support to request the mobile SDK documentation for your platform.

Privacy and Data Handling

FraudEG processes device attributes for fraud detection purposes only and does not sell or share device data with third parties. Device fingerprints are stored as cryptographic hashes — the raw attribute values used to build the fingerprint are discarded after processing.

Regulation	FraudEG Approach
GDPR	Device data is processed under legitimate interest for fraud prevention. Data is stored in EU regions for EU-origin traffic. Deletion requests are honored within 30 days.
CCPA	FraudEG does not sell personal information. Device attributes are classified as fraud-prevention operational data.
PSD2	Device intelligence contributes to Strong Customer Authentication (SCA) risk analysis under the transaction risk analysis (TRA) exemption.

Do not rely on device signals alone to make block decisions. A vpn_detected or new_device signal on its own does not confirm fraud — many legitimate users browse with VPNs or access your app from a new device. Always combine device signals with behavioral, transactional, and velocity signals through the risk rules engine for accurate, low-false-positive decisioning.

Get Started

Core Concepts

Guides

Platform

FraudEG Device Intelligence: Fingerprinting and Bots

What FraudEG Collects

Device Sessions

Creating a Device Session

Device Trust Score

Device Signals

Web Integration

Mobile SDK

Privacy and Data Handling

​What FraudEG Collects

​Device Sessions

​Creating a Device Session

​Device Trust Score

​Device Signals

​Web Integration

​Mobile SDK

​Privacy and Data Handling

What FraudEG Collects

Device Sessions

Creating a Device Session

Device Trust Score

Device Signals

Web Integration

Mobile SDK

Privacy and Data Handling