How does device fingerprinting work?
A script in the checkout page or a mobile SDK reads attributes of the device and browser and combines them. The UK Information Commissioner’s Office describes fingerprinting as collecting pieces of information about a device’s software or hardware that can be combined to uniquely identify a particular device. No single attribute is unique, but together they usually point to one device.
How is it used in payments?
Fraud tools use it to link activity: many cards tried from one device suggests card testing, and a returning customer on a known device looks safer. 3-D Secure relies on the same idea. Stripe says the device data it sends helps the issuer recognise repeat payments from the same device and assess overall risk. Adyen’s API reference requires the browser’s user agent and accept header for browser-based 3-D Secure 2, and the customer’s IP address for Visa and JCB transactions. As an illustrative example: a store sees 300 card attempts in an hour, 240 of them from four devices. Blocking those four devices stops 80% of the attack without touching other customers.
What are the limits?
Fingerprints are probabilistic. Devices change, privacy-focused browsers hide or vary attributes, and identical phones on a shared network can look alike. Privacy law applies too. In the UK, the ICO says preventing or detecting fraud may fall within the strictly necessary exception, provided the data is used only for that purpose, while fingerprinting for advertising needs consent. Rules differ by country.
Where does Omno use it?
Omno does not fingerprint devices. Its risk controls score every transaction for fraud and apply the merchant’s customer rules, customer blocking and card blocking. 3-D Secure is performed by the connected PSP, browser information can be a routing condition, and a Direct Link payment request carries the customer’s browser data. Merchants that use a dedicated fraud provider can pass its results to Omno through customer groups, which eligibility rules use to decide which providers a customer can reach.