E-commerce fraud detection with device fingerprinting

E-commerce fraud comes in many shapes (promo abuse, card testing, fake accounts, account takeover), but most of it has one thing in common: a small number of people pretending to be many customers. A visitor ID helps you see that, because it stays the same when someone clears cookies, switches email addresses or connects through a VPN.

Promo abuse

One person opens 50 accounts to redeem a "20% off your first order" code 50 times. Every account has a different email address, but they come from the same browser. Identify the browser at signup and send the visitor ID along:

import { TraceTail } from '@tracetail/js';

const tracetail = new TraceTail({ apiKey: 'YOUR_API_KEY', endpoint: 'https://tracetail.io/api' });
const { visitorId } = await tracetail.generateFingerprint();

await fetch('/api/signup', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email, visitorId }),
});

On your server, count accounts per visitor ID. If one ID has opened several accounts in the past month, hold the welcome offer for review.

Card testing

People with stolen card numbers test them with small purchases, often from one machine, card after card. Count distinct cards per visitor ID:

// Your backend: many different cards from one browser in a day is a red flag.
async function cardTestingRisk(visitorId) {
  const cards = await db.payments.distinctCardFingerprints({ visitorId, since: hoursAgo(24) });
  return cards.length > 5 ? 'high' : 'low';
}

Account takeover

A sign-in from a device the account has never used, followed by a change to the shipping address, deserves a second factor before the order ships.

Review manipulation

Several "different customers" reviewing the same product from one browser is easy to see once reviews carry a visitor ID.

What a visitor ID won't catch

• Fraud on the real customer's device, for example when someone is talked into placing an order themselves.
• Organized rings where each member uses their own device.
• Anti-detect browsers that generate a fresh fingerprint for every profile. They make abuse more expensive, not impossible.
• Forged IDs. The visitor ID is computed in the visitor's browser and sent by your own page, so treat it as a strong signal rather than proof: an attacker who controls their browser can send any ID they like, including one they learned from a victim.

A practical rollout

1. Instrument key moments: signup, sign-in, checkout and review submission.
2. Link IDs to what happened: visitor ID to accounts, to payment methods, to promo codes.
3. Set thresholds, for example three or more accounts from one device in a week for review, five or more cards in a day to block checkout, and a new device plus a changed shipping address for re-authentication.
4. Alert first, automate later, once you trust the thresholds.

TraceTail identifies returning visitors with 99.6% accuracy and flags automated browsers. The SDK is small, computes the ID in milliseconds and doesn't slow down checkout. TraceTail's first 1,000 identification requests each month are free, with no credit card; after that it's $0.10 per 1,000.

Read the docs or see the live demo.