Online payment fraud isn’t just a growing problem; it’s a crafty, shape-shifting challenge for businesses of all sizes. From stolen credit cards to chargeback abuse, criminals have developed countless tactics to exploit online payments, and many of them keep coming back for more.
It’s important to recognize these repeat offenders, and it’s not enough to just keep track of user accounts. Criminals can easily change names or emails or create multiple new accounts. For platforms that allow guest checkouts or minimal verification, the problem can be even worse since criminals don’t need to create an account to wreak havoc.
To outsmart them, payment platforms need better ways to identify returning fraudsters, no matter how well they try to hide. This means combining a range of methods, from using IP addresses and cookies to recognizing the devices themselves. Understanding the strengths and weaknesses of each method is key to building a robust defense against repeat payment fraud.
Prevalent Payment Fraud Tactics
Payment fraud comes in many forms, and each one is designed to evade security measures and exploit vulnerabilities. Stolen credit cards are one of the most common tools in a fraudster’s kit. They’re quick, profitable, and often leave the victim and business scrambling to pick up the pieces. Then there’s card cracking, where criminals test a series of card numbers and security codes until they find a combination that works. These methods often happen at scale, draining funds before anyone realizes what’s going on.
Account takeover is another tactic used to gain control of legitimate user accounts and make unauthorized purchases. When the actual account owner discovers these fraudulent charges, they dispute them, leading to chargebacks. This results in lost revenue, fines, and damages to the business’s reputation with payment processors.
While these and other types of fraud are harmful enough on their own, repeat offenders can be a real nightmare. They exploit weaknesses over and over again, adapting to avoid detection, with smaller businesses that lack strong security being especially vulnerable.
Common Methods to Identify Repeat Fraudsters
Identifying a criminal determined to stay under the radar is easier said than done. They’re clever, and while conventional identification methods can be helpful, each has its own strengths and weaknesses.
IP address tracking
IP addresses are often the first line of defense. Tracking an IP address is relatively simple to implement and can provide useful geographic insights that help identify unusual locations or suspicious activity patterns. However, criminals know this, and IP tracking is easily circumvented. With the widespread use of VPNs, proxies, and mobile networks that assign frequently changing dynamic IP addresses, IP addresses are far from a reliable indicator of identity.
Cookies and local storage
Cookies and local storage have long been used to identify users. When someone returns to your site, a stored cookie can link that visitor to past activity, even if they aren’t logged in. This can be an effective way to flag suspicious behavior across visits. However, this method has significant downsides. Criminals can easily clear cookies, use privacy-focused browsers that block them, or simply switch to incognito mode, severing the link. Many legitimate, privacy-conscious users also clear their cookies regularly, making this approach increasingly unreliable.
User account patterns
For sites that require user accounts, monitoring behavioral patterns is another way to spot suspicious activity. Accounts that show a high number of failed login attempts, unusual purchasing habits, or odd geographic locations can be flagged for potential fraud. This works well in scenarios where accounts are necessary, but it quickly falls apart when criminals operate without creating an account or when they use disposable emails and other easily swapped credentials. Essentially, account-based monitoring only works if you have accounts to track, and many criminals are skilled at creating multiple, seemingly legitimate ones to evade detection.
Device Fingerprinting: A Better Solution to Identify Fraudsters
Criminals are experts at covering their tracks, but there is an additional way to recognize them even when they’re trying to hide. Instead of relying on a single point of identification, like a cookie or IP address, device fingerprinting collects various browser and device attributes, such as screen resolution, installed fonts, operating system, and browser version, to create a unique “fingerprint” for each visitor. These attributes are harder to modify, allowing businesses to identify devices across sessions, even if users clear their cookies, use incognito mode, or change their IP address.
Device fingerprinting’s resilience to evasion tactics makes it particularly effective at device recognition and identifying repeat fraudsters. By creating a consistent identifier, it can link fraudulent activity across different accounts or attempts, making it harder for offenders to stay hidden. This approach adds a crucial layer of defense that is far more tamper-resistant than traditional methods.
Businesses can develop their own device fingerprinting solutions by combining techniques like canvas fingerprinting, audio fingerprinting, and WebGL fingerprinting with browser and device properties. Or they can choose from off[1]the-shelf solutions that provide ready-to-use identification capabilities. Both paths can enhance fraud detection efforts and improve overall security.
Maximizing Device Recognition to Combat Payment Fraud
So you can recognize your visitors—now what? Here’s how device recognition can help fight different types of payment-related fraud effectively.
Preventing stolen credit card testing (card cracking)
Device recognition can help detect users making multiple rapid payment attempts from the same device, even if the user uses multiple accounts, changes their IP address, or uses incognito mode. By flagging such devices early, businesses can prevent the successful validation of stolen card details and block card cracking before significant damage is done.
Blocking account takeovers and chargeback abuse
Criminals often hijack user accounts to make unauthorized purchases, and traditional defenses relying on credentials alone become useless once those credentials are compromised. While adding multi-factor authentication (MFA) can help, it also risks frustrating users and driving away legitimate transactions. Device recognition addresses this by verifying whether the device matches the account’s known devices, allowing businesses to prevent account takeovers and chargeback fraud without adding unnecessary friction for genuine customers.
Stopping new account fraud
When criminals try to hide behind new accounts, device recognition can be an effective way to catch them. New account fraud often involves creating accounts to exploit offers or disguise fraudulent payments as if they come from new, unrelated users. By linking a device to multiple accounts or repeated new account attempts, businesses can flag risky registrations and prompt additional verification or deny account creation. This makes it much harder for repeat offenders to bypass detection by simply creating new accounts.
Identifying repeat fraudsters
Device recognition enables businesses to create effective high-risk watchlists for devices involved in past fraudulent behavior. When a high-risk device returns, even with a new account, the business can automatically flag the activity for further review, prompt for additional verification, or deny transactions altogether.
This proactive approach ensures that criminals can’t simply change surface-level details to evade detection, making repeat fraud attempts significantly harder.
Best Practices for Using Device Recognition
To get the most out of device recognition, it’s important to integrate it with your other defenses. Combining it with behavioral analysis helps detect anomalies in user behavior, such as sudden changes in purchase habits or geographic locations. Implementing multi-layered defenses, including bot activity monitoring, velocity checks, and user activity analysis, provides a more comprehensive security approach. This layered strategy is key to preventing criminals from exploiting weak points and ensures repeat offenders have fewer opportunities to strike again.
Winning the Battle Against Payment Fraud
Recognizing repeat fraudsters is invaluable for staying ahead of payment fraud. Techniques like IP tracking, cookies, and account analysis provide a good foundation. However, accurate device recognition further strengthens these efforts by offering a persistent and comprehensive way to identify malicious actors, allowing businesses to detect and respond to risks in real time. By leveraging the power of these techniques, businesses can better protect themselves and their customers, reducing financial losses and maintaining trust. Payment fraud will always be a challenge, but with a well-rounded, proactive approach, businesses can effectively meet it head-on.
