Device fingerprinting is software that recognises the same phone or browser each time it comes back to an app or a website, even under a new account. It is also called device intelligence. It is used to stop one fraudster from opening many accounts, and to notice when a known customer's login comes from an unfamiliar device.
A fingerprint here is a set of facts about the device that, taken together, are nearly unique. On a phone, these include the model, the operating system version, the screen size, the language and time zone, the installed fonts and many hardware details. In a browser, they include the way the browser draws a hidden image, which differs slightly from one graphics chip to another. No single fact identifies a device. But together, hundreds of facts usually do. The software turns them into one stable device ID. The ID stays the same when the user deletes the app and installs it again, or clears the browser's cookies.
The software also looks for signs of fraud on the device itself. Is the app running on an emulator, a program on a computer that pretends to be a phone? Is the phone rooted, which means that its built-in protections have been removed? Is an app installed that fakes the phone's location? Is a screen-sharing app running, which a scammer might use to watch the screen?
Say a ride-hailing app in Lucknow offers ₹150 off each new user's first ride. In one week, 380 new accounts claim the offer. Each has a different phone number and a different name. But device fingerprinting shows that they come from only 12 devices, and nine of these are emulators running on two computers. The app withdraws the offer from all 380 accounts, and blocks the 12 devices from creating new accounts. Without fingerprinting, each new SIM card would have looked like a new customer.
Banks use the same signal against larger frauds. A phone that has opened accounts in many names is a warning sign for mule account detection, which looks for accounts used to pass stolen money along. The device ID also goes with every payment to payment fraud detection, and with every new application to synthetic identity fraud detection.
Device fingerprinting is close to bot management, which tells real users apart from automated scripts on a website. Fingerprinting identifies which device is there. Bot management decides whether a person or a program is using it. Fingerprinting is also different from behavioural biometrics, which recognises how a person uses the device, not the device itself.
Privacy law limits this work. India's DPDP Act requires a company to state why it collects such data, and to use the data only for that purpose, as data protection law explains. Most of the Act's duties, including this one, apply from 13 May 2027.