Device intelligence and checkout fraud: balancing trust and conversion

At a glance

What this is: This article argues that device intelligence can help e-commerce teams distinguish legitimate buyers from fraudsters when legacy checkout controls are too shallow or too disruptive.

Why it matters: It matters because fraud teams need stronger identity and risk signals without increasing false declines, and the same trust problem affects merchants, marketplaces, and identity programmes that rely on conversion-sensitive decisions.

By the numbers:

• Regulators in Australia flagged more than 140 ghost stores in a single year.
• Global chargeback volume is expected to grow 24% from 2025 to 2028.
• Merchants reject 6% of all e-commerce orders, but between 2 and 10% of those are actually legitimate orders.
• False declines cost $81 billion in lost revenue per year.

Context

Digital commerce fraud is increasingly a trust problem, not just a transaction problem. Platforms have to preserve conversion while distinguishing legitimate returning buyers from fraudsters, and shallow signals like IP address, cookies, and device resets are no longer enough to support that decision reliably.

The identity angle is real even though this is not a classic IAM article. Device intelligence functions as a behavioral trust layer for customer identity decisions, while also helping platforms spot repeat abuse, ghost stores, and first-party fraud without adding friction that drives abandonment.

Key questions

Q: What breaks when fraud controls rely on IP addresses and cookies alone?

A: They break when legitimate users change networks, clear browser state, or travel, because the controls confuse normal behaviour for fraud. That creates false declines, abandoned carts, and weak detection of repeat abusers. Stronger programmes use persistent device, behavioural, and network signals together so risk decisions reflect continuity rather than one session snapshot.

Q: Why do persistent device signals reduce false declines in e-commerce?

A: Persistent device signals help reconnect a returning buyer across browser resets, new IP addresses, and private browsing sessions. That gives fraud systems more context before they block an order, which lowers the chance of rejecting a genuine customer while still supporting risk-based review where behaviour looks unusual.

Q: How can security teams separate merchant fraud from first-party abuse?

A: Use different controls for seller onboarding, checkout risk, and dispute handling. Merchant fraud is usually a legitimacy problem before conversion, while first-party abuse is a post-purchase dispute pattern, so the data, thresholds, and response paths should not be merged into one generic fraud queue.

Q: What governance trade-off should checkout teams manage between conversion and fraud control?

A: They need to minimise friction without making the trust model so permissive that fraud losses rise. The practical balance is risk-based decisioning, where high-confidence buyers move quickly and uncertain cases receive added review or step-up checks. That approach protects revenue while reducing unnecessary customer abandonment.

Technical breakdown

Why checkout rules fail when signals are too shallow

Traditional fraud controls often rely on static or easily reset signals such as IP addresses, cookies, and browser state. Those inputs are weak because they can change for benign reasons, such as travel or private browsing, and they are also easy for fraudsters to evade. The result is poor discrimination between legitimate users and risky actors, especially when the checkout flow is designed to minimise friction. In practice, the technical weakness is not that rules exist, but that the signal set is too narrow and too mutable to support reliable risk scoring across sessions and devices.

Practical implication: expand beyond resettable signals before tightening checkout rules.

How persistent device intelligence changes buyer recognition

Device intelligence builds a more durable visitor profile by combining many real-time signals from the device, network, and behaviour layers. When a browser clears cookies, changes IP address, or uses private browsing, the underlying pattern can still remain recognisable if enough attributes stay stable. That persistence matters because it lets fraud systems connect repeated activity across sessions without forcing a hard stop at checkout. The core architectural shift is from single-signal rule evaluation to probabilistic identity continuity, which is more useful when the business needs both speed and discrimination.

Practical implication: treat device intelligence as a continuity layer inside fraud scoring, not as a standalone gate.

Why ghost stores and friendly fraud need different controls

Ghost stores are merchant impersonation operations, while first-party abuse is a buyer-side dispute problem. Both damage marketplace economics, but they fail differently. Ghost stores exploit onboarding and trust formation, so the control objective is early merchant risk discrimination. Friendly fraud happens after a legitimate purchase, so the control objective is repeat-pattern detection and dispute intelligence. A single checkout rule set cannot address both with equal precision. That is why platforms increasingly need risk controls that separate merchant legitimacy, buyer continuity, and post-transaction abuse into distinct decision paths.

Practical implication: split merchant onboarding, checkout, and dispute controls instead of forcing one model to handle all fraud types.

Threat narrative

Attacker objective: The attacker objective is to monetise fraudulent commerce activity while avoiding detection, either by impersonating merchants or by abusing legitimate purchase and dispute flows.

1. Entry occurs when fraudsters create ghost stores that mimic trusted sellers with branding, product photography, and fake urgency tactics.
2. Credentialed or repeated abuse follows when the same actors exploit weak checkout signals, browser resets, or chargeback processes to continue activity unnoticed.
3. Impact is manifested through false declines, chargeback losses, reputational damage, and the erosion of trust between buyers, merchants, and the platform.

NHI Mgmt Group analysis

Checkout trust is becoming a decision-quality problem, not a binary fraud problem. The article shows that platforms lose money both when they let fraud through and when they block good customers. That makes signal quality, not just rule strictness, the real governance issue for fraud and identity teams. Practitioners should treat checkout trust as a measurable decision system, not a static control.

Device continuity is the named concept this article points to. Persistent device intelligence matters because checkout decisions need to recognise returning users across changing conditions without relying on fragile identifiers. That is a useful pattern for consumer trust, but it must be governed carefully so the model does not become a black box that hides false positives or unfair friction. Practitioners should demand explainable risk signals and review their decision thresholds.

Ghost store detection is an onboarding governance problem in disguise. Fraud teams often think of ghost stores as a marketplace abuse issue, but the underlying failure is allowing seller legitimacy to be inferred too late or too weakly. The same lesson applies to broader identity governance: if trust is not established at the right point in the lifecycle, downstream controls carry the entire burden. Practitioners should move legitimacy checks earlier in the merchant journey.

Friendly fraud exposes a lifecycle gap between legitimate purchase and dispute handling. The article’s first-party abuse examples show that a buyer can be authentic at checkout and still become a source of repeated loss later. That means fraud governance cannot stop at transaction approval. Practitioners should align dispute analytics, repeat-pattern detection, and customer history into the same control plane.

Conversion pressure is now part of fraud architecture. The article makes clear that hard blocking, while attractive in isolation, can directly damage revenue and retention. That does not mean controls should be softer; it means they need better context. Practitioners should optimise for risk-based friction, where the control adapts to confidence rather than applying the same threshold to every session.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Device continuity is becoming the practical trust layer for checkout. Platforms that still depend on resettable identifiers will keep oscillating between fraud loss and customer friction. The governance challenge is to use persistent device intelligence as a risk signal without turning it into a blunt denial mechanism.

Merchant legitimacy and buyer legitimacy are two different controls. When a platform treats ghost stores, first-party abuse, and false declines as the same problem, it usually overcorrects in at least one direction. The better operating model is to separate onboarding, transaction approval, and dispute intelligence so each control can be tuned to the failure mode it is meant to catch.

For practitioners

• Tighten seller onboarding trust checks Separate merchant onboarding from checkout scoring and verify new sellers before they can generate transactional trust. Use stronger legitimacy checks for stores that resemble established brands or use urgency-driven merchandising patterns.
• Replace shallow signals with persistent device intelligence Use device, network, and behavioural continuity to recognise returning buyers even when cookies are cleared or IP addresses change. Keep the model privacy-conscious and feed it into existing fraud workflows instead of making it a hard gate.
• Build a distinct first-party abuse workflow Track repeat chargeback actors separately from merchant fraud and checkout fraud so dispute abuse does not get lost inside general fraud scoring. Include customer history, dispute frequency, and recurrence after a successful claim.
• Measure false-decline impact Compare fraud block rates with downstream abandonment and legitimate-order rejection so your fraud controls are judged on both prevention and conversion. Use the Merchant Risk Council style of analysis to spot when rules are suppressing good buyers.

Key takeaways

• Checkout fraud controls fail when they depend too heavily on shallow identifiers that legitimate users can change and fraudsters can evade.
• The article’s evidence points to material scale, including more than 140 ghost stores flagged in Australia and $81 billion in annual false-decline losses.
• Practitioners should use persistent, privacy-conscious device intelligence alongside existing fraud tools to reduce false declines and catch repeat abuse earlier.

Key terms

• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
• False decline: A false decline is a legitimate transaction that is rejected because the fraud controls interpret it as risky. It matters because the operational cost is not limited to one lost sale. It can also damage customer trust, reduce retention, and distort fraud programme metrics.
• First-Party Misuse: First-party misuse is a chargeback dispute filed by the legitimate cardholder after making the purchase themselves. It may be accidental, such as forgetting a transaction, or intentional, such as trying to keep the goods and recover the money. The key issue is that the identity is genuine even when the dispute is not.
• Ghost Store: A ghost store is a fraudulent online storefront that imitates a legitimate seller to deceive buyers and platforms. It usually combines copied branding, fake urgency, and professional-looking product pages, which makes early verification and behavioural vetting essential to stop downstream payment and trust abuse.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It is designed for practitioners who need to connect identity controls to broader security programmes without adding unnecessary friction.