Device intelligence gaps are widening fraud exposure in digital channels

At a glance

What this is: This is a fraud prevention survey summary showing that device intelligence gaps, not just attack volume, are weakening account takeover defence and making coordinated fraud harder to spot.

Why it matters: Fraud, IAM, and PAM teams should treat device intelligence as a governance control because weak device recognition blurs the line between legitimate users, shared access, and organised fraud activity.

By the numbers:

• The survey covered 216 merchants at MRC and 178 attendees at Identiverse.
• At MRC, 42% of respondents cited detecting devices used by fraud rings as a key challenge.
• Among MRC respondents, 33% reported using in-house solutions built from various data points without comprehensive correlation capabilities.
• Another 18% of MRC respondents said they have no device intelligence solution in place at all.

Context

Device intelligence is the set of methods used to recognise, score, and correlate devices across sessions, accounts, and behaviour patterns. In this article, Arkose Labs argues that traditional device identification is no longer keeping pace with fraud rings using proxies, emulation, and coordinated identities.

The governance gap is broader than fraud detection alone. When device signals cannot reliably separate legitimate customer behaviour from adversarial activity, fraud teams lose confidence in both step-up decisions and manual review outcomes, especially in high-volume digital channels.

That makes device intelligence part of identity governance rather than a narrow anti-abuse control. It influences how organisations distinguish account sharing, account takeover, and false positives at scale.

Key questions

Q: What breaks when device intelligence cannot recognise repeat devices reliably?

A: Fraud teams lose the ability to separate legitimate repeat behaviour from coordinated abuse, so account takeover, chargebacks, and shared-account fraud all look more similar than they should. The result is more manual review, slower decisions, and a weaker security posture across digital channels.

Q: Why does weak device history make fraud detection less effective?

A: Without historical correlation, a current session has little context. That makes it hard to tell whether a device is genuinely new, recently changed, or part of a ring that is rotating identities across many accounts. The control fails because identity patterns disappear between sessions.

Q: What are the signs that device intelligence is failing in practice?

A: Look for heavy manual review, inconsistent outcomes, high false positives, and a growing gap between the number of flagged sessions and the number of useful decisions. If analysts cannot explain why one device is trusted and another is not, the control is too shallow to support scale.

Q: How should security teams balance fraud detection with customer experience when using device intelligence?

A: Security teams should tune device intelligence to reduce friction only where risk is low, then step up checks when signals suggest automation, spoofing, or account takeover. The goal is to combine high-signal detection with selective challenge rather than blanket blocking. That approach preserves conversion, reduces false positives, and keeps fraud controls aligned with business risk.

Technical breakdown

Why static device fingerprinting is breaking down

Static device fingerprinting depends on stable browser or device attributes, but modern fraud operations know how to change or imitate those markers. Residential proxies hide source location, emulation software alters fingerprints, and distributed fraud rings reuse credentials across many accounts. Once those signals are spoofed, a device profile becomes a weak proxy for trust. Effective device intelligence now has to fuse multiple dimensions, including behavioural patterns, network context, and historical correlation, rather than treating one fingerprint as a durable identity signal.

Practical implication: treat single-signal fingerprinting as an input, not a decision point, in fraud controls.

How historical correlation changes fraud detection

Historical correlation links a current session to prior device behaviour, account activity, and network characteristics. That matters because a new customer can resemble a fraudster using fresh credentials, while a fraud ring can make many accounts look individually normal. Without historical context, fraud teams default to manual review or blunt rules, both of which create delay and inconsistency. The technical shift is from identifying a device once to understanding whether its behaviour fits a longer pattern of legitimate use, shared access, or coordinated abuse.

Practical implication: preserve and correlate device history long enough to support account-level and ring-level analysis.

Why dual identifiers matter for privacy and decision quality

The article points to deterministic and probabilistic identifiers as complementary methods. Deterministic identifiers recognise a device that has been seen before through artifacts placed on the device, while probabilistic methods infer likelihood in real time without storing personal data. Used together, they help create a more complete risk profile while reducing blind spots created by either method alone. For fraud teams, the value is not elegance of model design, but whether the system can support accurate decisions without forcing every ambiguous event into manual review.

Practical implication: evaluate whether your device intelligence stack can support both repeat recognition and privacy-conscious inference.

Threat narrative

Attacker objective: The objective is to move fraudulent activity through trusted digital channels without triggering device-based controls.

1. Fraud rings begin with access from residential proxies, emulation tooling, or shared credentials that make the session look ordinary at first glance.
2. They then reuse or coordinate identities across many accounts, which lets identical device signatures and repeated behavioural patterns evade simplistic fingerprint checks.
3. The impact is account takeover, chargeback fraud, and potentially lateral abuse across customer accounts and digital services.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Device intelligence is now an identity governance control, not a fraud add-on. The article shows that fraud teams are no longer dealing with isolated transaction anomalies. They are dealing with identity ambiguity at the device layer, where recognition, tracking, and history determine whether access appears legitimate. That makes device intelligence part of the same governance stack that decides how confidence is established and how exceptions are handled.

Historical device context has become the missing control plane for fraud operations. The article repeatedly points to weak correlation, limited history, and manual review overload. Those are not separate operational inconveniences. They are symptoms of a programme that cannot maintain continuity between first seen, previously seen, and newly suspicious behaviour. Practitioners should treat that continuity as the control objective.

Device intelligence gaps expose a governance mismatch between customer convenience and adversarial scale. The article makes clear that travel, VPN use, shared devices, and new-customer behaviour all create legitimate ambiguity. Fraud rings exploit that ambiguity by operating at scale. The implication is that policy models built for low-volume exception handling no longer hold when adversarial reuse is industrialised.

Fraud teams need a stronger concept of identity blast radius. When one unidentified device can pivot into account takeover, chargebacks, or cross-account abuse, the question is no longer whether a session looks normal. It is how far a false trust decision can propagate before detection. That is an IAM and fraud governance problem together, not a point-solution tuning issue.

Deterministic recognition and probabilistic inference should be evaluated as complementary governance functions. The article indicates that teams need repeat recognition, behavioural correlation, and privacy-aware decisioning at once. The field is moving away from the false choice between rigid device IDs and opaque scoring. Practitioners should reframe the problem as whether the control stack can sustain evidence across sessions without collapsing into manual review.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Device intelligence gaps will increasingly be judged as identity governance failures. Fraud teams cannot rely on static fingerprints when adversaries can rotate proxies, spoof signatures, and coordinate across accounts. The practical shift is toward controls that preserve behaviour history and decision confidence across sessions.

Fraud operations need to move from device recognition to device continuity. The article makes clear that the real issue is not whether a device can be named once, but whether its behaviour can be followed over time. That change affects review queues, step-up policies, and the quality of ATO containment.

Device intelligence should be evaluated as part of the account takeover control stack. If it cannot inform decisions fast enough to distinguish legitimate users from fraud rings, it becomes a reporting layer rather than a security control. Practitioners should expect stronger correlation between device history, behavioural evidence, and response automation.

For practitioners

• Benchmark device recognition quality across real fraud scenarios Measure how often your current stack can distinguish legitimate repeat users, shared family devices, travel patterns, VPN use, and coordinated fraud ring behaviour.
• Correlate device history with account and network signals Join device characteristics to prior sessions, behavioural anomalies, and network context so investigators can see whether a device has changed risk posture over time.
• Reduce manual review dependence with clearer escalation rules Define when device intelligence should trigger step-up checks, when it should route to analyst review, and when it should block known fraud patterns outright.
• Test privacy-preserving identifiers against detection needs Validate whether probabilistic device intelligence can support fraud decisions without storing unnecessary personal data or breaking customer experience.
• Map account takeover paths to device-level blind spots Identify where weak device recognition could let one compromised session spread into chargebacks, shared-account abuse, or broader customer compromise.

Key takeaways

• Device intelligence weakness is no longer a narrow fraud tooling problem. It is a governance problem that affects how organisations recognise legitimate users, coordinated fraud rings, and account takeover attempts.
• The article's survey data shows broad operational strain, including outdated recognition, heavy manual review, and in-house tools that lack full correlation.
• Teams should prioritise device history, correlation, and escalation design so fraud signals can support faster and more reliable identity decisions.

Key terms

• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
• Deterministic Identifier: A deterministic identifier recognises a device by a stable artifact that has been seen before. It is useful when the same device returns, but it becomes weaker when attackers can alter the environment or when legitimate users create inconsistent signals.
• Probabilistic Identifier: A probabilistic identifier infers device similarity from multiple signals rather than relying on one fixed marker. It is designed to work in real time and can improve privacy posture because it does not depend entirely on persistent personal data storage.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.