TL;DR: VPN use is now routine, desktop sessions carry the densest fraud signal mix, and mobile integrity events remain rare but more decisive when they appear, according to Fingerprint's 2026 Device Intelligence Report, which analyses more than 23 billion identification events across over 7 billion browsers and devices.
At a glance
What this is: Fingerprint's device intelligence report says fraud and evasion signals are clustering in desktop browser sessions, while VPN use has become normal and mobile integrity signals remain comparatively rare.
Why it matters: Fraud, IAM, and risk teams need to recalibrate policy thresholds so they do not overreact to routine VPN use while still weighting stacked desktop signals and rare mobile integrity events correctly.
By the numbers:
- Fingerprint analysed more than 23 billion identification events across over 7 billion browsers and devices worldwide.
- In 2025, roughly 1 in 5 identification events involved VPN usage.
- Desktop browser tampering reached 4.4% of identifications in 2025, up from 2.6% in 2024.
- Rooted Android devices accounted for 0.12% of identifications in 2025, while jailbroken iOS devices were 0.03%.
Context
Fraud detection depends on understanding what normal behaviour looks like at decision points such as signup, login, checkout, and account recovery. The central governance problem is not whether a single signal is unusual, but whether multiple signals are being interpreted in the right environment, especially when desktop and mobile sessions behave very differently.
Fingerprint's report frames that problem through device and browser telemetry rather than identity proofing or account history. The identity angle is indirect but real: session integrity, bot resistance, and account takeover defence all depend on how reliably a system distinguishes legitimate users, automation, and device abuse.
The result is a baseline for risk scoring, not a universal rulebook. The report suggests that desktop is where enforcement effort has the highest return, while mobile integrity events are rarer and therefore more decisive when they appear.
Key questions
Q: How should fraud teams handle VPN usage in risk scoring?
A: Treat VPN use as a normalised context signal, not a reliable fraud indicator on its own. It becomes useful when combined with other anomalies such as tampering, automation, unusual workflow timing, or inconsistent device history. The goal is to avoid overblocking privacy-conscious users while still catching sessions that stack multiple abuse signals.
Q: Why do stacked desktop signals matter more than single anomalies?
A: Desktop gives attackers more room to disguise automation and manipulate browser state, so one anomaly often has limited meaning. When several signals appear together, they point to a deliberate attempt to mimic legitimate behaviour. That is why mature fraud models should score combinations, not just count isolated flags.
Q: What are the signs that mobile risk controls are underweighted?
A: If rooted devices, emulators, app cloning, or MitM characteristics appear but trigger only soft friction, your mobile controls are probably underweighted. These signals are rare, so they deserve stronger treatment than similar desktop anomalies. A clean mobile baseline should let a single strong integrity event move the response quickly.
Q: How should teams distinguish privacy behaviour from abuse behaviour?
A: Use workflow context, signal combinations, and historical consistency rather than a single network attribute. Privacy behaviour such as VPN use is common and often legitimate, while abuse usually shows up as layered inconsistency across device, browser, and task path. Policy should reflect that distinction across signup, login, checkout, and recovery flows.
Technical breakdown
Why desktop browser sessions concentrate fraud signals
Desktop is where users have the most flexibility to alter browser state, run automation, and mask execution environments. That makes it easier for adversaries to combine browser tampering, virtual machines, and developer tooling in ways that look normal in isolation but become suspicious in aggregate. The report's point is not that every desktop anomaly is malicious. It is that the desktop environment gives attackers more room to emulate legitimate workflows while evading weak fingerprinting controls. For defenders, the technical challenge is feature correlation across one session rather than reliance on a single indicator.
Practical implication: Treat stacked desktop signals as a correlation problem, not a single-signal block decision.
Why VPN usage is now a weak standalone risk signal
VPN routing has moved from edge-case behaviour to routine privacy and access management. That matters because many fraud models still over-weight IP masking as if it were a reliable marker of hostile intent. The report shows that VPN presence is now common across desktop and mobile traffic, which means it is better used as contextual data than as a primary suspicion trigger. In practice, a VPN tells you something about network path and user behaviour, but not enough to distinguish a developer, a privacy-conscious user, or an attacker.
Practical implication: Deprioritise VPN alone and score it only when combined with other abuse indicators.
Why mobile integrity events carry more governance weight
Mobile environments are technically more constrained than desktop, so many evasion techniques do not scale there. That is why rooted devices, emulators, app cloning, and MitM-style interference are rare but more meaningful when they appear. The article's key technical point is that mobile integrity signals have stronger diagnostic value because the baseline is cleaner. This is especially important for account creation, checkout, and recovery flows, where a single strong integrity signal can justify step-up checks or denial more quickly than a noisy desktop indicator.
Practical implication: Use rare mobile integrity events as higher-confidence triggers for step-up controls.
NHI Mgmt Group analysis
Desktop signal stacking is the real governance problem: the article shows that fraud risk is less about any one indicator than about how multiple indicators combine inside a session. That creates a control gap for teams still tuning policy around individual anomalies instead of environmental context. The practical conclusion is that risk models should weight signal combinations differently on desktop than on mobile.
VPN normalisation has created a false-positive trap: once roughly one in five identification events includes VPN routing, network masking can no longer serve as a broad suspicion proxy. This does not reduce fraud pressure, but it does force teams to separate privacy behaviour from abuse behaviour. The governance challenge is threshold design, not VPN suppression.
Mobile integrity is a low-volume, high-trust boundary: rooted devices, emulators, app cloning, and MitM characteristics are rare enough that they should carry stronger response weight than similar-looking desktop anomalies. That makes mobile an identity assurance problem as much as a fraud problem, because device integrity directly affects how much trust a session deserves.
Signal interpretation now depends on workflow context: signup, recovery, login, and checkout expose different fraud economics, so the same telemetry should not trigger the same response everywhere. This is where fraud governance intersects with identity risk management: controls must align to the trust boundary being exercised, not just the signal being seen.
Named concept, desktop normalisation drift: the baseline for desktop traffic is drifting as VPN use, automation, and development behaviour become harder to separate from abuse. That means teams must continuously recalibrate what they treat as anomalous, or they will either miss real fraud or exhaust users with unnecessary friction.
What this signals
Normalisation drift is the strategic issue: as VPNs, automation, and power-user behaviours become routine, teams must continuously retune what counts as suspicious. The practical danger is not missing every unusual session, but treating ordinary privacy behaviour as evidence of abuse and eroding trust in the controls meant to protect the business.
Risk decisions should move closer to the workflow: account recovery, checkout, and sign-up expose different fraud economics, so a one-size-fits-all policy will overblock some users and underprotect others. Fraud governance works better when it aligns device intelligence to the specific decision point being defended.
For practitioners
- Reweight desktop signals by combination, not isolation Build scoring that treats browser tampering, VM presence, and developer tooling as materially stronger when they occur together in the same session.
- Downgrade VPN as a standalone suspicion trigger Use VPN presence as context unless it is paired with additional abuse indicators or conflicts with your geo-compliance rules.
- Escalate rare mobile integrity events immediately Route rooted devices, emulators, app cloning, and MitM-style interference into stronger step-up or denial paths during account creation and recovery.
- Separate workflow policy by decision point Tune different thresholds for signup, login, checkout, and account recovery so each path reflects its own fraud loss profile.
Key takeaways
- Desktop sessions now carry the densest mix of fraud-relevant signals, especially when browser tampering, virtualisation, and automation appear together.
- VPN usage has become routine enough that it should usually be treated as context rather than as a standalone abuse indicator.
- Rare mobile integrity events deserve stronger response because the mobile baseline is cleaner and those signals are more decisive when they appear.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Desktop tampering and automation support credential abuse and movement through protected workflows. |
| Recommendation — Map stacked desktop anomalies to TA0006 and TA0008, then hunt for session abuse across fraud-sensitive paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about how to apply access decisions at high-risk decision points. |
| Recommendation — Align fraud controls to PR.AA-05 by enforcing path-specific access decisions at signup, login, checkout, and recovery. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Fraud and risk workflows here involve external users whose session trust must be evaluated continuously. |
| Recommendation — Apply IA-8 to strengthen authentication and trust decisions for customer-facing workflows. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on reducing abuse across account creation and recovery workflows. |
| Recommendation — Use CIS-5 to tighten account lifecycle controls around the sessions most exposed to fraud. | ||
Key terms
- Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
- Browser Tampering Detection: Browser tampering detection identifies signs that a browser has been modified or obscured to evade fingerprinting or bot controls. It does not prove fraud on its own, but it raises confidence when combined with persistence and behavioural anomalies.
- Integrity Signal: An integrity signal is evidence that a device, app, or session may have been modified, intercepted, or automated. Common examples include tampering, rooting, emulation, and man-in-the-middle characteristics. These signals are valuable because they often change the confidence level of a transaction more than a privacy signal does.
- Risk Scoring Model: A risk scoring model is the method used to rank third parties by inherent and residual risk so reviews and remediation can be prioritised. The score should reflect evidence, control gaps, exposure, and criticality, not just a questionnaire tally or a static trust label.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on August 15, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org