Platform-level fraud detection changes e-commerce merchant defence

At a glance

What this is: The article argues that e-commerce platforms can reduce fraud by using shared device intelligence across merchants instead of leaving each merchant to defend itself in isolation.

Why it matters: For identity and fraud practitioners, the key issue is whether platform-wide signals can suppress account takeover, promo abuse, and synthetic identity activity without adding checkout friction.

By the numbers:

• Projected global e-commerce sales are expected to surpass $6.8 trillion in 2025, which increases the scale and value of fraud targets across merchant ecosystems.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant behaviour gap in application security.

👉 Read Fingerprint's analysis of platform-wide fraud defence for e-commerce merchants

Context

Platform fraud prevention fails when every merchant is forced to make isolated decisions from partial signals. In high-volume e-commerce, attackers reuse the same card testing, account takeover, promo abuse, and bot infrastructure across multiple stores, while merchants typically see only their own slice of the activity.

Device intelligence gives fraud teams a way to connect sessions, accounts, and payment behaviour across the platform, so repeated abuse is easier to spot before checkout completes. That is especially relevant where fraud prevention overlaps with identity verification, trust scoring, and access decisions around suspicious accounts and payment credentials.

Key questions

Q: How should platforms detect fraud across multiple merchants?

A: Platforms should correlate device, behavioural, and transaction signals across merchants so the same attacker cannot reset their profile by moving store to store. The goal is not just detection at checkout, but platform-wide pattern recognition that can block repeat abuse earlier. That requires clean telemetry, consistent identifiers, and governance for shared risk decisions.

Q: Why do merchant-only fraud controls fail against organised abuse?

A: Merchant-only controls fail because attackers reuse the same cards, devices, and automation infrastructure across multiple storefronts. Each merchant sees only a fragment, so abuse can look isolated until the campaign has already spread. Cross-merchant correlation closes that blind spot and exposes repeat behaviour before it becomes chargeback or takeover loss.

Q: What do teams get wrong about device intelligence in fraud prevention?

A: They often treat it as a standalone detector instead of an enrichment layer. Device intelligence is most useful when it helps confirm or weaken confidence in other signals such as velocity, geography, and account history. On its own, it rarely proves fraud; in combination, it improves decision quality.

Q: Who should own governance for shared fraud signals?

A: The platform owner should own it because shared fraud telemetry affects retention, access, escalation, and customer experience across every merchant. Merchants need transparency into how signals are used, but the platform must control policy, false-positive handling, and data lifecycle. Without that governance, shared intelligence becomes inconsistent and hard to trust.

Technical breakdown

Why merchant-level fraud controls miss repeat attackers

Merchant-only fraud controls create blind spots because each store sees a narrow history of devices, cards, and behavioural patterns. Fraudsters exploit that fragmentation by testing stolen cards at one merchant, then moving to the next before defenders can correlate the activity. Platform-level correlation changes the detection unit from a single transaction to a persistent device and behaviour profile, which is more effective against distributed abuse. The technical requirement is clean, real-time device data with enough consistency to link sessions across merchants without over-relying on brittle identifiers.

Practical implication: centralise device and behaviour correlation so suspicious activity can be blocked across the platform, not just at one checkout.

How device intelligence supports account takeover and promo abuse detection

Device intelligence is not a standalone fraud verdict. It works by combining signals such as browser characteristics, interaction patterns, geolocation anomalies, transaction velocity, and prior abuse history into a risk decision. That matters for account takeover because credential stuffing and session hijack attempts often reuse the same device infrastructure across targets. It also matters for promo abuse, where scripted registrations and repeated coupon testing leave patterns that are hard to see inside a single merchant workflow.

Practical implication: tune fraud engines to use repeat-device and behaviour history as decision inputs for ATO, refund abuse, and promo abuse.

Platform trust becomes a shared control plane

When a platform can reuse high-confidence signals across merchants, fraud defence becomes a shared control plane rather than a set of isolated merchant rules. That improves both security and user experience because trusted sessions can pass faster while suspicious sessions face stronger friction. The architectural trade-off is governance: the platform must decide how much signal sharing is acceptable, how long to retain it, and how to prevent false positives from spreading across the ecosystem. This is a data governance problem as much as a fraud problem.

Practical implication: define retention, sharing, and escalation rules for device signals before rolling them into checkout decisions.

Threat narrative

Attacker objective: The attacker wants to monetise repeated abuse across many merchants while avoiding detection by staying one step ahead of siloed controls.

1. Entry occurs when fraudsters test stolen cards, synthetic identities, or automated sign-up flows against one merchant and reuse the same infrastructure elsewhere.
2. Escalation happens when the attacker shifts from simple testing to account takeover, promo abuse, or chargeback fraud across multiple merchants while each store sees only a fragment of the pattern.
3. Impact is platform-wide loss through fraudulent transactions, chargebacks, and degraded trust, with legitimate users facing either more friction or more false declines.

NHI Mgmt Group analysis

Platform fraud is now a shared identity problem, not just a payment problem. The article is really about how trust is reused across merchants, which means attackers can reuse compromised signals too. Once a platform has enough reach to see repeated device behaviour, fraud detection starts to resemble identity governance for anonymous users. The practitioner takeaway is that merchants and platforms need a shared view of risk, not disconnected point solutions.

Device intelligence creates a verification trust gap when it is treated as a binary allow or block control. A device can be stable, repeatable, and still malicious if it is part of a bot network or takeover ring. The stronger model is continuous risk evaluation that combines device history, behavioural patterns, and transaction context. The practitioner takeaway is to design for correlation, not just single-event verification.

Promo abuse and account takeover should be treated as ecosystem compromise patterns. The article shows that attackers do not respect merchant boundaries, which makes fragmented controls structurally weak. That same logic appears in identity security when organisations assume a credential, session, or device is only meaningful inside one application. The practitioner takeaway is to investigate repeated abuse as a cross-merchant campaign, not a local anomaly.

Shared fraud telemetry only works when governance is explicit. The platform can only benefit from cross-merchant signals if it has clear rules for retention, access, escalation, and false-positive handling. Without those guardrails, shared intelligence can create noisy decisions or overblocking. The practitioner takeaway is to treat fraud telemetry as governed identity data, not just operational metadata.

What this signals

Device intelligence will matter more as fraud actors industrialise reuse. The practical signal for e-commerce teams is that isolated merchant rules will continue to miss campaigns that hop across storefronts, especially where the same device, browser, or behavioural pattern is reused to probe payment and account workflows. Teams should expect more demand for platform-wide correlation, cleaner telemetry, and policy clarity around shared risk data.

Fraud telemetry is increasingly identity data in disguise. Once a platform can link sessions, accounts, and repeat abuse, the governance questions start to look familiar to identity teams: who can access the signal, how long it is retained, and how decisions are explained. That is why alignment with broader identity governance thinking, including the control discipline reflected in NIST SP 800-53 Rev 5 Security and Privacy Controls, becomes relevant.

Shared-signal architectures need a named control boundary. We call this the verification trust gap, the space between seeing a device and being able to trust the behaviour attached to it. Closing that gap means combining device intelligence with continuous policy decisions, not assuming that a stable identifier is a trustworthy one.

For practitioners

• Implement cross-merchant device correlation Link device identifiers, behavioural traits, and transaction histories across merchants so the same attacker is visible even after moving to a new storefront. This is the core control that turns isolated detection into platform defence.
• Prioritise high-risk flow controls Apply stronger checks to card testing, account creation, password resets, promo redemption, and refund requests, because those are the workflows attackers repeatedly reuse across platforms.
• Define shared signal governance Set retention limits, access rules, and escalation criteria for platform-wide risk data so merchants can benefit from shared intelligence without creating uncontrolled data sprawl.
• Use behavioural history in fraud decisions Weight repeat-device patterns, impossible velocity, and synthetic interaction traits alongside authentication outcomes, rather than relying on a single checkout signal.

Key takeaways

• Fraud prevention becomes materially stronger when platforms can correlate repeat abuse across merchants instead of treating each store as an isolated security island.
• The scale of e-commerce and the speed of attacker reuse mean that checkout controls must be driven by shared device and behaviour intelligence, not just merchant-level rules.
• Practitioners should treat fraud telemetry as governed identity data and design explicit policy for how signals are shared, retained, and acted on.

Key terms

• Device Intelligence: Device intelligence is the practice of interpreting signals from a device to assess whether a session or transaction is likely legitimate. It goes beyond fingerprinting by combining device context with behavioural, identity, and payment evidence to support a risk decision.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Fraud Telemetry: Fraud telemetry is the collection of signals that indicate suspicious or adversarial behaviour during onboarding, login, or account recovery. It includes device, behavioural, document, and biometric indicators that help teams detect attack patterns before they become successful identity abuse.

What's in the full article

Fingerprint's full article covers the operational detail this post intentionally leaves for the source:

• Platform-specific explanations of how device intelligence is inserted into checkout and fraud workflows
• Examples of the fraud patterns the vendor says can be linked across merchants, including account takeover and promo abuse
• Operational detail on how cleaner device data improves platform-level decisioning and merchant trust
• The commercial and user-experience outcomes Fingerprint associates with shared fraud defence

👉 Fingerprint's full article covers how device intelligence changes fraud decisions across the merchant ecosystem.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle disciplines. It helps security practitioners connect identity controls to broader risk programmes across cloud, application, and platform environments.