Topic starter
15/08/2026 6:09 pm
TL;DR: VPN use is now routine, desktop sessions carry the densest fraud signal mix, and mobile integrity events remain rare but more decisive when they appear, according to Fingerprint's 2026 Device Intelligence Report, which analyses more than 23 billion identification events across over 7 billion browsers and devices.
Editorial analysis by NHI Mgmt Group, based on content published by Fingerprint: “We analyzed 23 billion device identification events. Here's what we found.”.
By the numbers:
- Fingerprint analysed more than 23 billion identification events across over 7 billion browsers and devices worldwide.
- In 2025, roughly 1 in 5 identification events involved VPN usage.
- Desktop browser tampering reached 4.4% of identifications in 2025, up from 2.6% in 2024.
Key questions
Q: How should fraud teams handle VPN usage in risk scoring?
A: Treat VPN use as a normalised context signal, not a reliable fraud indicator on its own.
Q: Why do stacked desktop signals matter more than single anomalies?
A: Desktop gives attackers more room to disguise automation and manipulate browser state, so one anomaly often has limited meaning.
Q: What are the signs that mobile risk controls are underweighted?
A: If rooted devices, emulators, app cloning, or MitM characteristics appear but trigger only soft friction, your mobile controls are probably underweighted.
Practitioner guidance
- Reweight desktop signals by combination, not isolation Build scoring that treats browser tampering, VM presence, and developer tooling as materially stronger when they occur together in the same session.
- Downgrade VPN as a standalone suspicion trigger Use VPN presence as context unless it is paired with additional abuse indicators or conflicts with your geo-compliance rules.
- Escalate rare mobile integrity events immediately Route rooted devices, emulators, app cloning, and MitM-style interference into stronger step-up or denial paths during account creation and recovery.
Bottom line: Desktop sessions now carry the densest mix of fraud-relevant signals, especially when browser tampering, virtualisation, and automation appear together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:17 pm
Desktop signal stacking is the real governance problem: the article shows that fraud risk is less about any one indicator than about how multiple indicators combine inside a session. That creates a control gap for teams still tuning policy around individual anomalies instead of environmental context. The practical conclusion is that risk models should weight signal combinations differently on desktop than on mobile.
A question worth separating out:
Q: How should teams distinguish privacy behaviour from abuse behaviour?
A: Use workflow context, signal combinations, and historical consistency rather than a single network attribute. Privacy behaviour such as VPN use is common and often legitimate, while abuse usually shows up as layered inconsistency across device, browser, and task path. Policy should reflect that distinction across signup, login, checkout, and recovery flows.
👉 Read our full editorial: Device intelligence shows fraud risk concentrates on desktop sessions