Topic starter
23/06/2026 9:16 pm
TL;DR: Static device fingerprinting creates division and collision problems as browsers update, privacy tools randomise signals, and shared environments make different devices look identical, according to Arkose Labs. Device identity for fraud control now has to treat change as a signal, not just noise, because persistent reputation is only useful when the underlying identity is stable.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Fingerprinting Is Broken. Here’s How We Fixed It.”.
Key questions
Q: How should security teams handle device identity when fingerprints change over time?
A: Security teams should treat device identity as a continuity problem, not a one-time match.
Q: What is the difference between device collision and device division?
A: Collision is when many devices share one fingerprint, while division is when one device splits into multiple fingerprints.
Q: When should security teams trust device reputation in fraud decisions?
A: Teams should trust device reputation only when the system can show that the device identity remains coherent across normal changes and has not been artificially manipulated.
Practitioner guidance
- Re-score device identity around continuity Replace single-snapshot matching with a model that can compare current sessions against prior device behaviour and preserve identity across normal signal drift.
- Separate organic drift from manipulation Use differences between a device's current signals and its own history to distinguish routine browser or network changes from deliberate fingerprint evasion.
- Measure collision and division separately Track how often one device is split across multiple IDs and how often multiple devices share one ID, because both errors degrade fraud decision quality in different ways.
Bottom line: Static device fingerprinting now produces both fragmented identities and shared identities, which makes fraud decisions less reliable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:29 am
Static device fingerprinting is no longer a reliable identity assumption. The model was built for a world where device attributes changed slowly and predictably. That assumption fails when browsers, networks and privacy tools mutate signals constantly, because the same device can look new on every return visit. The implication is that device identity governance has to move from snapshot logic to continuity logic.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: Why do shared networks and common hardware distort device fingerprinting?
A: Shared networks and common hardware create many devices that look nearly identical to a static fingerprinting system. That makes the identity layer ambiguous before fraud even enters the picture, so ordinary users can be grouped with attackers or attackers can blend into legitimate traffic. The control has to account for context, not just attributes.
👉 Read our full editorial: Device ID fingerprinting breaks when devices become dynamic