Topic starter
12/06/2026 9:57 pm
TL;DR: More than 70% of enterprises now rank identity-based attacks as a top concern, while 40% of those attacks are AI-powered and 88% of security professionals report rising bot activity, according to Arkose Labs. Device identification can reduce friction, but it does not remove the underlying trust problem in registration, login, and payments.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Introducing Arkose Device ID in an Evolving Threat Landscape”.
By the numbers:
- More than 70% of enterprises consider identity-based attacks their top security concern.
- 40% of identity-based attacks are AI-powered.
- 88% of security professionals report a rise in AI-powered bot attacks.
Key questions
Q: What breaks when trust signals are treated as proof of identity?
A: Trust signals are useful for prioritisation and risk scoring, but they are not a substitute for cryptographic proof.
Q: Why do AI-powered bots make device-based fraud controls less reliable?
A: AI-powered bots can mimic human pacing, reuse browser characteristics, and adapt their behavior to the control being tested.
Q: What are the signs that device trust is failing in login and payment flows?
A: Common signs include high repeat usage from supposedly trusted devices, unusual session reuse, account sharing across locations, and fraud that persists even after device-based suppression rules.
Practitioner guidance
- Separate device recognition from authentication decisions Use device identifiers to enrich risk scoring, but keep login approval tied to explicit authentication and contextual policy checks.
- Add step-up triggers for trusted-device abuse Require additional verification when a familiar device shows improbable session behavior, payment risk, or account-sharing patterns.
- Monitor session continuity after device trust is established Track token reuse, location shifts, and rapid context changes so a trusted device does not mask hijacked session activity.
Bottom line: Device identification can improve fraud decisions, but it does not prove that the actor using the device is legitimate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:23 am
Device trust is a fraud signal, not an identity control: Device IDs can improve correlation across sessions, but they do not establish who is behind the interaction. Once teams start treating device continuity as proof of legitimacy, they collapse the distinction between recognition and authorization. The practitioner conclusion is simple: device intelligence belongs inside decisioning, not above it.
A question worth separating out:
Q: How should fraud teams balance device signals with step-up verification?
A: Fraud teams should use device signals to reduce friction only when other context supports the transaction. If the device is known but the session, payment behavior, or login pattern is unusual, step-up verification should take precedence. That keeps convenience from overriding risk.
👉 Read our full editorial: Arkose Device ID and the limits of device trust in fraud defense