Device Intelligence Glossary
Clear, encyclopedic definitions of the concepts behind browser fingerprinting, bot detection, and fraud prevention — what each term means, how it works, and why it matters.
Showing 73 of 73 terms
Fingerprinting
21Browser Fingerprinting
Browser fingerprinting is the practice of collecting and combining many observable attributes of a web browser and its environment into a single identifier that can recognize a device without cookies or local storage. Because each attribute carries a little information, the combination is often distinctive enough to single out one browser among millions.
Read definitionCanvas Fingerprinting
Canvas fingerprinting is a technique that renders text or graphics to an HTML5 canvas element and reads back the resulting pixel data to derive a device-specific identifier. Tiny differences in GPU, graphics driver, font rasterization, and anti-aliasing cause the same drawing instructions to produce subtly different pixels on different machines.
Read definitionWebGL Fingerprinting
WebGL fingerprinting is a technique that queries a device's GPU and graphics driver through the WebGL API to derive identifying metadata such as the renderer string, vendor, supported extensions, and shader precision. Because these values reflect real graphics hardware and driver builds, WebGL signals are highly stable and discriminate well even across different browsers on the same machine.
Read definitionAudio Fingerprinting
Audio fingerprinting is a technique that uses the Web Audio API to generate and process a sound signal, then measures the numerical output to derive a device-specific identifier. Differences in audio hardware, digital signal processing, and floating-point behavior across devices cause the same synthesized audio to produce subtly different results.
Read definitionFont Fingerprinting
Font fingerprinting is a technique that determines which fonts are installed or available on a device and how they render, using the resulting list and metrics as an identifying signal. The particular set of fonts on a system reflects its operating system, installed software, and user customizations, which together make the font profile distinctive.
Read definitionTLS Fingerprinting
TLS fingerprinting is a technique that identifies the software making an HTTPS connection by inspecting the parameters of its TLS handshake, particularly the ClientHello message. Because different TLS libraries and clients advertise cipher suites, extensions, and versions in characteristic ways, the handshake reveals the underlying client even without any application-level data.
Read definitionJA4 Fingerprint
A JA4 fingerprint is a standardized identifier derived from a client's TLS ClientHello that summarizes its cipher suites, extensions, and protocol versions to identify the TLS library or client. It is the successor to the JA3 scheme, designed to be more robust and harder to evade while remaining independent of IP address and user agent.
Read definitionHTTP/2 Fingerprinting
HTTP/2 fingerprinting is a technique that identifies a client by the characteristic way it uses the HTTP/2 protocol, including its settings frames, header ordering, stream priorities, and window sizes. These low-level protocol behaviors are set by the client's networking library and differ between real browsers and automation tools.
Read definitionWebRTC Leak
A WebRTC leak is the exposure of a device's true local or public IP address through the WebRTC APIs, even when the user is behind a VPN or proxy. It occurs because WebRTC gathers network candidates for peer-to-peer connectivity and can reveal addresses that the browser would otherwise keep hidden.
Read definitionScreen Fingerprinting
Screen fingerprinting is a technique that uses display characteristics such as resolution, color depth, pixel ratio, available screen area, and multi-monitor layout as identifying signals. While any single screen value is common, the combination with device pixel ratio and viewport details adds useful entropy to a device profile.
Read definitionHardware Fingerprinting
Hardware fingerprinting is the use of signals tied to a device's physical components, such as the GPU, CPU core count, memory, sensors, and audio hardware, to build a stable device identifier. Because hardware changes far less often than software configuration, these signals form some of the most durable anchors for device recognition.
Read definitionTimezone & Locale Fingerprinting
Timezone and locale fingerprinting uses a device's configured timezone, language preferences, date and number formatting, and related regional settings as identifying and corroborating signals. These values reflect where and how a user has set up their device, and fraud-detection systems commonly compare them against network geolocation.
Read definitionEntropy (Fingerprinting)
Entropy, in fingerprinting, is a measure of how much identifying information a signal or combination of signals carries, expressed as the number of bits needed to distinguish devices. Higher entropy means a signal splits the population into more distinct groups, so combining high-entropy signals is what makes a fingerprint uniquely identifying.
Read definitionFuzzy Matching
Fuzzy matching is a technique that recognizes two fingerprints as the same device even when some signal values differ, by measuring similarity rather than requiring an exact match. It tolerates the small, expected changes that occur as browsers update and configurations drift, reducing false negatives without collapsing distinct devices together.
Read definitionSignal Stability
Signal stability is the degree to which a fingerprinting signal stays constant for the same device over time. Stable signals like GPU metadata anchor long-term recognition, while volatile ones like exact browser version change frequently and must be handled with tolerance.
Read definitionPolymorphic Code
Polymorphic code is program code that changes its own structure or form on each execution or deployment while preserving its behavior. In the context of fingerprinting and fraud, it is used both by detection scripts to resist reverse engineering and tampering, and by attackers to evade signature-based defenses.
Read definitionAdvanced Matching
Advanced matching is a device-recognition approach that tolerates small, expected changes in signal values, such as a browser version update, while still recognizing the same device. Unlike exact matching, it reduces false negatives caused by routine drift, keeping a device's identity stable as its environment evolves.
Read definitionSignal Hashing
Signal hashing is the use of a fast one-way hash function to convert raw fingerprint signal values into fixed-length hashes for efficient comparison and storage. Hashing turns bulky or sensitive raw values into compact digests that can be matched quickly without retaining the original data.
Read definitionSignal Uniqueness
Signal uniqueness is a measure of how distinctive a signal is, reflecting how much identifying information it carries about a device. Highly unique signals such as canvas or WebGL output contribute far more to identification than common ones like platform or language that most users share.
Read definitionCross-Device Tracking
Cross-device tracking is the practice of linking activity across a person's multiple devices, such as a phone, laptop, and tablet, into a single profile. It can be deterministic, using shared logins or identifiers, or probabilistic, inferring links from shared networks, behavior, and correlated signals.
Read definitionCookieless Tracking
Cookieless tracking is the recognition of returning devices or users without relying on browser cookies, typically by using device fingerprinting and server-side signals. It has grown in importance as browsers restrict third-party cookies and users routinely clear or block them.
Read definitionBots & Automation
12Bot Detection
Bot detection is the process of identifying automated scripts, headless browsers, and other non-human traffic by analyzing behavioral patterns, browser API inconsistencies, and environment signals. It separates genuine human visitors from software agents that impersonate them.
Read definitionHeadless Browser
A headless browser is a real browser engine that runs without a visible window or graphical interface, controlled entirely by code. It is used legitimately for testing and rendering, but is also a common tool for scraping and bot attacks.
Read definitionAnti-Detect Browser
An anti-detect browser is a specialized browser built to forge or randomize its own fingerprint so that multiple accounts or sessions appear to come from different, unrelated devices. It is a core tool for multi-accounting, promo abuse, and evading device-based fraud controls.
Read definitionCDP Detection
CDP detection is the identification of browsers being controlled through the Chrome DevTools Protocol, the low-level interface many automation tools use to drive Chromium. Its presence is a strong indicator that a session is scripted rather than driven by a human.
Read definitionWebDriver Detection
WebDriver detection is the identification of browsers controlled through the W3C WebDriver standard, the interface behind tools like Selenium. The classic signal is the navigator.webdriver property, though robust detection looks well beyond it.
Read definitionResidential Proxy
A residential proxy routes traffic through IP addresses assigned by consumer internet providers to real homes, making automated requests appear to originate from ordinary users. It is the network layer attackers use to evade IP-based blocking and reputation checks.
Read definitionDatacenter Proxy
A datacenter proxy routes traffic through IP addresses owned by hosting and cloud providers rather than consumer ISPs. It offers cheap, high-volume anonymity but is comparatively easy to recognize because its addresses do not belong to residential networks.
Read definitionCAPTCHA Farm
A CAPTCHA farm is a service that solves CAPTCHAs at scale, either through low-paid human workers or automated solvers, so that bots can bypass challenges designed to stop them. It turns the CAPTCHA from a barrier into a small, priced cost per request.
Read definitionWeb Scraping
Web scraping is the automated extraction of data from websites by programs that request pages and parse their content at scale. It ranges from benign indexing to abusive harvesting of pricing, content, and personal data.
Read definitionCredential Stuffing Bot
A credential stuffing bot is automation that tries large lists of stolen username and password pairs against a login endpoint to find accounts that reuse the same credentials. It converts breach data from other services into account takeovers on the target.
Read definitionAI Agent (Automated Browsing)
An AI agent, in the browsing sense, is an autonomous program driven by a language model that navigates websites and completes tasks by interpreting pages and deciding its own actions. It blurs the line between bot and human because it reasons about goals rather than following a fixed script.
Read definitionAutomation Framework
An automation framework is a software library or toolkit that programmatically controls a browser, such as Selenium, Playwright, or Puppeteer. These tools power legitimate testing but are also the foundation of most sophisticated bots.
Read definitionFraud Types
15Account Takeover (ATO)
Account takeover (ATO) is a form of fraud in which an attacker gains unauthorized control of a legitimate user's account and uses it for theft, further fraud, or resale. It typically follows the compromise of login credentials rather than the creation of a new fake account.
Read definitionPayment Fraud
Payment fraud is any transaction in which stolen, fake, or manipulated payment details are used to obtain goods, services, or money without authorization. It spans card-not-present fraud, stolen-account purchases, and manipulation of payment flows.
Read definitionCarding
Carding is the practice of testing and using stolen credit card numbers to confirm which are valid and then extracting value from them. It usually begins with automated low-value transactions that verify a card before it is used for larger fraud.
Read definitionChargeback Fraud
Chargeback fraud is the abuse of the payment dispute process to reverse a legitimate charge and keep the goods or services received. It includes both criminal disputes of stolen-card transactions and dishonest disputes filed by real customers.
Read definitionPromo Abuse
Promo abuse is the exploitation of promotional offers, discounts, and coupons beyond their intended terms, usually by redeeming them repeatedly through fake or duplicate identities. It turns marketing incentives meant to attract genuine customers into a source of loss.
Read definitionMulti-Accounting
Multi-accounting is the practice of one person or entity operating many accounts to gain an advantage that a single account would not allow. It underlies abuses ranging from repeated promo redemption to collusion, ban evasion, and manipulation of platforms.
Read definitionTrial Abuse
Trial abuse is the repeated exploitation of free-trial offers by creating new accounts to obtain a paid product for free indefinitely. It lets a single user consume trial value again and again instead of converting to a paying subscription.
Read definitionRefund Fraud
Refund fraud is the abuse of a merchant's return and refund process to obtain money back while keeping the goods or without a legitimate reason. It ranges from false claims by individual buyers to organized services that guarantee refunds for a fee.
Read definitionAd Fraud
Ad fraud is the deliberate generation of fake advertising activity, such as fraudulent impressions, clicks, installs, or conversions, to steal money from advertisers and ad networks. It exploits the fact that digital advertising pays out on measured events that can be faked.
Read definitionClick Fraud
Click fraud is the generation of fake clicks on pay-per-click ads to drain an advertiser's budget or to earn illegitimate revenue as a publisher. It is a specific, high-impact form of ad fraud focused on the click event.
Read definitionBonus Abuse
Bonus abuse is the exploitation of sign-up bonuses, deposit matches, and reward incentives beyond their intended terms, most often through multiple accounts. It is especially prevalent in iGaming, betting, and fintech, where bonuses carry direct cash-equivalent value.
Read definitionFriendly Fraud
Friendly fraud is when a genuine customer disputes a legitimate charge with their bank to get their money back while keeping the goods or services. Unlike criminal fraud, it is committed by the real cardholder, which makes it uniquely hard to detect.
Read definitionSynthetic Identity Fraud
Synthetic identity fraud is the creation of fictitious identities by combining real and fabricated personal information to pass verification and open accounts. Because the identity does not correspond to a single real victim, it can evade traditional identity checks for a long time.
Read definitionSIM Swap Fraud
SIM swap fraud is an attack in which a criminal transfers a victim's phone number to a SIM they control, hijacking calls and texts. It is used to intercept one-time passcodes and account-recovery messages, defeating SMS-based authentication and enabling account takeover.
Read definitionNew Account Fraud
New account fraud is the creation of accounts using stolen, fake, or synthetic identities in order to commit fraud from the outset. Unlike account takeover, which hijacks an existing account, it manufactures fresh accounts as the vehicle for abuse.
Read definitionRisk & Detection
17Device Intelligence
Device intelligence is the practice of collecting, analyzing, and enriching device signals to identify visitors, detect fraud, assess risk, and personalize experiences without relying solely on PII or cookies. It turns raw browser and network attributes into an actionable picture of who or what is behind a request.
Read definitionVisitor ID
A visitor ID is a stable, unique token derived from a device's fingerprint signals that identifies a returning visitor across sessions. Unlike a cookie, it persists through incognito mode, cookie clearing, and browser restarts because it is computed from the device rather than stored on it.
Read definitionConfidence Score
A confidence score is a numerical value from 0 to 1 that expresses how certain an identification system is that the current visitor matches a previously seen identity. Higher values mean stronger correlation between the current signals and a known device profile.
Read definitionRisk Score
A risk score is a single numerical value that summarizes how likely a given visitor, session, or transaction is to be fraudulent. It condenses many underlying signals into one figure that fraud systems can compare against a threshold to allow, challenge, or block an action.
Read definitionSuspect Score
A suspect score is a composite risk score, on a 0-to-100 scale, that aggregates bot signals, IP reputation, environment anomalies, and behavioral indicators into a single value. A higher score means the visitor is more likely to be fraudulent or automated.
Read definitionVerdict Engine
A verdict engine is the decisioning layer that turns raw signals and risk scores into a concrete outcome such as allow, deny, or review. It is where measurement ends and action begins, applying policy to the evidence collected about a visitor.
Read definitionVelocity Checks
Velocity checks are fraud rules that measure how frequently an action is performed by the same entity within a time window. They catch abuse that reveals itself through speed and volume, such as one device creating many accounts or one card attempting many transactions in minutes.
Read definitionDevice Graph
A device graph is a data structure that links devices, identifiers, and accounts by the relationships observed between them. It reveals connections a single-visit view would miss, such as many accounts sharing one device or one person operating across several devices.
Read definitionSmart Signals
Smart signals are server-computed enrichment signals that add risk and identity context to a visit, covering areas like bot confidence, VPN detection, incognito detection, and suspect scoring. They are calculated server-side so they cannot be spoofed by the client the way raw browser values can.
Read definitionIP Intelligence
IP intelligence is the server-side enrichment of IP addresses to detect VPNs, proxies, Tor, datacenter hosting, and residential proxies, and to add geographic and network-risk context. It turns a bare IP address into an assessment of how the traffic is reaching you and how much to trust it.
Read definitionVPN Detection
VPN detection is the identification of visitors routing their traffic through a virtual private network, using signals like IP reputation, timezone mismatches, WebRTC leak analysis, and DNS patterns. It reveals when a user's apparent network location is being masked by an encrypted tunnel.
Read definitionTor Detection
Tor detection is the identification of traffic arriving through the Tor anonymity network, based on known exit-node lists, network characteristics, and Tor Browser configuration patterns. It flags one of the strongest forms of network anonymization a visitor can use.
Read definitionProxy Detection
Proxy detection is the identification of visitors routing traffic through a proxy, VPN, or other anonymizer, using IP reputation, timing analysis, and HTTP header inspection. It reveals when a request is being relayed through an intermediary rather than coming directly from the user's device.
Read definitionASN (Autonomous System Number)
An ASN, or Autonomous System Number, is a globally unique identifier assigned to a network operator that controls a block of IP addresses under a single routing policy. Mapping an IP to its ASN reveals which organization the traffic belongs to, such as a home ISP, a cloud provider, or a hosting company.
Read definitionIncognito Detection
Incognito detection is the identification of visitors browsing in a private or incognito window, inferred from the behavior of storage APIs and other browser characteristics that differ in private mode. It reveals when a user has disabled the persistent state that fraud controls often rely on.
Read definitionIdentification Algorithm
An identification algorithm is the method that turns raw device signals into a stable visitor identifier by separating signals into stability tiers, hashing each tier, and combining them with weighted confidence. It is engineered to recognize the same device over time despite the routine drift of individual signals.
Read definitionTransport Encryption
Transport encryption is the protection of signal data while it travels from the browser to the server, so it cannot be read or tampered with in transit. In device intelligence it typically combines standard TLS with an additional application-layer transformation of the payload before it leaves the page.
Read definitionPrivacy & Compliance
8GDPR
GDPR (General Data Protection Regulation) is the European Union's comprehensive data protection law, in force since May 2018, that governs how organizations collect, process, and store the personal data of individuals in the EU and EEA.
Read definitionPII (Personally Identifiable Information)
PII (Personally Identifiable Information) is any data that can be used, on its own or in combination with other information, to identify, locate, or contact a specific individual.
Read definitionFirst-Party Data
First-party data is information a company collects directly from its own users, customers, and visitors through its own websites, apps, and systems, based on its direct relationship with them.
Read definitionConsent
Consent, in data protection, is a freely given, specific, informed, and unambiguous indication by which an individual agrees to the processing of their personal data for a defined purpose.
Read definitionPrivate Browsing
Private browsing, also known as incognito mode, is a browser feature that opens a session which does not save local history, cookies, form entries, or site data after the window is closed.
Read definitionCookie Persistence
Cookie persistence is the ability of a cookie to survive across browsing sessions, so that a website can recognize a returning visitor after the browser has been closed and reopened.
Read definitionPrivacy Sandbox
Privacy Sandbox is a Google initiative for the Chrome browser and Android that aims to replace third-party cookies and other cross-site tracking mechanisms with a set of privacy-preserving APIs.
Read definitionITP (Intelligent Tracking Prevention)
ITP (Intelligent Tracking Prevention) is a privacy feature built into Apple's Safari browser that limits cross-site tracking by restricting third-party cookies and shortening the lifespan of certain cookies and other stored data.
Read definitionReady to get started?
Try Tracio free with 2,500 API calls per month. No credit card required.