Kavra LabPOST /loginVerifySame actor, 7th fingerprint this week
- Fingerprint rotated 6 times
- Graphics claim contradicts render
- Home ISP matches account history
Risk72
Detection
Device spoofing detection that keeps one actor as one actor
Fingerprint spoofing is faking the device details a browser or app reports, such as screen, graphics, fonts, timezone or device ID. Rotation changes those values on every visit so one actor looks like many new visitors. Kavra checks the claims against each other and the network, keeps one actor, and treats the rotation as a signal.
- Who it hits
- Any site that limits offers, trials or accounts per device
- What it costs
- Repeat bonuses, ban evasion, blind device checks
- Tools used
- Antidetect browsers, spoofing extensions, device ID changers
- Where to stop it
- Signup, login and every reward claim
What is fingerprint spoofing?
Every browser and phone gives away a set of details when it loads a page or opens an app: screen size, graphics card, installed fonts, language, timezone, operating system version, how it draws images and, on mobile, device identifiers. Combined, those details form a browser fingerprint or device fingerprint that is often distinctive enough to recognize a returning device without cookies.
Device spoofing means lying about those details. Instead of reporting its real hardware, the device reports values chosen by a tool. Fingerprint rotation takes this one step further: the values change on every visit or every account, so the same machine never looks the same twice. To a system that counts fingerprints, one person becomes a hundred first-time visitors.
How devices get spoofed
Spoofing ranges from a browser add-on to a fully modified phone. Each tool changes a different set of values.
| Tool category | What it changes | Typical use |
|---|---|---|
| Antidetect browsers | Every reported browser value, per profile, with separate storage | Running many accounts from one laptop |
| Spoofing extensions | A few values, such as user agent, canvas output or timezone | Low-effort rotation on a normal browser |
| Automation with stealth plugins | Values that reveal a scripted browser | Bots that must look like people |
| Device ID changers | Phone model, device IDs and ad IDs on rooted or jailbroken phones | Farming app bonuses and referrals |
| Emulators and virtual machines | Hardware that does not exist, presented as real | Cheap, disposable devices at scale |
| Privacy browsers | Small random noise added to some values | Legitimate privacy, not fraud |
How fraudsters use rotation
Rotation targets any rule that counts devices. A typical run against a signup offer looks like this.
- 01
Generate a fresh identity
The tool creates a new profile with a plausible device: a common laptop screen, a mainstream graphics card, fonts to match, and a timezone for the target country.
- 02
Pair it with a new network
Each profile gets its own proxy exit, so the device and the IP address are both new at the same time.
- 03
Claim the one-time value
The profile signs up, claims the welcome offer or trial, and moves on. The site sees a first-time device.
- 04
Rotate and return
The next visit gets a new fingerprint. Banned accounts come back, device limits reset, and velocity rules never trigger because no device repeats.
Why spoofed fingerprints are hard to catch
Basic fingerprinting trusts what the device says about itself. It reads the values, hashes them and compares the hash. That is exactly the layer spoofing tools rewrite, so a check that only reads reported values will always see what the tool wants it to see.
Rotation also breaks the usual logic of fraud rules. Most rules ask "have we seen this device before?" and a rotating actor always answers no. Blocking unknown fingerprints is not an option, because every real customer on a new phone or a fresh browser update is unknown too. The answer is to stop asking whether the fingerprint is new and start asking whether the device behind it is.
Signals that expose a spoofed device
A tool can change what a device reports. Keeping every layer consistent is much harder.
Claims that contradict each other
A browser reports a phone screen with a desktop graphics card, or fonts that do not ship with the claimed operating system.
Reported vs measured
The device says it has one graphics chip, but the way it actually draws shapes and text matches another.
Device and network disagree
The timezone and language say one country, while the connection and its route say another.
Too random, too clean
Values drawn from a template: perfectly common combinations, noise that changes every page load, or empty storage on every visit.
Stable parts under changing ones
Some traits are hard to fake and rarely change. When they stay the same while the surface fingerprint rotates, it is the same device.
The same hands
Typing rhythm, pointer movement and the path through the site stay the same across fingerprints, because the same person or script is behind them.
A new visitor vs a rotating actor
Genuinely new visitor
- Device claims agree with how it renders and behaves
- Network and timezone tell the same story
- Fingerprint stays stable on later visits
- No link to earlier accounts or devices
Rotating actor
- Reported values contradict each other or the hardware
- New proxy exit with each new fingerprint
- Surface fingerprint changes, deeper traits stay put
- Same behavior as accounts seen before
Legitimate spoofing and false positives
Not every changed fingerprint is fraud. Some privacy browsers add small random noise to values such as canvas output to stop tracking. Browsers that aim for uniformity make every user look alike. Browser updates, new monitors, docking stations and travel all change a fingerprint honestly. Developers and QA teams switch user agents all day.
The difference is intent and pattern. Privacy protection changes a few values in known ways and does not come with a new proxy, a new account and a bonus claim each time. A good system recognizes those browsers for what they are, weighs rotation together with network, behavior and what the visitor is trying to do, and steps up only when the combination points to abuse.
How to detect device spoofing: a checklist
The aim is not to catch every changed value. It is to recognize the same device and the same actor, whatever the surface says, and to decide at the moments that matter: signup, login and reward claims.
- Never use the fingerprint as the identity. Use it as one piece of evidence about a device.
- Compare what the device claims with how it actually renders, behaves and connects.
- Count rotations per actor. A returning device with a new fingerprint is a finding, not a new visitor.
- Link accounts by the traits that are hard to change together: deep device traits, network, behavior and history.
- Treat known privacy browsers as context, and escalate only when rotation meets a reward, a new account or a risky login.
- Step up with verification when evidence is mixed, and block only when layers clearly contradict each other.
Related reading: fingerprint rotation and device spoofing in the glossary, and how the same evidence stops multi-accounting.
Sources
- Eckersley, EFF: How Unique Is Your Web Browser? (Panopticlick study, 2010)
- Vastel et al., USENIX Security 2018: FP-Scanner, the privacy implications of browser fingerprint inconsistencies
- Brave: Fingerprint randomization (2020)
- Tor Project: The Design and Implementation of the Tor Browser
- Google Play Console Help: Advertising ID
How Kavra helps
How Kavra catches spoofed and rotating devices
Kavra analyzes 3,000+ data points on every visit and looks for contradictions between layers, so a changed fingerprint does not make a changed actor.
Rotation is a signal
A device that changes its fingerprint but stays the same actor is kept as one actor with N rotations, not N new visitors.
Contradictions between layers
Device, browser integrity, network and behavior are checked against each other. A disguise that fools one layer rarely fools all of them.
The real connection
Kavra's own edge network sees how the device actually connects, not only what the browser claims, and its proxy intelligence flags rotating exits.
Identity and device linking
Returning devices are recognized across visits and accounts, with trusted devices per account and logins compared with each account's own history.
Privacy by design
Visitor IDs are opaque and the fingerprint is never the identifier. No names or emails are required, and data is never shared across customers.
Explained, adjustable decisions
Each assessment shows the rotation count and the findings behind it. Allow, verify or block with your rules, or start in observe-only mode.
FAQ
Frequently asked questions
Something else? Talk to our team.
Can a device fingerprint be faked?
The reported values can. Antidetect browsers, extensions and device ID changers rewrite screen, graphics, fonts, timezone and device IDs. What is hard to fake is consistency: every claim has to agree with how the device actually renders, behaves and connects. Detection that checks those layers against each other catches most spoofed devices even when each value looks plausible.
What is fingerprint rotation?
Fingerprint rotation is changing a device's fingerprint on every visit or every account, so one machine appears as many new devices. It is used to reset device limits, claim one-time offers again and return after bans. Kavra treats it as a signal: the actor is kept as one, with a count of how many times it rotated.
Is using a fingerprint spoofer illegal?
Using a privacy tool that changes your fingerprint is generally legal, and many people do it to avoid tracking. It becomes a problem when spoofing is used to break terms of service, claim offers repeatedly, evade bans or commit fraud. Businesses usually respond by closing accounts and withholding rewards rather than by legal action.
Will privacy browsers be flagged as spoofed?
They should not be blocked for protecting privacy. Privacy browsers change a few values in known, consistent ways, and good detection recognizes them. Risk rises when rotation comes with other evidence, such as a new proxy exit, a new account and a bonus claim on each visit. That combination points to abuse; privacy alone does not.
How is device spoofing detected on mobile apps?
On mobile, spoofing usually means a rooted or jailbroken phone with tools that change the model and device IDs, or an emulator posing as a phone. A native SDK can compare the claimed hardware with how the device behaves and connects, notice modified environments, and link a reset device back to its earlier history.
Why not just block every new fingerprint?
Because real customers produce new fingerprints all the time: a new phone, a browser update, a new monitor or a borrowed laptop. Blocking unknown fingerprints punishes them and barely slows fraudsters, who rotate anyway. The better question is whether the device behind the new fingerprint is one you have seen before.
See who is really on your site.
Run Kavra on your own traffic in observe-only mode. No risk to your customers, and a clear report of the fraud it finds.