Coordinated fraud exploits the gaps between accounts, applications, and payment checks. Here we look at how persistent device intelligence can help payment providers catch abuse earlier and protect legitimate approvals, while strengthening the fraud systems you already use.
—
Every time you stop a fraudulent transaction, you have to wonder how many legitimate payments were declined because the very same anti-fraud tools kicked in after a false positive.
So there’s fighting fraud, and then there’s fighting the unintended consequences of fighting fraud. The very measures you deploy to combat fraud often add unwanted friction to the payment flow, resulting in a degraded experience for customers who simply want to make stress-free payments.
All the customer sees is their payment being impeded for seemingly no reason, while apparently random additional security measures cause frustration and delay. Sometimes users give up without completing a purchase. Yet all of these measures are standard practice for anti-fraud control.
For payment providers, the real challenge is stopping fraud without making legitimate purchases and account access harder for trusted consumers.
But payment providers can’t just throw their anti-fraud tools in the trash. So what’s the way out of this bind? In short, better device intelligence.
In this report, we’ll look at the ways coordinated fraud is evolving across payment platforms, why fragmented visibility between touchpoints accelerates financial risk, and why persistent device intelligence is an essential control point for stopping fraud without raising false positives.
The scale and cost of fraud exposure
Juniper Research forecasts that ecommerce fraud will cost merchants $66.4 billion in 2026. The opportunity for payment providers is expanding too: Juniper projects $100 trillion in global transaction value by 2030 across ecommerce, in-store, and cross-border payments. For providers pursuing a slice of that growth, protecting payment volume and controlling fraud for merchants, issuing financial institutions, and end users must be priorities.
Authentication alone, however, does not close the fraud gap. In Europe, strong customer authentication (SCA) under EU PSD2 rules has reduced card fraud but payment providers rely on exemptions to keep checkout smooth. A report from the European Banking Authority and European Central Bank found that exempted remote card payments generally had higher fraud rates than card payments overall, suggesting fraudsters target transactions likely to skip authentication.
SCA, however, typically only protects the payment itself, not the login, onboarding, or payout change that can come before it. Whether or not SCA applies, the device behind each attempt helps decide when to exempt, when to challenge, and when to decline.
The primary task for all markets is to identify a high-risk payment before approval, giving the responsible merchant or issuer the information to approve, challenge, or decline, while reducing unnecessary friction for legitimate activity.
De-fragmented visibility: Connecting the dots in payment flows
Suppose a checkout system flags a device for repeated card-testing attempts. Later, the same device submits an application to open a merchant account under a newly registered business name. If approved, the fraudster can run validated cards through their own account and withdraw the funds before chargebacks arrive, leaving the payment provider to absorb the losses.
If the checkout and onboarding systems don’t share that device history, underwriting sees a clean application. Connecting that history gives the team a reason to investigate before approval.
EMV 3-D Secure (EMV 3DS), the payments security and authentication protocol, can be a useful tool for verifying legitimate purchaser activity but it doesn’t cover the entire picture. It shares payment and device information to support issuer authentication, but a signal collected inside that flow does not automatically become context for separate login, onboarding, or payout controls.
Persistent device intelligence supplies an additional level of visibility to connect changing cards, credentials, and identities. You can get evidence you need to more confidently assess risk alongside the transaction and account history; shared device use alone does not establish fraud.
> For more detail on this, our payment fraud article explains how isolated signals can leave coordinated activity undetected.
Merchant-side threats: Protecting the merchant portfolio
For merchant-side payment provider risk teams, one goal is to keep fraud out of the merchant portfolio. That means stopping synthetic merchants at onboarding, protecting good merchant accounts, and catching fraudulent payments before approval, all without adding friction for their customers. Card testing, payment fraud, chargeback abuse, synthetic merchant onboarding, and merchant account takeover can all be stages of the same operation.
Here’s how each fraud type poses a problem and how it can be reduced through the use of persistent device intelligence.
| Fraud type | The threat | How device intelligence helps |
|---|---|---|
| Synthetic merchant onboarding | A fraudster opens a merchant account using a synthetic identity. Once approved, they can run stolen cards through the account and withdraw payouts before chargebacks come in, leaving the provider with losses. Fake merchant accounts can also be used to process payments for prohibited goods. | Linking applications to fraudulent history gives underwriting teams a reason to investigate before approval. Where signals indicate emulator use or browser tampering, they add further context to submitted onboarding documents rather than replacing KYB–strengthening existing defenses. > Check out our guide on how to stop new account fraud. |
| Merchant account takeover | Attackers who take over a merchant account can redirect payouts or push stolen cards through an established, trusted account. | A valid login followed by an unfamiliar device changing payout bank details deserves assessment before that change takes effect. A targeted step-up can protect the account while familiar, low-risk merchant access continues without blanket challenges. > Check out our guide on how to stop account takeover (ATO). |
| Card testing | An attacker runs small payment or authorization attempts across multiple cards, which exploits payments infrastructure and creates chargeback exposure. | Looking only at each card or merchant can miss the pattern; linking attempts to a device can expose repeated probing sooner, and bot detection signals flag automated traffic. Catching testing protects both the merchant and the provider. > Read our complete guide to stopping card testing. |
| Payment fraud | Stolen card details can pass basic validation and complete a purchase, generating chargebacks that count against the merchant and provider’s portfolio, with losses often falling to the provider. | A device associated with previous abuse, unusual activity, or repeated attempts adds context before approval. Linking that information with existing decisioning helps providers stop fraudulent payments without treating every returning shopper as suspicious. Fewer fraudulent approvals means fewer disputes across the portfolio. |
| Chargeback abuse / first-party fraud | Cardholders dispute purchases, claiming fraud, inflating chargeback ratios, leaving the provider facing penalties. | Connecting device history with accounts and purchases can reveal repeat behavior and help assemble evidence after a dispute. Providers can evaluate that evidence alongside the claim rather than assuming every dispute is misuse. > Read our complete guide to building better chargeback cases. |
Issuer-side threats: Connecting account access to payment risk
Issuer-side payment providers help bank, credit union, and fintech clients protect cardholder payments and account access. Their priority is to identify risky activity before money moves while avoiding unnecessary cardholder friction. Device context can carry relevant history between issuer portals, cardholder sessions, authentication, and payment decisions.
| Fraud type | The threat | How persistent device intelligence helps |
|---|---|---|
| Client/Issuer portal and cardholder ATO | Valid credentials from phishing and malware can conceal account takeover, both for cardholders and for banking staff who use the provider’s client portal to manage card programs | When a session requests a password reset or attempts to change contact details, the payment provider can reference the session against device history. An unrecognized device can trigger a challenge flow or manual review before downstream fraud occurs. |
| Card testing | Repeated low-value attempts involving different cards can indicate testing, which increases costs and can lead to costly card re-issuance. | Where device signals accompany payment or authentication events, connecting attempts to the same environment gives the issuing risk engine more context than a card-by-card assessment. The issuing client can use that pattern alongside transaction data to intervene before further fraudulent payments are approved. |
| MFA bypass and session hijacking | Fraudsters utilize stolen session tokens to hijack a cardholder’s session, bypassing authentication gates. They can change controls, add a payee, or provision a card to a digital wallet. This can leave the provider’s issuing clients liable for unauthorized transactions. | Comparing the device at login with the device behind a later request can reveal session hijacking, triggering step-up before an action completes. |
| Chargeback abuse / first-party fraud | Cardholders initiate fraudulent disputes, claiming online purchases were unauthorized. This increases losses for providers. | Merchant data shared through Mastercard First-Party Trust and Visa Compelling Evidence 3.0 gives providers useful data to identify first-party misuse. Cross-referencing disputed purchase device data with past, undisputed payments helps providers automate dispute resolution. Device history adds further context. |
Full-service providers: Shared context, distinct decisions
Full-service providers serve both merchants accepting payments and card issuers. Different teams within the same company may choose different fraud tools for each side of the business, because their priorities differ.
Merchant-side risk and product leaders need to assess merchant applications, protect merchant accounts, and help legitimate customers complete purchases. Success means fewer fraudulent payments, stronger checkout conversion, and better merchant retention.
Meanwhile, an issuer-side team might prioritize preventing unauthorized card access, minimizing credit losses, and ensuring compliance.
A merchant-side team might investigate a merchant application linked to earlier card testing; an issuer-side team might challenge a suspicious cardholder login. Each team uses relevant signals within its existing fraud systems and applies its own decision rules and workflows.
Persistent device intelligence can be a useful bridge that gives both teams a record of devices used across logins, applications, and payment attempts.
How to overcome these challenges
1. Break the silos
A fraud warning at checkout should be visible when the same device appears at login or onboarding. Use a persistent visitor identifier to link device activity to the platform’s own account, application and payment records.
For merchant-side teams, a device linked to card testing can prompt investigation of a later merchant application. For issuer-side teams, a cardholder’s previous login activity can help assess a subsequent request to change account details.
Keeping that history useful also requires reliable recognition when someone tries to appear new. Fingerprint’s identification approach supports recognition through cookie deletion, private browsing, and VPN use.
If someone manipulates browser attributes to disguise their device, tampering detection can flag signs of that manipulation. Teams can assess those signals alongside account and payment history to choose an appropriate challenge or review.
2. Shift from reactive to proactive decisions
Use connected activity to step in before another approval or dispute occurs. Fingerprint’s velocity signals summarize activity and linked identifiers over time. This can help distinguish a single attempt from repeated probing, directing the platform toward a challenge, review, or block action, appropriate to the risk.
Trusted history matters too. A traveler in a new location or a returning customer using private browsing may still have recognizable activity that marks them out as trusted, not fraudulent. An unfamiliar device can prompt a targeted step-up instead of treating every customer to the same interruption.
3. Fit the existing stack
Fingerprint enters as additional input to the payment provider’s existing risk, rules, and investigation workflows. This gives engineering teams identifiers to connect signals at the right touchpoints and validate end-to-end latency within the payment flow during integration. Issuing teams can add account and payment context without replacing the entire fraud stack.
Your engineers can then verify those inputs on the server and check their freshness and association with the action being assessed. This helps prevent attackers from substituting or replaying another event’s identity while keeping the decision inside the platform’s established controls.
One payment provider added Fingerprint to its in-house risk engine and reported 30–40% faster fraud detection. It also reported lower monetary losses from preventing fraudulent merchant onboarding.
The aim is to catch risky payments before approval, identify coordinated abuse across the lifecycle and preserve smooth access for legitimate customers. For merchant-side providers, that supports merchant retention and revenue. For issuer-side providers, it strengthens the service delivered to bank, credit union, and fintech clients.
See what persistent device intelligence can do for your business
As fraud continues to evolve across payment platforms, it’s essential teams have tools to support security across their ecosystem. When accounts, onboarding, and payment flows are tightly connected, preventing fraud depends on identifying risk early, before it spreads across systems and services.
Persistent device intelligence provides a way to evaluate risk continuously across the payment lifecycle. By intervening earlier, payment providers can reduce fraud exposure and protect revenue, while preserving the seamless experiences legitimate consumers expect.
To learn more about how persistent device intelligence can support earlier, more precise fraud prevention across payment ecosystems, explore how Fingerprint approaches real-time trust decisions.
Start a free trial | Contact sales
> Want to dig in further on the ways you can protect customer trust as digital financial services scale? Check out our Scaling Trust in Digital Finance report.
