A familiar device isn’t the whole story: Where device intelligence fits in fraud prevention

Most of us expect our bank to recognize us. We also expect it to notice when something is wrong.

Those expectations meet at the device. The phone we use to check our balance, the laptop we use to pay bills, and the browser we return to each week all provide context that can help a financial institution decide how much confidence to place in an interaction.

But familiarity only takes that decision so far. A customer can replace a phone and remain perfectly legitimate. A fraudster can gain access to a familiar device. And a customer can use their own phone to make a payment under a scammer’s direction.

At Entersekt, we see device intelligence as an essential contributor to fraud prevention. Its greatest value comes from understanding what it reveals, where its visibility ends, and how it informs the next decision.

In the first article in this series, we explored why effective protection requires multiple signals. In this article, we unpack why device intelligence is a practical place to begin: because every digital banking interaction happens somewhere. 

What the device can tell us

Device intelligence helps institutions assess the environment in which an interaction takes place.

Depending on the channel, operating system, permissions, and technology deployed, it can contribute evidence about:

• Recognition: Has this device or browser been associated with the customer before?

• Integrity: Are there signs of tampering, emulation, or a potentially compromised environment?

• Connections: Is the device associated with suspicious activity across other accounts?

• Network context: Does the connection introduce anomalies that warrant closer attention?

• Remote access: Are there observable indicators of tools that could allow another person to view or control the interaction?

No solution has equal visibility into every environment. A mobile banking app and a browser session may expose different evidence. The purpose is to build a more informed assessment of the interaction—and give the institution a better basis for acting.

Recognition and binding provide different assurance

It is also worth separating device recognition from device binding. Device fingerprinting uses a combination of characteristics to help recognize an environment. That evidence can be useful, but characteristics can change, and some can be imitated. I encourage you to review NIST’s Digital Identity Guidelines on Identity Proofing and Enrollment.

Cryptographic device binding can establish a stronger association by linking an account or registered authenticator to a key held in a particular device or application environment. Entersekt’s browser authentication approach includes securely linking a browser instance to a known user identity.

Even that stronger association answers a bounded question: evidence that the registered device is present does not establish that every action taken through it is safe.

Two customers, two very different decisions

Imagine a customer unboxing a new phone one Saturday morning. They install their banking app and sign in. The device is unfamiliar, but that is exactly what we would expect after an upgrade. A blunt rule could turn that moment into a blocked login and a support call. A more considered approach would use the unfamiliar device as a reason to establish assurance through secure registration, appropriate authentication, and identity verification where needed.

Now consider another customer using the phone they have banked with for two years. Someone claiming to be from the bank persuades them to install a remote-support tool and transfer money to a “safe account.” The device is familiar. The customer may successfully authenticate. But the payment is still dangerous.

Where available, remote-access indicators could contribute to identifying the risk. A new beneficiary, an unusual payment, and changes in the customer’s interaction could add further context. These examples show why device familiarity should influence a decision without settling it.

Trust needs to follow the journey

A device assessment at login is useful. But its relevance must also be considered when the customer changes contact details, registers another authenticator, adds a beneficiary, or initiates a payment.

Consider a session that begins routinely, then moves through account recovery, a phone-number change, and a substantial transfer. The sequence deserves attention even if each individual step has a plausible explanation.

At Entersekt, our view is that risk assessment and authentication should remain connected throughout that journey. Device evidence should inform the decision alongside identity assurance, behavior, transaction details, and relevant activity in other channels. The response should fit the concern:

• An unfamiliar device may call for stronger authentication.

• Suspected manipulation may call for a targeted warning, a pause, or review.

• Asking a deceived customer to approve one more prompt may add little protection.

Better context should improve the experience

Customers should benefit from the intelligence their bank gathers. When device evidence supports confidence in a routine interaction, it can help avoid unnecessary challenges. When the evidence changes, it can help focus protection where it matters.

That requires discipline. Travel, privacy tools, software updates, and replacement devices all have legitimate explanations. Institutions need to assess combinations of evidence and the reliability of each signal, rather than treating every anomaly as a verdict.

They should also collect device data for a defined purpose, with appropriate privacy and retention controls. More data earns its place when it improves decisions.

Give device intelligence a clear role

For financial institutions evaluating this layer, three questions are useful:

• What can we observe in each channel?

• How does device evidence change authentication and transaction decisions?

• Can we show better outcomes through fewer losses, fewer unnecessary challenges, or less customer disruption?

Device intelligence gives institutions valuable insight into the environment surrounding a customer. Effective protection connects that insight to the person, the action, and the circumstances.

Our next article in this series will explore the interaction itself: what behavioral intelligence can add when a recognized device and valid credentials leave important questions unanswered.