Also known as: Browser Fingerprinting, Device ID, Digital Fingerprinting
Device fingerprinting is a tracking technique that identifies a specific device by combining dozens of hardware and software signals — screen resolution, GPU, browser version, time zone, language, installed fonts, and more — into a single, near-unique identifier. Brokers use it to recognise a returning user even without cookies or a login.
Unlike a cookie, which the user can delete, a fingerprint is inferred passively from attributes the browser exposes on every page load. A modern library such as FingerprintJS or Seon hashes 30–100 such signals into one ID that stays stable across sessions. Studies by the Electronic Frontier Foundation found that a typical browser fingerprint is unique among hundreds of thousands of others, so clearing cookies or switching to Incognito mode does little to hide it.
In retail brokerage, the fingerprint is the backbone of multi-account and bonus-abuse detection. When a user opens a second account to claim a deposit bonus again, the broker's fraud engine sees the same GPU signature, canvas hash, and font list, and links the two accounts even if the name, email, IP, and payment card differ. For an IB, the same technology maps referred clients back to the partner's own device.
A concrete example: a broker offering a $30 no-deposit bonus per new account might see 12 registrations over one week that all share the same canvas hash and audio-context fingerprint. The fraud system merges them into one identity, voids 11 of the 12 bonuses, and clawbacks any CPA paid to the affiliate who sent them.
On page load, a script reads attributes the browser voluntarily exposes: user-agent, screen and colour depth, installed fonts, WebGL/GPU renderer, audio stack, time zone, and language. It also runs active probes — drawing hidden text to a canvas (canvas fingerprinting) or rendering a 3D scene (WebGL fingerprinting) — because tiny differences in GPU and driver produce a consistent, device-specific output.
These signals are hashed into one identifier and stored server-side. Each new session is matched against the stored set; a high-similarity match links the sessions to the same device. Because the ID survives cookie deletion, VPN switches, and Incognito mode, it is far harder to evade than IP- or cookie-based tracking, and fraud engines weight it heavily when scoring account linkage.
A JavaScript agent reads passive attributes (user-agent, screen, fonts, time zone) and runs active probes (canvas, WebGL, audio) on the client.
The collected signals are normalised and hashed into a single stable identifier, sometimes with a confidence score.
The ID is stored server-side and every future session is compared against it to detect returning or linked devices.
When one device maps to multiple accounts, the fraud engine raises a linkage flag, voids duplicate bonuses, and holds affiliate commissions for review.
Why it matters for partnership: Brokers use device fingerprinting to catch multi-account and self-rebate fraud, so registering fake or duplicate accounts from your own machine is flagged instantly. Clean, one-device-per-client traffic protects your commissions and partner tier.
An affiliate sends 15 sign-ups to XM's partner program in one month. The broker's fraud stack, running FingerprintJS, detects that 9 of them share an identical canvas hash and GPU renderer — all created on the partner's laptop. XM voids the 9 duplicate accounts and clawbacks roughly $400 in CPA, then downgrades the affiliate's tier pending a traffic review.
| Method | User can evade? | Persistence |
|---|---|---|
| Device fingerprint | Very hard | Survives cookie wipe, VPN, Incognito |
| Cookies | Easy (delete) | Lost on clear or new browser |
| IP address | Easy (VPN) | Changes with network or proxy |
Never register client accounts on your own computer or phone — the shared fingerprint reads as affiliate self-dealing and voids the commission.
Assuming that clearing cookies or using Incognito mode hides your identity — modern fingerprinting ignores both and still links your accounts.
No. A VPN only masks your IP address. Your fingerprint is built from your device's hardware and browser attributes, which stay the same behind any VPN.
Barely. Private mode clears cookies and history but exposes almost the same hardware and browser signals, so the fingerprint remains highly recognisable.
It is widely used, but under GDPR and ePrivacy rules it can require consent and disclosure. Brokers typically cover it in their privacy policy and terms.
They likely registered from the same device or shared computer, producing a matching fingerprint. Ask clients to sign up on their own devices.
Rarely, but identical off-the-shelf devices with default settings can collide. Fraud engines combine the fingerprint with IP, behaviour, and payment data to reduce false positives.
Repeated test registrations on your own device create linked accounts and can trigger a fraud review. Use a broker-provided demo or sandbox instead.