Q: Antifraud says my users share a 'device fingerprint.' They're different people — how?

Q: Antifraud says my users share a 'device fingerprint.' They're different people — how?

A: A device fingerprint isn't a serial number; it's a probabilistic profile built from dozens of browser and device attributes. Different people genuinely can share one, and that's worth understanding before you assume a false positive.

The fingerprint is assembled from things like screen resolution, time zone, language, installed fonts, browser version, OS, and canvas/WebGL rendering quirks. Combined, they're usually unique enough to recognize a returning visitor without cookies.

But collisions happen legitimately:

— Stock corporate laptops imaged identically share fonts, resolution, and OS build.
— Default phones of the same model with the same OS version look near-identical fresh out of the box.
— Privacy browsers that deliberately spoof a generic fingerprint make many users look the same on purpose.

So a fingerprint cluster is a flag, not a verdict. The risk rises when the same fingerprint converts many times across different identities fast — that's the farm or emulator pattern, not coincidence.

If your traffic legitimately comes from a uniform device pool (one office, one device giveaway campaign), tell your manager up front so the cluster reads as context, not abuse.

Short version: fingerprints are probabilistic and can collide honestly. It's high reuse across many identities that signals fraud — explain real clusters proactively.

Still stuck? Drop your case in the comments.