Use cases
"Have I seen this device before?" Answered without cookies, scored server-side, and shaped to the fraud you are actually fighting.
Stolen credentials arrive from unfamiliar devices at scale. Passwords alone cannot tell an owner from an attacker who knows the password.
Bind each account to the devices it normally uses. A login from a device the account has never presented is a clean, low-false-positive step-up trigger.
One person spins up dozens of accounts to farm sign-up bonuses, free trials, or referral rewards, each with a fresh email and cleared cookies.
Cleared cookies do not reset the device. When many "new" accounts resolve to one visitorId, the pattern is obvious before you pay out.
Card testing and stolen-card checkout look legitimate per-transaction. You only learn the truth weeks later, as a chargeback.
Score the device at checkout: a first-seen device rapidly cycling cards, or one already linked to disputes, gets held for review instead of shipped.
Automation drains inventory, scrapes pricing, and stuffs forms, rotating IPs and user agents to stay under rate limits.
Headless and automated clients carry tell-tale signals. Flag isBot and datacenter origin at the edge, before the request touches your app logic.
Blanket 2FA on every login taxes real customers and tanks conversion, while lax auth invites takeover.
Skip friction for a device an account has used safely for months; require a second factor only when the device is genuinely new or risky.
Serial free-trial resets and self-referral loops quietly inflate cost and corrupt growth metrics.
Tie trial eligibility and referral credit to the device, not the email. The same device claiming its tenth "first" trial simply does not qualify.
They all reduce to the same call. Run the demo, read the response, and map the signals to your rules engine.