TI-2026-061F — The Print You Can't Wash Off

Classification: HIGH · Persistent Tracking · Device Fingerprinting / "Fraud Prevention" Confidence: HIGH on the mechanism and the intelligence precedent (OWASP, Vault 7 Codex); MEDIUM on specific corporate ownership links, all from public reporting. TLP:WHITE — public tooling, public research, public leaks. Series: The Fake Umbrella — Part F. F is for "Fraud prevention." It sounds like it is on your side. Its product is a mark on your device that you cannot see, cannot decline, and cannot wash off. Facts are facts. They are good for some and bad for others. You decide.

The seed: a spy agency and a "fraud" vendor wrote the same spec

Read this line and guess who wrote it:

"…utilizes a collection of distinctive values to generate a loose fingerprint to attempt to uniquely and repeatably identify a particular target … [balanced against] the sponsor's need to avoid heuristic signatures."

That is not a marketing page for an anti-fraud SDK. It is Codex, a CIA tooling specification published in the WikiLeaks Vault 7 leak — a covert utility for fingerprinting a surveillance target so precisely, and so quietly, that the target never notices. Now read the sales copy of a modern "device intelligence" vendor: identify a returning visitor uniquely and repeatably, even in incognito, even after they clear cookies, without them knowing. Same sentence. Same technique. One is called espionage; the other is called "fraud prevention."

That collision is the whole of Part F. The most reassuring word in the consumer-security lexicon — fraud prevention — is built on the identical mechanism a spy agency designed to covertly tag a human being. Whether it protects you or marks you is not a property of the code. It is a claim about intent that you have no way to check.

What the thing actually is

Strip the brand names and here is the machinery. Your browser, to render a page, must expose thousands of tiny truths about your machine: how it draws a line of text on a hidden canvas (the canvas hash), which GPU string your WebGL reports, how your audio stack processes a test tone, your fonts, your screen, your client hints — and at the network layer, your JA3 / HTTP-2 handshake shape. None of these is secret; all of them together are almost unique. Combine them and you get a stable hash — a number that identifies your specific device with no cookie, no login, no permission prompt.

OWASP's own defensive cheat sheets document every one of these signals. The technique is real and, in narrow defensive doses, legitimate. But note what makes it different in kind from a cookie:

• A cookie can be seen, blocked, inspected, and deleted. Consent law (GDPR/ePrivacy) attaches to it. It expires.
• A fingerprint is computed from properties your browser must reveal to work. It has no UI, no toggle, no expiry, and no delete button. You cannot see it, decline it, or clear it — because there is nothing to clear. It is inferred from you, not stored on you.

The "fraud prevention" industry took the un-clearable tracker that privacy researchers spent a decade warning about and rebranded it as a shield.

"Survives incognito, survives cookie-clearing" — the confession in the brochure

The tell is that the vendors advertise the abuse as the feature. The flagship pitch of a device-intelligence product — FingerprintJS/Fingerprint and its peers — is a persistent visitor identifier that works in incognito mode, works after the user clears cookies, and holds across sessions, at high stated accuracy. Read that as a user, not a buyer: every capability listed is a description of your loss of control. "Survives incognito" means your private-browsing mode does not protect you from us. "Survives cookie-clearing" means the one control you were given does not work. "Persistent" means forever.

Privacy researchers named this years before it wore the "fraud" label. Samy Kamkar's "evercookie" (2010) demonstrated a tracker engineered to respawn after deletion. The 2014 study "The Web Never Forgets" (Acar et al.) caught canvas fingerprinting deployed across thousands of top websites as exactly this: a supercookie users could not see, clear, or refuse. Nothing about the technique changed when it was rebranded. Only the sentence in front of it did — from "tracking you can't escape" to "protecting you from fraud."

Who owns the shield

Here is where "fraud prevention" stops being a euphemism and becomes an architecture. The largest fraud-fingerprint networks do not stand alone — they sit inside surveillance data brokers.

Look at the top row and the last row: the same corporate parent (LexisNexis) that runs the "fraud prevention" fingerprint on your bank's login page also sells data services to ICE. The device ID you were told protects your account is a node in the identity graph that broker monetises elsewhere — and, per 061D, location and device-ID resolve to the same person. The "fraud" fingerprint is not a walled-off safety feature. It is a new, un-clearable primary key for the commercial surveillance dossier the previous letters already described.

The seven questions

Who is this? Device-fingerprinting / "identity trust" firms — FingerprintJS/Fingerprint, ThreatMetrix (LexisNexis), iovation (TransUnion) — selling persistent device identity as anti-fraud.

Why did it attack? No packet-level attack; a tag. It marks your device with a durable identifier so it can be recognised anywhere the SDK is embedded.

Who does it claim to be? Your protector — stopping account takeover, card fraud, and bots on your behalf. The friendliest possible framing of an un-clearable tracker.

Whom is it related to? Ad-tracking supercookies (same technique), surveillance data brokers (same owners), and — most damningly — the CIA's Vault 7 Codex (same mechanism, covert target-tracking).

Where is the money? SaaS fees to banks, retailers and platforms and the value the fingerprint adds to the parent broker's identity graph. The person being fingerprinted is, again, the inventory, not the customer.

What is the official anchor? "Legitimate interest" and "security" carve-outs that exempt fraud-fighting from the consent rules cookies must follow — legality by exemption.

What if it is not who it claims? It is who it claims — a fraud tool. The finding is that a fraud tool built on covert, un-clearable, broker-owned identity is a surveillance instrument, whatever the label on the invoice.

What if…

• What if fraud is real and expensive, so this is necessary? Fraud is real and this stops some of it — granted. But necessity for the bank is not consent from the user, and "we needed it" has never in this series licensed an un-auditable, un-clearable, broker-owned tracker on every honest visitor as the price of catching the few.
• What if it's just a hash, not personal data? A stable, cross-site, unique hash is personal data — it re-identifies. That is its function. "It's only a number that always means you" is not anonymity; it is a name in a lab coat.
• What if users who fear it can just block it? They largely cannot — that is the advertised point. Fingerprinting resistance is a specialist arms race (Tor Browser, aggressive anti-fingerprint modes) that breaks ordinary browsing; for the normal user there is no toggle, because the vendors built it so there wouldn't be.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Device fingerprinting is essential, privacy-preserving fraud defence. It stops account takeover, payment fraud and bot attacks that cost billions and hurt ordinary people. It uses a hashed device signal, not names; it runs under legitimate-interest security exemptions; it protects the very users it fingerprints. Without it, online banking and commerce drown in fraud."

Where it breaks:

• "Privacy-preserving" collides with the value prop. A tool whose selling point is surviving incognito and cookie-clearing is not privacy-preserving; it is privacy-defeating by explicit design. You cannot market the un-clearability and then claim the un-clearability is respectful.
• "Just a hash" is exactly the supercookie 'The Web Never Forgets' warned about. A persistent cross-site unique ID is the textbook tracking identifier — academia flagged it as such a decade before "fraud" was stamped on it.
• "Protects the user" ignores who owns it. When ThreatMetrix belongs to LexisNexis (an ICE supplier) and iovation to a credit bureau, the fingerprint is not a ring-fenced safety feature — it is a new primary key in a surveillance dossier. Protection and profiling share the same database row.
• The one true thing: fraud defence is a genuine need, and narrow, transparent, first-party, non-persistent signals can serve it. That legitimate core exists — and it is the fig leaf for a persistent, third-party, broker-owned, un-clearable identity that goes far beyond it. The need is real; this implementation is a tracker wearing the need as a coat.

Verdict: targeted, transparent, first-party fraud signals are legitimate. The industry as built — persistent, covert, un-clearable device identity, mechanically identical to a spy agency's target-tracker and owned by the brokers who sell surveillance — is HIGH. "Fraud prevention" is not a mitigation. It is the friendliest available name for a mark you cannot wash off. Confidence: HIGH on mechanism and precedent; MEDIUM on the specific ownership links, all publicly reported.

Read between the lines

The genius move was choosing an enemy no one defends. Say "tracking" and people recoil; say "fraud prevention" and they thank you — so the same un-clearable identifier that the ad-tech world had to fight cookie-consent laws to keep was quietly relicensed under a word that makes objection sound like siding with criminals. And notice the ownership pattern is not incidental: fraud-fingerprint firms keep being bought by data brokers and credit bureaus. That is not diversification. A persistent, cross-site, un-clearable device key is the single most valuable joining-column a commercial identity graph can have — it welds a person's sessions together across every site that embeds it. The brokers did not buy a fraud tool. They bought a primary key for you, and "fraud prevention" is the receipt that made the purchase sound protective.

The human layer

An abuse survivor opens a private-browsing window to look for a shelter, deliberately, carefully, the way she was taught — new window, no history, clear everything after. She believes, because she was told, that incognito means invisible. But three of the sites she visits embed the same "fraud prevention" SDK, and it computed the same device fingerprint each time, and stitched the three visits into one identifier that does not care that she cleared her cookies, because there were never any cookies to clear. Somewhere she is now a single, persistent, cross-site entity — the same kind of entity the CIA's Codex was built to make of a target — assembled by a company that told her, if it told her anything, that it was keeping her safe. She did everything right. The tool was designed so that doing everything right would not be enough. That is not a failure of the product. It is the product working.

Defense — treat "fraud prevention" as tracking until proven otherwise

(1) For readers/users: know that incognito does not stop fingerprinting; if anonymity is safety-critical, use tooling built to resist it (e.g., Tor Browser) and assume every other browser is fingerprintable. (2) For builders: if you must fight fraud, prefer first-party, transparent, short-lived, disclosed signals over embedding a third-party persistent-ID SDK — and read who owns the vendor before you make their fingerprint your users' primary key. (3) For policymakers: consent and deletion rights were written for cookies and do not reach fingerprints; close that gap so an un-clearable identifier is regulated by what it does (persistent tracking), not what it is called ("security"). (4) For everyone: when a company says "fraud prevention," ask the same question as with "analytics" and "ethical" — what un-nameable thing is this friendly word standing in front of? Here, it is a print you can't wash off.

Investigation metadata

Next — TI-2026-061G: G is for GreyNoise — the "internet observatory" firms (GreyNoise, Shodan, Censys) that watch who scans the whole internet, and sell the watching back — the observers you are not allowed to observe.

A cookie you can delete. A fingerprint is inferred from the way your own machine draws a letter, and there is nothing to delete — which is exactly why they sell it. The same technique a spy agency built to mark a target, sold to you as protection, owned by the brokers who profile you. "Fraud prevention" is the kindest possible name for the one identifier you were never allowed to refuse. Facts are facts. They are good for some and bad for others. You decide.