Device identity (or device ID) is a persistent, often cryptographically-secured identifier assigned to a specific device, used to recognize it reliably across sessions, establish device trust, and detect fraud. It’s a stronger, more durable cousin of device fingerprinting, where fingerprinting infers identity from observable attributes, device identity can be anchored to a cryptographic key stored on the device, making it far harder to spoof.

Recognizing a device with confidence is enormously useful: a trusted, known device lets a returning customer through with minimal friction, while an unrecognized or suspicious device raises risk. Device identity is how that recognition is made reliable.

Device identity vs. device fingerprinting

The two are related but distinct. Device fingerprinting derives a probabilistic identifier from the device’s attributes (browser, hardware, configuration), powerful but spoofable, since attributes can be faked. Device identity aims for a deterministic, tamper-resistant identifier, often by generating a cryptographic key pair on the device and binding it to that device (see crypto binding). The device proves its identity by demonstrating control of the key, which can’t be copied by simply mimicking attributes. In practice, modern systems combine both: fingerprinting for broad, cookieless recognition, and cryptographic device identity for high-assurance trust.

How device identity supports security

A reliable device identity enables several capabilities: recognizing trusted devices to reduce friction for legitimate users (risk-based authentication), binding passkeys and credentials to a specific device, detecting when an account is accessed from a new or unexpected device (an account-takeover signal), and linking activity across accounts to expose fraud rings using the same device. Because it persists across sessions and resists spoofing better than attributes alone, it’s a durable anchor for trust decisions.

Cryptographic device identity

The strongest form uses cryptography: the device generates and stores a private key (ideally in secure hardware), and proves its identity by signing challenges, with only the public key held server-side. This is the same principle that makes passkeys phishing-resistant, applied to the device itself, the identity can’t be cloned by copying observable traits, because it rests on a secret the device holds. Web-crypto and secure-enclave approaches make this practical across web and mobile.

Device identity in fraud prevention

For fraud teams, device identity turns "is this a device we trust?" into a dependable input. A high-assurance known device can streamline the experience; an unknown device performing a sensitive action can trigger step-up; and a single device masquerading as many can be unmasked. Fused with behavioral and network signals, device identity is a core pillar of the layered detection that distinguishes legitimate customers from fraudsters across the lifecycle.

Frequently asked questions

What is device identity?

A persistent, often cryptographic identifier for a device, used to recognize it reliably, establish trust, and detect fraud.

How is device identity different from device fingerprinting?

Fingerprinting infers a probabilistic ID from attributes (spoofable); device identity uses a tamper-resistant, often cryptographic identifier bound to the device.

How does cryptographic device identity work?

The device holds a private key (ideally in secure hardware) and proves identity by signing challenges, so it can’t be cloned by copying attributes.

Why is device identity important for fraud prevention?

A reliable known-device signal reduces friction for trusted users, flags access from new devices, and exposes one device masquerading as many.

Can device identity be spoofed?

Cryptographic device identity is highly resistant to spoofing because it rests on a device-held key, unlike attribute-based fingerprints that can be faked.

Related: Device Fingerprinting · Crypto Binding · Passkeys · Risk-Based Authentication · Account Takeover (ATO)