Location, Location, Location: The Signal Fraud Struggles to Fake
An interview with André Ferraz by Sean Murphy
The property trade has a mantra, that the three things which determine the value of a home are location, location and location. It has always described houses. It now describes, in André Ferraz's account, one of the more effective tools in the fight against online fraud, although the benefit of location is probably not what you expect.
André Ferraz is the co-founder and chief executive of Incognia, a company that sells fraud detection built on where a device is and how it behaves rather than on who is holding it. That distinction sits at the centre of his argument about why much of the industry has been fighting the wrong battle. For years, fraud teams have leaned on digital signals: the fingerprint of a browser or a handset, the cadence of someone's typing, the tilt and swipe patterns meant to mark one user apart from another. Ferraz's contention is that these signals are ageing badly. Fraudsters have learned to spoof a GPS coordinate, to reset a device so that it looks factory-fresh, to mimic the behavioural tics that were supposed to be hard to counterfeit. His point is that a defence built on signals fraudsters can reproduce will always have a short shelf life; fraudsters always adapt.
What is harder to reproduce is the context around location. A phone does not sit in a vacuum. It sits in a room, surrounded by the same router, the same television, the same tangle of a household's other devices, night after night. The pattern of what a device is habitually near, the constellation of networks and hardware within reach of it, is far more difficult to fake at scale than a single location pin. A fraudster can move a coordinate easily enough. Reproducing the pattern of a real person's home, the specific mix of devices and networks it sits among, across thousands of fake accounts is a far harder problem.
This reflects Incognia’s broader approach to fraud prevention: traditional device fingerprinting is no longer sufficient as the primary signal for fraud decisions. It can still play a role, but increasingly as a supporting signal within a broader set of intelligence signals. As Ferraz put it at the time: “The era of device fingerprinting is over".
Ferraz’s point is similar to the shift from fingerprints to DNA in forensics: device fingerprinting still has value, but it no longer belongs at the centre of the fraud decision. In Incognia’s approach, fingerprinting serves as a supporting signal, while location intelligence, tamper detection, and persistent device recognition carry more of the decision-making. Together, those signals can preserve continuity even through the tricks fraudsters use to make the same device appear new.
Where a fingerprint fractures into ten apparent devices, Incognia is able to recognise a single device returning under fresh disguises. The same recognition is meant to cut both ways, sparing genuine customers repeated identity checks when they come back on a new handset.
That capability matters most against organised fraud. Fraud today is run as an industry, from device farms and account factories where handsets are cycled through the same physical space to spin up fake accounts and cash out stolen funds.
Incognia's own research points the same way, describing a growing industrialisation of financial crime, with recurring fraud, where the same weak points are hit repeatedly. A room packed with handsets cycling through the same few networks is not a household, it is a business, and it is the kind of anomaly that Incognia is uniquely equipped to tackle.
None of this would count for much in Europe if it collapsed the moment it met a data protection regulator. Ferraz describes himself as an advocate for user privacy while running a company whose stock in trade is location and device behaviour, and he squares the two by pointing at what Incognia does not collect. The system does not ask for a name, an email address, a phone number or a government identifier. To Incognia, a customer's phone is closer to an anonymous token than a named person, and Incognia assesses whether an interaction fits a device's established pattern without trying to work out who the person behind it is.
In May, announcing that Incognia had become the most downloaded fraud prevention software development kit in Europe, Ferraz framed the growth around the continent's appetite for data minimisation, saying that companies “no longer see privacy and fraud prevention as competing priorities.” The tools winning trust, in his opinion, are the ones that ask for less personal data rather than more.
As payments increasingly settle in real time, the window to stop a fraudulent transaction has narrowed to the moment it happens, leaving little room for the slower, after-the-fact review older systems relied on. Ferraz's wager is that the ordinary physical context around a device, the networks and hardware it habitually sits among, can be read fast enough for that world while infringing less on the privacy of users.
