Device ban: how to block a repeat offender so the ban survives a new account
A device ban makes a ban stick to the device, not the account, so a banned user cannot walk back in under a fresh email. How it works and how to build it.
Vasil Makarchuk is the Chief Technology Officer at ShieldLabs with 10 years of experience in engineering and building scalable systems for online businesses.
Vasil Makarchuk's articles
How to prevent referral fraud
What referral fraud is, the main types from self-referral to account farming, why it is hard to catch, and how the device behind fake referrals stops it.
How to prevent loyalty fraud
What loyalty fraud is, the main types from points theft to fake-account farming, why rewards programs are targets, and how device signals help stop it.
How to prevent gift card fraud
The merchant side of gift card fraud: how fraudsters cash out stolen cards, farm gift-card promos, and how the device behind those accounts links them.
How to prevent buy now, pay later (BNPL) fraud
What BNPL fraud is, the main types from account takeover to loan stacking, why the model is so exposed, and how to prevent it with device-level signals.
The 8 best bonus and promo abuse prevention tools in 2026
The 8 best bonus and promo abuse prevention tools in 2026, how prevention works by linking many bonus claims back to one person, and how to choose.
The best affiliate fraud detection tools in 2026: traffic and identity
The best affiliate fraud detection tools in 2026, split into traffic and click-fraud tools that score clicks in real time and device and identity tools that catch self-referral.
The best device fingerprinting solutions in 2026: build vs buy
The best device fingerprinting solutions in 2026, split into open-source libraries you self-host and commercial solutions that maintain the identifier and add fraud signals.
The 8 best free-trial abuse prevention tools in 2026
The 8 best free-trial abuse prevention tools in 2026, how prevention works by linking many trial signups back to one device, and how to choose.
How to prevent fintech fraud: the device layer across the fraud types
The fintech fraud types from new-account and synthetic identity to account takeover, payment and BNPL abuse, and mule accounts, and where the device layer fits.
The 8 best new-account fraud detection tools in 2026
The best new-account fraud detection tools for 2026, how signup-fraud detection links many fake accounts back to one device, and how to choose the right layer.
The 7 best anti-detect browser detection tools in 2026
The best anti-detect browser detection tools for fraud teams in 2026, how detection spots spoofed and tampered browser fingerprints, and how to choose.
How website visitors are counted: Google Analytics, Vercel, and ShieldLabs compared
Why your visitor counts never match across tools. How Google Analytics, Vercel, and ShieldLabs each identify a visitor, and which count is closest to the truth.
Brute force vs credential stuffing vs password spraying: how they differ, and how to detect each
Brute force, credential stuffing, and password spraying all hit your login, but differ in what the attacker knows. The difference, and how to detect each.
How to detect fake reviews
What review fraud is, the main types of fake reviews, why the text alone won't catch them, and how the device behind a review ring gives it away.
Free-trial abuse vs API-key abuse vs rate limiting: which layer stops what
Free-trial abuse, API-key abuse, and rate limiting get blamed for each other. Which layer stops what for an AI API, who owns each fix, and where the gap is.
7 CAPTCHA alternatives for 2026: stop abuse without blocking real users
The 7 best CAPTCHA alternatives for 2026, from silent device intelligence to invisible challenges, and how to stop abuse without blocking real users.
How to prevent promo abuse in ecommerce
How to prevent promo abuse in ecommerce: the tactics behind discount farming, the signals that flag it, and how to score a redemption before you grant it.
How to prevent free-trial abuse in AI companies: a developer's guide
How AI companies prevent free-trial abuse: the credit-farming economics, the signals that expose a farmed signup, and how to score it at the API.
The 13 best device intelligence platforms in 2026
A practical guide to the best device intelligence platforms in 2026, how to evaluate them, and which fit self-serve teams versus enterprise fraud stacks.
How to stop new-account fraud at signup
How to stop new-account fraud at signup: the abuse-and-evasion kind, why email checks and CAPTCHA miss it, and how to score a registration before it exists.
How to prevent affiliate fraud
What affiliate fraud is, its main types from cookie stuffing to fake leads and self-purchases, and how the device behind a fake conversion gives the ring away.
The 10 best multi-accounting detection tools in 2026
The 10 best multi-accounting detection tools in 2026, how detection works by linking accounts to a shared device and network, and how to choose.
The 14 best account takeover detection tools in 2026
The 14 best account takeover detection tools in 2026, how ATO detection works, and how to choose across device, behavioral, identity, and bot defenses.
Synthetic identity fraud: what it is and how to detect it
What synthetic identity fraud is, how the fabricated-identity lifecycle works, why it is so hard to detect, and how device signals expose the ring behind it.
The 8 best fraud detection software in 2026
The 8 best fraud detection software in 2026, what to look for, and how the options differ across device signals, decisioning, and chargeback protection.
IP fraud scores explained: Talos, Scamalytics, and IPQS
What an IP fraud score means, how Talos, Scamalytics, and IPQS calculate it, why yours can be high through no fault of your own, and what a score misses.
How to detect geolocation spoofing and prevent fraud
How to detect geolocation spoofing: how it works, why a single IP check fails, and how layered signals expose the mismatch so your team can prevent fraud.
Cookieless device identification: how to recognize a returning device without cookies
What cookieless device identification is, how it recognizes a returning device without a stored cookie, and why it is not the same as cookieless analytics.
Will iCloud Private Relay and Chrome IP Protection break your fraud detection?
What iCloud Private Relay and Chrome IP Protection actually change for fraud detection: what degrades, what survives, and why masking is not evasion.
How to prevent friendly fraud with device evidence
Friendly fraud is when a real customer disputes a purchase they made. How it works, why it is hard to prove, and how device evidence helps you fight it.
What is TLS fingerprinting? How JA3 and JA4 identify a client
TLS fingerprinting identifies the software behind a connection from its TLS handshake. How it works, what JA3 and JA4 are, and what it reveals.
Account takeover detection for web apps: the signal layer at login
How to detect account takeover at login: the device and network signals that flag a suspicious login, why MFA alone misses them, and where the gap is.
What is WebRTC fingerprinting? How it reveals a real IP behind a VPN
WebRTC fingerprinting uses a browser's real-time connection setup to expose network data, including a local or real IP behind a VPN. How it works.
What IP reputation is, and why an IP score alone won't catch fraud
What IP reputation is, how the 0 to 100 score is built, and why a clean IP score alone will not catch fraud. The lagging, shared, and recycled-IP problem.
JA4 fingerprinting explained: how it improves on JA3, and what it actually identifies
What JA4 fingerprinting is, how it fixes JA3's weakness to TLS randomization, the JA4 string format and JA4+ suite, and what it can and cannot identify.
How to detect VPNs in 2026
How to detect VPNs in 2026: the methods that actually work, why an IP check alone fails, and how masked traffic ties to abuse and risk.
What is device fingerprinting? How it works, signals, and uses
What is device fingerprinting: the signals that make up a device fingerprint, how the recognition works across browsers, web vs mobile, and what teams use it for.
Proxy detection for fraud prevention: how to identify hidden traffic sources
How proxy detection works for fraud prevention: 13 techniques, why residential proxies are hard to spot, and why an IP check alone is never enough.