TL;DR: session-layer ATO detection versus residential proxy
- Core banking fraud engines are excellent at scoring the transaction that has just happened and blind to the device that made it, which is why a valid credential on a residential proxy walks straight past them.
- cside returns device fingerprint, TLS handshake fingerprint VPN status, AI-agent detection and new-device-on-known-account across the three fintech vectors, mapped to $13.5B in US ATO losses in 2025 (18% up on 2024, 6 million consumers affected, per Javelin), all SOC 2 Type II certified.
- If your risk model still treats a clean residential IP as clean, add the session layer. If synthetic identity rings are not on your P&L, keep the rules engine you have.
Bank fraud prevention software has to cover three attack vectors at once: account takeover with stolen credentials, new account fraud at onboarding, and synthetic identity fraud that clears standard KYC. Each of these leaves a signal in the browser that server-side fraud platforms never collect, which is why browser-layer detection has become a necessary complement to core banking fraud infrastructure.
The three primary fraud vectors in financial services
Account takeover is the highest-volume fraud vector in banking. An attacker gets a valid credential pair, usually from a breach or a phishing campaign, and uses it to log in. The credential is correct. The device is not. A real account holder builds up a device fingerprint history over time, while the attacker shows up from a device the account has never seen.
New account fraud targets the account opening process. Fraudsters apply for accounts, credit products, or loans using stolen or synthetic identities built from a mix of real and fabricated data. The goal is to access credit, launder funds, or set up accounts for later fraud use.
Synthetic identity fraud is the hardest of the three to catch at application time. A synthetic identity usually passes standard KYC because it carries enough real data to satisfy verification. The signal shows up in the device pattern. One device opening multiple accounts with different identity details is the signature of a synthetic identity ring.
Where server-side tools have a detection gap
Core banking fraud platforms score transactions and account events with rules engines and machine learning trained on historical data. They work well for spotting anomalous transaction patterns once an account is established and active.
What they do not collect is browser signals. When an attacker uses a valid credential pair from a new device on a residential proxy, the server-side check sees a valid credential, a clean IP, and no transaction anomaly. Every check passes. The device behind the proxy, the browser fingerprint it presents, and the fact that a script may be driving it stay invisible to the server-side layer.
US account takeover losses reached $13.5 billion in 2025, an 18% increase over 2024, affecting 6 million consumers, with financial services accounts as the primary target (Javelin Strategy & Research 2026).
| Year | US account takeover losses |
|---|---|
| 2024 | $11.4B |
| 2025 | $13.5B |
The browser is the one layer where the device mismatch is visible. A browser-layer signal tool collects the device fingerprint, TLS characteristics, and session behavior at page load, before any authentication request fires. That is the gap browser-layer tools are built to close.
Why residential proxies defeat IP-based controls
Per-IP rate limiting and IP reputation checks are standard parts of a banking fraud stack. On their own they are not enough, because residential proxy services hand attackers IP addresses that carry no fraud history.
Residential proxies route attack traffic through real consumer internet connections, so each request arrives on a clean residential IP. Reputation systems have nothing to flag. The attacker rotates IPs between attempts, so per-IP rate limits never trip.
TLS handshake fingerprint TLS fingerprinting identifies VPN and proxy connections from the TLS handshake itself, independent of the IP address. A residential proxy has a consistent TLS handshake fingerprint signature that differs from a standard browser connecting directly. Paired with a new device fingerprint on a known account, that is a high-confidence ATO signal IP-based controls cannot produce.
cside browser-layer signals across each fintech vector
cside browser-layer fraud detection maps to each of the three banking fraud vectors with specific signal outputs.
For account takeover, the device fingerprint shows whether the session comes from a device the account has used before. The TLS handshake fingerprint TLS signal shows whether the connection runs through a VPN or proxy. A new fingerprint plus a proxy connection on a high-value account is a high-priority risk signal. cside also flags AI agents driving the browser session, including Playwright, Puppeteer, OpenAI Operator, and Claude for Chrome, which turn up in automated credential-stuffing campaigns.
For new account fraud, the device fingerprint links multiple applications to the same device even when the applicant clears cookies or switches browsers. One device submitting several account applications with different personal details in a short window is a strong new account fraud signal that identity verification alone cannot produce.
For synthetic identity fraud, the device pattern is the primary signal. A synthetic identity ring creates multiple identities and opens an account with each one. Each identity passes KYC in isolation. Seen across accounts, the device fingerprint ties them back to the same device or a small cluster of devices, which exposes the ring.
Integration with your existing fraud stack
cside returns its signals as a JSON API response. Your existing fraud rules engine reads those signals alongside transaction data, adding a browser-layer feature set to whatever scoring logic you already run.
The integration is a script tag on your login and account opening pages. The script collects browser signals and returns a session token. Your backend looks up the signal set for that token when it processes the authentication or application event.
cside is SOC 2 Type II certified. Cookieless device fingerprinting means no personally identifiable information is stored or transmitted, which aligns with a GDPR legitimate-interest basis and avoids the consent management overhead that PII-based device tracking carries. The certification fits standard banking vendor security assessments.
Compliance posture
SOC 2 Type II certification covers the security, availability, and confidentiality controls around cside's signal collection and processing. This is the certification financial services security teams typically require when onboarding a new vendor.
Cookieless fingerprinting derives the device identifier entirely from browser and hardware characteristics, with no cookie or local storage dependency. The fingerprint stays consistent across sessions without storing PII on the user's device, so GDPR consent requirements for tracking cookies do not apply.
PCI DSS Requirements 6.4.3 and 11.6.1 have been mandatory since March 2025. cside produces a 2-second PCI compliance report validated by a VikingCloud QSA. For banks running payment card programs or card-not-present acceptance, that PCI coverage is an added benefit alongside the fraud signal function.
