Look at the traces, not the identity.
A forged identity can be convincing; the device behind it, the egress point and the contact details usually are not. Krino derives these traces on every event and offers them to your rules like any other field.
Four sources, one decision.
Device fingerprint
A stable identifier is derived from what the browser reports about itself — screen, language, timezone, platform, plugin set. Clear the cookies, end the session, open a private tab: the same device still appears under the same trace.
- One device, several accounts
- One device, cards tried back to back
- Known-fraud device lists
IP intelligence
The country and autonomous system of the egress point are read from an offline database. Datacenter ranges — which is where most VPN and proxy traffic exits — are flagged separately.
- Country and city
- Datacenter or hosting egress
- Mismatch with the declared address
Email signals
The domain is checked against known disposable and throwaway providers. Variants built with dots and plus-addressing collapse to one address — so ten accounts that look different count as one.
- Disposable provider
- Free provider or corporate domain
- Normalised address matching
Phone signals
The number is normalised to international form, the country and carrier extracted, the line type determined. Virtual and VoIP numbers are flagged as their own category.
- Country and carrier
- Mobile, landline or VoIP
- Country and address mismatch
Why is all of it offline?
Most of these signals are sold as per-query services. Krino reads them from lists held inside your infrastructure, for three reasons.
Privacy
Every outbound query tells a third party that this customer is doing this thing right now. Reading locally removes that entirely.
Latency
A decision inside a payment flow cannot wait on three external responses. Local lookups are measured in milliseconds and survive a vendor outage.
Cost
Per-query pricing makes teams trim their rules as volume grows. A flat licence removes that pressure — look at as many signals as you like.
The lists refresh themselves.
Offline does not mean stale. A scheduled job pulls the IP and email-provider lists from their sources on a regular cadence and swaps them in when the new version is ready. The download only fetches the list — which customer matched what never leaves.
Let's see what turns up in your traffic.
A sample of last month's transactions is enough to see how much each signal catches.