Comparison · 4 min read

One human, one offer: promotion integrity without surveillance

Constance Ibe-WhitmoreRegulatory Translator

A detection vendor writes on its own homepage that traditional fingerprints are becoming useless, because browser makers are working to break them and attackers can emulate them. That is the obituary for a control category, written by a company that sells it.

Can you enforce one-per-person offers without profiling users?

Yes, and the current approach is failing anyway. One-per-person offers are enforced by device fingerprinting, IP analysis and payment matching. All three are degrading as browsers remove signals, and all three produce false positives against the people least able to argue.

Key takeaways

Uniqueness is currently inferred from correlated signals rather than established. Signal correlation degrades as platforms harden privacy.
Credential-bound uniqueness raises the attacker's cost from free to the price of a device, and the cost curve is publishable rather than asserted.
It collects nothing, which in a promotion context is a material privacy improvement over the alternative.

Part of Gaming and consumer marketplace identity

What the incumbent control actually does

One-per-person offers are enforced by inference. The platform collects signals — device characteristics, IP address, payment instrument, behavioural timing — and correlates them to guess whether two accounts are the same person.

It is guessing. That is not a criticism; it is the design. There is no identity assertion anywhere in the system, so correlation is the only available mechanism.

Why the signals are degrading

Three independent trends, none of which is reversing.

Browser privacy hardening. Fingerprinting surface reduction has been an explicit browser vendor goal for years, and each release removes entropy.
Platform privacy features. Private relay services, per-app addressing and randomised identifiers break IP and device correlation for ordinary users.
Adversary tooling. Residential proxies, anti-detect browsers and virtualised devices are commodity products with support forums.

The result is that the signal degrades fastest against legitimate privacy-conscious users and slowest against adversaries who buy tooling specifically to defeat it — which is exactly the wrong direction.

The false positive cost nobody books

Every fingerprinting-based control produces false positives: a household sharing a device, students on a university network, a family on one payment card, a returning customer on a new phone.

Those customers are denied an offer, told nothing useful about why, and frequently do not return. The cost is real, distributed across support and churn, and almost never attributed to the fraud control that caused it.

What credential binding provides

A device-bound credential establishes that a redemption came from a credential that has not redeemed this offer before. No inference, no correlation, no collection.

It is important to be precise about the limit. This establishes credential uniqueness, not human uniqueness. A person with two devices can enrol two credentials.

The attacker cost curve

This is the honest way to compare, and it is publishable rather than a claim.

Marginal cost to an abuser of obtaining one additional redemption.
Control	Marginal cost per additional identity	Scales to hundreds?
Email uniqueness only	Effectively zero	Trivially
IP and device fingerprinting	Cost of a proxy plus an anti-detect profile — cents	Yes, with tooling
Payment instrument matching	Cost of a virtual card — low single digits	Yes
Credential binding	Cost of a distinct device or secure element	Poorly — the cost is physical

The last row is the whole argument. Promotion abuse is an economic activity: it scales while the marginal cost per identity is near zero and stops when it is not. Moving the cost from cents to the price of a device does not make abuse impossible; it makes it unprofitable at scale, which is the actual objective.

Computing your threshold

Promotion abuse is worth attacking when the offer value exceeds the marginal cost per identity. So:

abuse is profitable when   offer_value > marginal_cost_per_identity

with fingerprinting        marginal_cost ≈ $0.05–$2
with credential binding    marginal_cost ≈ cost of an additional device

An offer worth $20 is comfortably profitable to abuse under the first line and marginal under the second. An offer worth $500 remains attractive under both, which tells you that high-value offers need something beyond uniqueness — usually verified identity, accepted as a cost of the offer.

The privacy position

A credential-bound control collects no device characteristics, no IP history, no behavioural profile. It stores a public key and a redemption record.

For an organisation with a privacy team, a regulator, or customers who care, that is not a secondary benefit. Fingerprinting sits in an uncomfortable position under several data protection regimes precisely because it processes device data for identification without meaningful consent, and replacing it removes that exposure entirely.

Who the false positives land on

Signals and the legitimate users they penalise
Signal	Penalises
Device fingerprint	Privacy tooling, shared and library computers, older devices
IP address	Shared households, student accommodation, mobile networks, VPN users
Payment instrument	Shared family cards, prepaid users, the thinly banked
Behavioural similarity	Anyone whose usage resembles someone else's

Each of those correlates with being less able to complain effectively, which is why the false positive rate is under-measured. The users who are wrongly blocked mostly leave.

Objections and honest limits

“Farms will simply enrol many credentials.” Enrolment is where the cost sits, and that is the intended design: make the scarce thing the enrolment rather than the account. It raises the unit cost of a farm from near zero to something measurable.

“We would still want the signals.” Keep them, as risk input for deciding when to demand proof. They are poor verdicts and reasonable triggers.

Uniqueness without profiling

Enrol once, claim once. One credential, one offer, no profile.
Collect nothing about the device. The point is that you do not need to.
Use existing signals as triggers, not verdicts. A false positive should cost seconds, not access.
Publish your false positive rate. Most operators cannot, which is itself the finding.

Terms used here

Promotion abuse: Claiming a one-per-person offer many times, usually through many accounts.
Device fingerprinting: Inferring a stable device identity from browser and network characteristics — a signal browsers are actively removing.
False positive: A legitimate user wrongly blocked, and the cost that is systematically under-measured.

Frequently asked questions

Does this stop multi-accounting? No. It raises the marginal cost per identity from cents to the price of a device, which stops abuse that is only profitable at scale.

What about households sharing a device? That is the current false-positive case. Credential binding handles it correctly — two people on one device can hold two credentials — which is an improvement over fingerprinting, not a regression.

Should we remove fingerprinting entirely? For promotion uniqueness, it becomes redundant. Other uses — session anomaly detection, for instance — are separate decisions.

What about very high-value offers? Uniqueness alone is insufficient when the offer value exceeds the cost of a device. Those need verified identity, accepted as a cost of running the promotion.

Why are current controls failing? Browsers are removing fingerprinting signals and attackers use residential proxies and real browsers. The signals erode from both directions.

Who bears the false positives? Privacy-tooling users, shared households, students, mobile-only and thinly banked users — who mostly leave rather than complain.

Will farms just enrol more credentials? That is the design. It moves the cost to enrolment, raising the unit economics of a farm from near zero to measurable.

Where this fits in Manav

Manav proves a specific person authorised a specific action, without a vault, a token or surveillance. The biometric never leaves the device and the platform receives a signature rather than a profile.

What we do not do →

Sources and further reading

Cloudflare — bot management and Web Bot Auth
Published research on anti-detect tooling and residential proxy markets.
FTC — business guidance