{
"slug": "uniqueness-without-surveillance",
"topic_id": "TOPIC-228",
"cluster": "Gaming, Betting & Consumer Marketplace Identity",
"tier": "Tier B",
"title": "One human, one offer: promotion integrity without surveillance",
"summary": "One-per-person offers are enforced by fingerprinting, IP analysis and payment matching. All three are degrading, all three produce false positives against real customers, and all three are surveillance.",
"lede": "A detection vendor writes on its own homepage that traditional fingerprints are becoming useless, because browser makers are working to break them and attackers can emulate them. That is the obituary for a control category, written by a company that sells it.",
"date": "2023-11-10",
"category": "Comparison",
"author_id": "constance-ibe-whitmore",
"tags": [
"promotion abuse",
"bonus abuse",
"device fingerprinting",
"multi-accounting",
"privacy",
"growth"
],
"image_title": "Uniqueness Without Surveillance",
"schema": "Article",
"key_takeaways": [
"Uniqueness is currently inferred from correlated signals rather than established. Signal correlation degrades as platforms harden privacy.",
"Credential-bound uniqueness raises the attacker's cost from free to the price of a device, and the cost curve is publishable rather than asserted.",
"It collects nothing, which in a promotion context is a material privacy improvement over the alternative."
],
"body": [
{
"type": "h2",
"text": "What the incumbent control actually does"
},
{
"type": "diagram",
"kind": "compare",
"alt": "Enforcement by inference versus enforcement by proof",
"caption": [],
"nodes": "One guesses at uniqueness from proxies. The other establishes it without learning who the person is.",
"left": {
"title": "Inference",
"items": [
"Device fingerprint",
"IP and network",
"Payment instrument",
"Degrading, and unfair at the margin"
]
},
"right": {
"title": "Proof",
"items": [
"One credential, one claim",
"No profile collected",
"Binary result",
"Unaffected by browser changes"
]
}
},
{
"type": "p",
"html": "One-per-person offers are enforced by inference. The platform collects signals — device characteristics, IP address, payment instrument, behavioural timing — and correlates them to guess whether two accounts are the same person."
},
{
"type": "p",
"html": "It is guessing. That is not a criticism; it is the design. There is no identity assertion anywhere in the system, so correlation is the only available mechanism."
},
{
"type": "h2",
"text": "Why the signals are degrading"
},
{
"type": "p",
"html": "Three independent trends, none of which is reversing."
},
{
"type": "ul",
"items": [
"Browser privacy hardening. Fingerprinting surface reduction has been an explicit browser vendor goal for years, and each release removes entropy.",
"Platform privacy features. Private relay services, per-app addressing and randomised identifiers break IP and device correlation for ordinary users.",
"Adversary tooling. Residential proxies, anti-detect browsers and virtualised devices are commodity products with support forums."
]
},
{
"type": "p",
"html": "The result is that the signal degrades fastest against legitimate privacy-conscious users and slowest against adversaries who buy tooling specifically to defeat it — which is exactly the wrong direction."
},
{
"type": "h2",
"text": "The false positive cost nobody books"
},
{
"type": "p",
"html": "Every fingerprinting-based control produces false positives: a household sharing a device, students on a university network, a family on one payment card, a returning customer on a new phone."
},
{
"type": "p",
"html": "Those customers are denied an offer, told nothing useful about why, and frequently do not return. The cost is real, distributed across support and churn, and almost never attributed to the fraud control that caused it."
},
{
"type": "h2",
"text": "What credential binding provides"
},
{
"type": "p",
"html": "A device-bound credential establishes that a redemption came from a credential that has not redeemed this offer before. No inference, no correlation, no collection."
},
{
"type": "p",
"html": "It is important to be precise about the limit. This establishes credential uniqueness, not human uniqueness. A person with two devices can enrol two credentials."
},
{
"type": "h2",
"text": "The attacker cost curve"
},
{
"type": "p",
"html": "This is the honest way to compare, and it is publishable rather than a claim."
},
{
"type": "table",
"caption": "Marginal cost to an abuser of obtaining one additional redemption.",
"head": [
"Control",
"Marginal cost per additional identity",
"Scales to hundreds?"
],
"rows": [
[
"Email uniqueness only",
"Effectively zero",
"Trivially"
],
[
"IP and device fingerprinting",
"Cost of a proxy plus an anti-detect profile — cents",
"Yes, with tooling"
],
[
"Payment instrument matching",
"Cost of a virtual card — low single digits",
"Yes"
],
[
"Credential binding",
"Cost of a distinct device or secure element",
"Poorly — the cost is physical"
]
]
},
{
"type": "p",
"html": "The last row is the whole argument. Promotion abuse is an economic activity: it scales while the marginal cost per identity is near zero and stops when it is not. Moving the cost from cents to the price of a device does not make abuse impossible; it makes it unprofitable at scale, which is the actual objective."
},
{
"type": "h2",
"text": "Computing your threshold"
},
{
"type": "p",
"html": "Promotion abuse is worth attacking when the offer value exceeds the marginal cost per identity. So:"
},
{
"type": "code",
"text": "abuse is profitable when offer_value > marginal_cost_per_identity\n\nwith fingerprinting marginal_cost ≈ $0.05–$2\nwith credential binding marginal_cost ≈ cost of an additional device"
},
{
"type": "p",
"html": "An offer worth $20 is comfortably profitable to abuse under the first line and marginal under the second. An offer worth $500 remains attractive under both, which tells you that high-value offers need something beyond uniqueness — usually verified identity, accepted as a cost of the offer."
},
{
"type": "h2",
"text": "The privacy position"
},
{
"type": "p",
"html": "A credential-bound control collects no device characteristics, no IP history, no behavioural profile. It stores a public key and a redemption record."
},
{
"type": "p",
"html": "For an organisation with a privacy team, a regulator, or customers who care, that is not a secondary benefit. Fingerprinting sits in an uncomfortable position under several data protection regimes precisely because it processes device data for identification without meaningful consent, and replacing it removes that exposure entirely."
},
{
"type": "h2",
"text": "Who the false positives land on"
},
{
"type": "table",
"caption": "Signals and the legitimate users they penalise",
"head": [
"Signal",
"Penalises"
],
"rows": [
[
"Device fingerprint",
"Privacy tooling, shared and library computers, older devices"
],
[
"IP address",
"Shared households, student accommodation, mobile networks, VPN users"
],
[
"Payment instrument",
"Shared family cards, prepaid users, the thinly banked"
],
[
"Behavioural similarity",
"Anyone whose usage resembles someone else's"
]
]
},
{
"type": "p",
"html": "Each of those correlates with being less able to complain effectively, which is why the false positive rate is under-measured. The users who are wrongly blocked mostly leave."
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Farms will simply enrol many credentials.” Enrolment is where the cost sits, and that is the intended design: make the scarce thing the enrolment rather than the account. It raises the unit cost of a farm from near zero to something measurable."
},
{
"type": "p",
"html": "“We would still want the signals.” Keep them, as risk input for deciding when to demand proof. They are poor verdicts and reasonable triggers."
}
],
"faq": [
{
"q": "Does this stop multi-accounting?",
"a": "No. It raises the marginal cost per identity from cents to the price of a device, which stops abuse that is only profitable at scale."
},
{
"q": "What about households sharing a device?",
"a": "That is the current false-positive case. Credential binding handles it correctly — two people on one device can hold two credentials — which is an improvement over fingerprinting, not a regression."
},
{
"q": "Should we remove fingerprinting entirely?",
"a": "For promotion uniqueness, it becomes redundant. Other uses — session anomaly detection, for instance — are separate decisions."
},
{
"q": "What about very high-value offers?",
"a": "Uniqueness alone is insufficient when the offer value exceeds the cost of a device. Those need verified identity, accepted as a cost of running the promotion."
},
{
"q": "Why are current controls failing?",
"a": "Browsers are removing fingerprinting signals and attackers use residential proxies and real browsers. The signals erode from both directions."
},
{
"q": "Who bears the false positives?",
"a": "Privacy-tooling users, shared households, students, mobile-only and thinly banked users — who mostly leave rather than complain."
},
{
"q": "Will farms just enrol more credentials?",
"a": "That is the design. It moves the cost to enrolment, raising the unit economics of a farm from near zero to measurable."
}
],
"sources": [
{
"t": "Cloudflare — bot management and Web Bot Auth",
"u": "https://developers.cloudflare.com/bots/"
},
{
"t": "Published research on anti-detect tooling and residential proxy markets."
},
{
"t": "FTC — business guidance",
"u": "https://www.ftc.gov/business-guidance"
}
],
"related": [
{
"slug": "portable-review-receipt",
"title": "Reviews, ratings and the verified transaction",
"category": "Vertical"
},
{
"slug": "bound-submission",
"title": "Proctoring detects; it does not prove",
"category": "Comparison"
},
{
"slug": "gambling-identity-survivability",
"title": "Deepfakes already beat casino identity checks",
"category": "Comparison"
}
],
"image": "https://cdn.twc.sh/images/igcache/Uniqueness%20Without%20Surveillance/1200_630/blog.jpg",
"wordcount": 945,
"url": "/blog/uniqueness-without-surveillance.html",
"reading_time": "4 min read",
"meta_description": "One-per-person offers are enforced by fingerprinting, IP analysis and payment matching. All three are degrading and produce false positives.",
"hub": {
"slug": "topics/consumer-marketplace-identity",
"title": "Gaming and consumer marketplace identity"
},
"answer": "Yes, and the current approach is failing anyway. One-per-person offers are enforced by device fingerprinting, IP analysis and payment matching. All three are degrading as browsers remove signals, and all three produce false positives against the people least able to argue.",
"answer_q": "Can you enforce one-per-person offers without profiling users?",
"glossary": [
{
"term": "Promotion abuse",
"def": "Claiming a one-per-person offer many times, usually through many accounts."
},
{
"term": "Device fingerprinting",
"def": "Inferring a stable device identity from browser and network characteristics — a signal browsers are actively removing."
},
{
"term": "False positive",
"def": "A legitimate user wrongly blocked, and the cost that is systematically under-measured."
}
],
"checklist": {
"title": "Uniqueness without profiling",
"id": "uniqueness",
"desc": "Four properties.",
"steps": [
{
"name": "Enrol once, claim once.",
"text": "One credential, one offer, no profile."
},
{
"name": "Collect nothing about the device.",
"text": "The point is that you do not need to."
},
{
"name": "Use existing signals as triggers, not verdicts.",
"text": "A false positive should cost seconds, not access."
},
{
"name": "Publish your false positive rate.",
"text": "Most operators cannot, which is itself the finding."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav proves a specific person authorised a specific action, without a vault, a token or surveillance. The biometric never leaves the device and the platform receives a signature rather than a profile.",
"href": "../about.html",
"label": "What we do not do"
}
}