Device history and account links: a practical guide

Device history connects observations across time under a provider's matching scope. Account links associate those observations with activity in your application or another documented source. Use both to investigate repeated behavior while keeping a device, a network and an authenticated account as different concepts.

Start with one event you can locate precisely. Inspect its timestamp, device association, account reference and returned finding before expanding to related activity. A large graph is less useful than a small relationship you can explain and verify.

Begin with the protected event

Identify the action under review: a registration, login, account change or checkout. The relevant device observation should belong to that action. Confirm the event reference rather than selecting whichever earlier result happens to be available.

Then inspect recognition. Ask whether the identifier represents the supported browser or device relationship and whether the match has a confidence or availability state. A missing identifier is not proof of a new device. A repeated identifier is not proof that the same person performed both actions.

The integration guide explains event association and trusted result delivery. Solve those steps before treating a relationship map as evidence about account behavior.

Name the relationship explicitly

A device associated with multiple accounts, an account associated with multiple devices and accounts sharing one network answer different questions. Label the edges in the investigation record so a reviewer can follow the actual connection.

Do not silently convert a network relationship into a device relationship. Shared infrastructure can connect unrelated people. Likewise, two identifiers from different products should not be merged merely because both fields are called “visitor ID.”

Read time windows and history access

Record first seen, last seen and the history period available under the selected plan where the product provides them. Activity concentrated in one period can have a different operational meaning from a relationship accumulated over a long account lifetime.

Sift's Device Fingerprinting API offers a specific device interface within its broader platform. TransUnion's TruValidate product covers identity and device-risk capabilities with its own access and reputation model. Inspect the selected interface and source of history rather than attributing every platform capability to one response.

Separate first-party application events from external reputation. Both can be useful, but they answer different questions and may have different availability. The investigation should make clear which relationship was observed directly and which was supplied by the selected service.

Connect findings to the account scenario

Ready-made detections and raw relationships are different outputs. ShieldLabs includes multi-accounting, account sharing, impossible travel and account takeover as account-level detections alongside device/network intelligence and risk scoring. The review describes the relevant scope in this comparison.

A provider may instead expose identifiers, historical fields or configurable policies that support an application-specific workflow. Castle's documentation is a useful place to inspect its operating model. Evaluate the responsibilities attached to the selected interface instead of assuming that every relationship is already a confirmed abuse finding.

For shared accounts, inspect legitimate explanations and the event sequence. A support-assisted recovery, a replacement device or permitted family use can change the relationship without establishing abuse. The product finding, business permission and user consequence should remain individually reviewable.

Build a concise case record

Retain the event reference, time window, relevant relationship, source finding and application consequence. Include any availability or matching ambiguity that affects the interpretation. Keep raw credentials and unrelated customer details out of editorial or public diagnostic submissions.

A useful case record lets another reviewer answer: what happened, which observations were connected, what the product returned and what the application did. It should not require guessing which account a screenshot belongs to or whether a score was current at the time of the action.

When a relationship is corrected, preserve enough context to understand the earlier decision under your retention rules. Reclassifying the current case should not silently rewrite every earlier observation as though the original output never existed.

Test shared-device and shared-network controls

Use a permitted test account pair on one known device, one account on distinct known devices and unrelated accounts on a shared network. These cases help distinguish device association from network coincidence and business permission.

Repeat the cases through the actual account workflow. An accurate device match attached to the wrong account can still create a misleading investigation. Review event association and returned history together before concluding that a platform fits your account-risk requirement.

The evaluation guide provides a broader test matrix. The recognition guide explains false splits and false merges. Use both alongside the twelve vendor reviews when deciding which history and relationship model your team can operate.

FAQ