Valid credentials prove nothing
Stolen credentials are easy to get and widely available. Attackers rely on the fact that these credentials will pass standard checks.
Fraud · Signals
Device Fraud & Behaviour Analysis
The password was correct, the device was familiar, and the customer authorised it themselves. Complead reads the device and the way the session is being used, from before login to the moment of payment, so a takeover or a customer under instruction is visible while it is still happening.
Continuous
SCORED THROUGHOUT, NOT AT LOGIN
Silent
NO FRICTION FOR REAL USERS
Device + behaviour
NEITHER SIGNAL ALONE IS ENOUGH
Explainable
EVERY SCORE SHOWS ITS DRIVERS
Why this matters
The credentials are right. The person is not.
Fraud often passes the password check. Attackers can take over accounts using valid credentials on devices that already seem trustworthy. Sometimes, a real customer approves a payment on their own phone while being coached by someone else. Remote access sessions can happen on the victim’s own computer, so the IP address, location, and device all appear normal. Every identity check sees a legitimate user. The real difference between these sessions and genuine ones is not who is connected, but how the session acts.
A trusted device can be the wrong hands
Remote access and coaching both run on the customer's own device. Device recognition alone confirms the hardware, not the operator.
Login is not where the signal is
Manipulation shows up while navigating and while approving a payment, not at the door. A control that checks once has already stopped listening.
How it works
Scroll to advance
Four steps, from connection to a scored session
-
Step 01
Identify the device, including what it is hiding
A fingerprint uses hardware and software details instead of stored identifiers, so it still works after clearing cookies, using private browsing, or routing through a VPN. Emulators, automation tools, tampered runtimes, and spoofing tools are each flagged separately. Cross-session correlation tracks device identity even when visible attributes change between visits.
-
Step 02
Read the session, from before login to after approval
We continuously measure typing speed, pointer and touch movements, navigation paths, form completion, and device handling. These are compared to the customer’s usual patterns. Monitoring continues after authentication, since the most important signals often show up later.
-
Step 03
Score, with the drivers named
Device and behavior signals are combined to create a session score. Each score shows which signals contributed and by how much, making the decision easy to review instead of just accepting it as final.
-
Step 04
Act inside the session
Actions like silent approval, holding for review, extra verification, or blocking are applied during the session, not before it starts. A genuine customer using a familiar device and acting normally will not notice any of these steps.
complead / IDENTIFY
| device | 0x88f2, new |
| GPU + audio + font profile | matched to 0x41a9 |
| CANVAS | rotated between sessions |
| EMULATOR | 2 flags |
| TLS | mismatch with declared OS |
complead / read
- session#55210
- TYPING3.1σ from baseline
- NAVIGATIONunfamiliar path to transfer
- HESITATIONelevated, payee field
- PASTEIBAN field
- HANDLINGdevice static, unusual
complead / score
- SCORE84 HIGH
- TOP DRIVERnavigation unfamiliar, +22
- REMOTE CONTROLsuspected
- PATTERNtakeover, not scam
- CONFIDENCE0.79
complead / act
- ACTIONstep_up
- CHALLENGEyour flow or ours
- RESULTfailed
- SESSIONblocked
- CASEopened, #7719
IDENTIFY
Read
Score
Act
Capabilities
What the product actually does
A device identity that can survive evasion
We create a device fingerprint by taking into account various details such as rendering behaviour, the audio pipeline, the font stack, hardware features, and the connection signature. We then compare these details across different sessions; if only one or two of the items vary, the device is still regarded as being the same because most of the profile remains unchanged.
The detection of the environment and the tools
Emulators, virtual machines, automation frameworks, runtimes that have been tampered with, cloned apps, and known spoofing extensions are all flagged separately; each one is identified individually and not just grouped together into a single score.
Remote control detection
Regardless of which tool is used, remote access sessions have their own behavioural signature, with indications such as input timing which does not match typical human movement, screen interactions that are inconsistent with the device, and latency patterns that show the presence of a relay. We do not need a malware signature in order to detect this.
Coaching and duress detection
It is to spot when the customer themselves are taking part in the fraud. Indications of this are hesitation when entering the payee's name, taking an odd route to reach the transfer screen, pasting in the beneficiary's details, long pauses which are similar to someone else talking, and a sense of urgency that doesn't match the customer's normal behaviour. A payment made on instruction appears completely normal in all respects except for the method used to carry it out.
The device and account graph
It is possible to identify the use of a single device for multiple accounts or the same account being accessed from many different devices. Moreover, we pick up on impossible travel, location discrepancies, and inconsistencies relating to the IP address or the platform. Patterns involving reuse and farming appear as clusters, not just as individual alerts.
Privacy by design
We monitor people's interactions rather than what they type or say. We do not gather data such as keystroke information, field values, fingerprints, face data, or voice data. The behavioral profiles are created on the basis of these measurements and are stored together with the customer record in the region that you have chosen.
Product tour
Three screens, and the third one finds what one account never shows
Live sessions Risk while the session is open
Scored continuously, high-risk sessions surfaced with the signals behind them and one action from the row.
- Scored throughout, not at login
- Device and behavioural flags together
- Step up, hold or block from the row
- Real users pass without interruption
complead / sessions
- HIGH takeover#55210
- HIGH coaching#55204
- MED new device#55187
- LOW#55198
Why this session is risky
The findings from the device, the deviation in behaviour from this customer's normal pattern, and the weight assigned to each of these factors.
- Device and environment flags listed
- Behaviour against this customer, not a population
- Drivers weighted, not just totalled
- Action, outcome and reviewer recorded
complead / session-detail
- #55210 HIGH 84
- EMULATOR 2 flags, +18
- REMOTE CONTROL suspected, +24
- TYPING 3.1σ, +22
- PASTE payee field, +6
One device, many accounts
The devices and accounts are shown as a group, with reuse, farming and coordinated onboarding displayed in the form of shapes rather than as separate flags.
- Accounts per device, devices per account
- Farm and reuse indicators
- Onboarding clusters from one device
- Through to every session in the cluster
complead / devices
- device0x88
- accounts4 active, 7 attempted
- onboardedsame week
- farm patternflagged
- sessions31
Case study · Neobank
Read the case study
A neobank caught takeovers that passed every credential check
The logins were clean—the right password, the right one-time code, and a device that the bank was already familiar with. However, the subsequent sessions were not. During each session, continuous behavioural scoring was used to detect the takeovers by comparing the customer's behaviour against their individual baseline, and since only high-risk sessions were challenged, actual customers noticed no difference.
−68%
Takeover losses
No change
IN CUSTOMER FRICTION
In-session
NOT IN NEXT WEEK'S CHARGEBACK
The password was right every time. The hands on the keyboard were not.
Head of Fraud, European Neobank
FAQ
Before you ask us
Does this cause trouble for real customers?
Not at all. Only risky sessions are stepped up. A genuine customer using a known device and behaving as they normally do goes through without any extra step and never notices it.
Does it function after logging in, or only at the gate?
All the way through, and this matters more than it may at first appear. A customer who is being coached behaves exactly as they should until they reach the payment screen, and that is where they start acting in an unusual way. A control that only checks at login has stopped watching by the time the signal shows up.
What behavioural signals do you take notice of, and what do you not?
The aspects of the interaction: typing cadence, pointer and touch dynamics, navigation sequence, form completion, hesitation and device handling. The actual keystrokes are not recorded, nor are the values entered in the fields or the text of any message. What is typed is never saved, only how it was typed.
Is the biometric data covered by the GDPR?
Fingerprint, facial or voice data is not collected. Instead, derived behavioural measurements are stored in the region you have selected and are kept in accordance with the same retention policy as the rest of the file. You are responsible for determining your legal basis and carrying out your DPIA, and the relevant documentation is available.
Can you tell that remote access tools are being used?
Yes, and this is true regardless of which tool is being used. Since remote control affects input timing, interaction consistency and latency in a manner that is evident in behaviour, a newly developed tool is evaluated on the same basis as a previously known one.
What occurs when a fraudster fakes the device fingerprint?
Spoofing attributes is both easy and frequent, which is the reason why device identity is established by correlating sessions using the complete signal profile rather than a single hash. When the obvious attributes are rotated the remaining ones stay the same, and the behavioural signals carry on regardless.
Can it pick up on device farms and coordinated onboarding?
Yes. When devices are shared among accounts, accounts appear on multiple devices, and groups of accounts are opened on the same device within a short time frame, patterns are identified rather than individual flags appearing.
In what way does it catch a payment the customer authorised themselves?
By the way the payment was made rather than its contents. The delay when entering the name of the payee, having to navigate an unfamiliar route to the transfer screen, beneficiary details that had been pasted in, and the pauses that match someone speaking are all measurable, while all the fields on the payment appear completely legitimate.
How is it integrated?
With a lightweight client-side collector in your app or web process and a server-side scoring call. Since the signals are available as conditions within each fraud rule, device and behaviour combine with payment and customer risk rather than being treated as a separate product.
Score your own sessions
Bring sample session data. In 30 minutes you will see device and behavioural risk scored, with the drivers behind each one.
3,000+
Data sources checked
220+
Countries covered
15 min
Always real-time data
Testimonials
All case studies
What compliance teams say
Complead provides ultimate control via its case management and safelist systems. Automated API operations significantly reduced my team's manual workload.
Using the API we run AML controls automatically and stay compliant, while reducing our team's daily workload.
With Complead we offer fast, easy, secure onboarding. We focus on real risks, not false positives.