Today we're launching something at Incognia that I'm particularly excited about: Real-Time Scam Prevention🛡️ We've spent years building technology that understands how people and devices behave in the physical world, with location precision down to the apartment level. Now we're applying that intelligence to the relationships behind payments. That physical-world behavior can tell us a lot about whether the sender and recipient have a real-world relationship. Real-Time Scam Detection uses a Physical Social Graph built on historical location patterns and persistent device intelligence to identify signals that may indicate that relationship. And the difference between legitimate payments and reported scams is pretty clear. In our analysis, we found that: → 79.2% of legitimate transactions occurred between users with a physical-world relationship → 86.2% of reported scams involved transactions between users with no physical-world relationship We combine that with other risk signals, including mule account detection, active-call detection, remote-access detection, and device tamper detection, to help banks assess scam risk in real time. In another analysis of transactions from a bank with more than 80 million active users, Incognia identified approximately 70% of scam transactions. I'm incredibly proud of the team behind this launch. We've spent a long time building toward this. More about what we’ve built: hubs.li/Q04BJgQj0

There's an easy solution to this: techcrunch.com/2026/10/13/ju…

AI makes content easy to fake. Identity systems cannot rely on what a user shows in one moment. The question is no longer just “Does this face look real?” It is “Is this a real user, and who are they?” Verification needs more than a convincing snapshot.

Fraud decisions should determine whether an action is trustworthy, not whether a person is “a fraudster.” A customer denied one refund may still be legitimate elsewhere. When support teams turn one decision into an identity, they punish good customers and slow growth.

Build vs. buy in fraud prevention depends mostly on company size. That was my main point on today’s panel at Merchant Fraud Alliance in Chicago. Small companies should buy the full solution. Building fraud prevention can distract from their core business. Large companies should build the decision layer, orchestration, and models, while partnering with vendors for best-in-class signals. The largest companies should develop some signals internally, too. Some of our banking clients have built parts of their device intelligence while using Incognia’s patented indoor location capabilities, as apartment-level location intelligence that automatically maps 3-dimensional environments is extremely hard to reproduce. Even after more than a decade of investment, Google and Apple haven't released an equivalent capability. Build where you have a unique data advantage, such as your own customer behavior and transaction data. Partner where intelligence compounds outside your walls, as it can with consortium data. But consortium data needs a foundation that survives fraudsters’ adaptation. Can the provider recognize the same device after a reset and detect fraud farms operating across multiple devices? We’ve seen automated resets generate new device IDs every 30 seconds. In Incognia’s data, over 60% of fraudsters use multiple devices, and 70% of those devices are factory reset weekly. If resets erase their history and switching devices breaks the connection, consortium data can become useless against those methods. Finally, ask what happens two years after implementation. Is the vendor still in the stack? A POC can look great before fraudsters learn to reset devices, switch hardware, or run farms. Ask prospective vendors for two-year customer retention and references who have lived through that adaptation. If a vendor is losing more customers than it wins, ask why before integrating it. And if it is still there two years later, it should be catching newer attacks, approving more good users, and delivering more value than on day one. Thanks to MFA and my fellow panelists Andreas Zodhiates, Dan Pinto, Mark Porteous, and Jarrod Price for the productive discussion.

Fraud-as-a-Service doesn’t just empower professional fraudsters. It also turns ordinary users into occasional abusers.

Multi-accounting does more than create losses. It makes risk teams skeptical of every account. When genuine customers start looking suspicious, false positives and friction rise. Better detection should stop abuse in the background while trusted users move freely.

My tier list for fraud signals. These are based on: → How resistant they are to AI → How effective they are at detecting fraud → How much unique information they can give you For me, these 3 belong in S tier: 1. Apartment-level location behavior There are a lot of things you can do with this signal that are very hard to do accurately any other way. You can identify device farms. You can recognize a device after a reset. You can tie the device back to an address, identify trusted locations more accurately, and use that context to remove friction for good users. 2. Transaction behavior This one is a little different because I’m talking about the company’s own internal data. No one has better information about your customers’ transactions than you do. That gives you a very unique source of intelligence that you can combine with external fraud signals to build models around the fraud you’re actually seeing. 3. Cross-account identity graph This is really about figuring out which accounts are connected. And I don’t just mean seeing the same email or phone number twice. I mean bringing together device, location, account history, and other signals so you can see the relationships between those accounts. Once you can connect them, it becomes much easier to see whether a small group is behind a large amount of fraud, or whether you’re looking at coordinated abuse or first-party fraud. For A tier, these the signals that are still detecting a very high volume of fraud today. Persistent device identity is a good example. If you’ve seen the device before and it comes back trying to create another account, that can be a very strong signal. The important part is persistence. A traditional device fingerprint may disappear after something as simple as a factory reset. Then as you move into B and C, you start getting into signals that are increasingly vulnerable to AI and easier for fraudsters to work around. What would you move up or down? What would you add?

Fraud investigations can get complicated, fast. You might start with one unexpected risk decision, then need to look across devices, accounts, fraud feedback, watchlists, rules, policies, and historical activity to understand what happened. A lot of that work is still manual. That’s why we’re introducing the Incognia MCP Server. It will allow compatible AI applications and agents to access Incognia risk intelligence and supported investigation capabilities, so analysts can start with the question they need answered. For example: “Why did this account receive High Risk and then Low Risk a few minutes later?” From there, the agent will be able to pull the relevant assessments, trace the devices and accounts involved, check fraud feedback and watchlist history, and review the rules and policies tied to each decision. It can then organize that evidence into a clear explanation for the analyst to review. That includes what happened, which devices and accounts were connected, what may have caused the different outcomes, and what still needs further review. The first version will be read-only. The analyst still reviews the evidence, validates the conclusion, and decides what action to take. The goal is simple: spend less time gathering evidence and get to the root cause faster. If you’re already an Incognia customer, reach out to your account team to learn more about setup details and relevant investigation use cases. More details: hubs.li/Q04yWWtg0

Here’s how we found one of the largest fraud farms we’ve ever seen 👇 This came up during a proof of value (POV) with a bank. They actually weren’t looking for fraud farms at all. They came to Incognia for overall fraud losses around the onboarding process. But as we started looking at the data, we noticed a pattern: → A bunch of accounts were being created on one device → Shortly after, those accounts were being accessed from different devices → The device that originally created the account would never show up again So we dug deeper. We looked at how those accounts and devices were connected with apartment-level location, and that’s when we found the farm: 200 devices tied to more than 4,500 accounts operating from one single apartment. The bank had a much bigger mule account handover problem than they ever realized. About 4% of newly-opened accounts were being handed over within a week 🤯 This is what happens when you start connecting signals across accounts, devices, locations, and time. Activity that looks normal on its own can start to reveal a much larger coordinated operation. P.S. Some of the most interesting fraud problems we find are the ones the bank wasn’t looking for in the first place. If you want to see what you could be missing, let’s talk.

If you think you detect 100% of emulators, you don’t. Modern emulators can look like real devices, while rigid rules can block legitimate users. Emulator detection is an adversarial problem. It requires layered evidence that evolves as fast as attackers do.

With frontier models refusing to do cyber work, the Chinese models will become the best at these tasks.

Fraud prevention is not about removing bad accounts. It is about making every return attempt harder and more expensive. If an attacker can return from the same device under a new account, the platform changed the username, not the economics.

I’ve criticized behavioral biometrics before, especially when it’s treated as a standalone identity signal. We tested behavioral biometrics on mobile. It didn’t improve our performance. On the web, the result has been different. Web sessions naturally give you less evidence about the user and device. Interaction patterns such as mouse movement, typing, clicks, and clipboard behavior can add useful information. But my view on behavioral biometrics hasn’t changed: it shouldn’t be treated as proof of identity or fraud on its own. It tells you something about how a session is being operated. Its value comes from combining that with stronger signals. That’s what we’re doing at Incognia. We’re adding behavioral biometrics to our web risk intelligence alongside: → browser and device intelligence → integrity and tamper signals → bot and automation detection → location intelligence And when a higher-risk action needs stronger verification, businesses can bring the customer’s trusted mobile device into the decision through Cross-Device Authentication. Behavioral biometrics is another useful piece of evidence when the data shows it actually adds value. More on how we’re using it at Incognia: hubs.li/Q04y8BxY0

A fraudster and a legitimate customer can share the same map coordinates on different floors. Blocking that location risks blocking both. This is why apartment-level precision matters in fraud prevention. A dot on a map isn't enough.

If you suspect a fraud farm, there are a few checks we’ve found useful during an investigation 👇 The exact process will vary depending on the case, but this is generally where I’d start: 1. Start from the suspicious activity. An account, device, transaction, or unusual behavior gives you the first point to investigate. 2. Look for connections across accounts and devices. One device touching multiple accounts, or several accounts sharing other characteristics, can point to coordinated activity. 3. Check for device manipulation. App cloning, emulation, spoofing, tampering, reinstalls, and factory resets can all help explain how the same operation keeps changing what it looks like. 4. Look at timing and velocity. Fraud farms often create patterns across many accounts or devices, especially when activity happens in tight windows or follows the same timing. 5. Check whether supposedly unrelated activity shares a location. Precise location can reveal when separate accounts or devices are being operated from the same place. 6. Look at the history of those devices and locations. If they’ve been connected to fraud or mule activity before, that gives you more context for what you’re seeing now. 7. See whether the activity points back to the same operation. By this point, you should be able to see whether the accounts, devices, and locations are behaving independently or as part of a coordinated group. 8. Follow the money. Where the funds move can expose additional accounts, institutions, or exchanges connected to the operation. 9. Document enough for the investigation to continue. If the case needs to move to law enforcement, you want a clear record of what happened, which accounts were involved, where the money went, and what investigators should look at next. — What have you found most helpful when investigating a suspected fraud farm?

Fraud scales when starting over is cheap. App cloners and emulators let attackers keep creating accounts and repeating the same attack. If replacing a banned account costs almost nothing, banning more accounts won't solve the problem. You have to make returning harder.