Security Wiki

Browser fingerprinting derives an identifier from a browser's observable traits — versions, fonts, rendering quirks — without storing anything on the device.

Canvas fingerprinting derives a device identifier from tiny differences in how a browser renders graphics — no cookies or stored state required.

Card cracking is the automated guessing of missing card details — CVV, expiry date — by testing combinations against live payment forms until one succeeds.

Card-not-present fraud is payment fraud where the physical card is never shown — online, by phone, or in-app — making stolen card data alone enough to pay.

Carding is the automated testing of stolen credit card data against payment forms to find cards that still work before selling or exploiting them.

Chargeback fraud is the abuse of the card dispute process to reverse legitimate charges — the merchant loses the goods, the revenue, and pays a fee on top.

Click fraud is the automated or incentivized clicking of paid ads to drain an advertiser's budget or inflate a publisher's revenue — no buyer ever intended.

Coupon fraud is the systematic abuse of discount codes, referral bonuses, and promotions — often through fake accounts that redeem one-time offers at scale.

Credential stuffing is an automated attack that tests stolen username-password pairs from data breaches against login forms to take over accounts.

Data minimization is the GDPR principle that personal data must be limited to what a stated purpose actually requires — collect less, keep it shorter.

Data residency is the question of where data is physically stored and processed — and which country's laws and authorities can reach it as a result.

Denial of inventory is a bot attack that locks products in carts or holds bookings without buying, making stock unavailable to real customers.

Device fingerprinting identifies devices by combining technical attributes like browser, OS, and hardware characteristics into a distinctive signature.

Email scraping is the automated harvesting of email addresses from websites and public sources to build spam, phishing, and resale lists.

Fake account creation is the automated mass registration of accounts under false identities, feeding spam, promo abuse, fake reviews, and downstream fraud.

Form spam is the automated submission of junk content through website forms — polluting inboxes, CRMs, and comment sections while hiding real leads.

IP geolocation maps an IP address to a physical region — country, city, sometimes postal area — powering localization, compliance and fraud checks.

IP reputation is an assessment of how trustworthy traffic from an IP address is, based on its history, network type, and links to proxies or botnets.

MFA bypass covers the techniques attackers use to defeat multi-factor authentication — phishing proxies, push fatigue, OTP interception, and token theft.

Payment fraud is any transaction that uses stolen, fabricated, or abused payment credentials — from stolen-card purchases to chargeback and refund abuse.