New Fingerprint, WebRTC, and Canvas: How Anti-Fraud Systems Link Ad Accounts

When a media buyer sees a notice about a new ad account being banned right after launching a campaign, the initial suspicion usually falls on a poor-quality proxy or account issues. However, ad platforms and anti-fraud solutions can evaluate a much broader set of technical, network, and behavioral signals even before the campaign goes live.

One such set of signals is the digital device fingerprint (Digital Fingerprint). It is formed from dozens of hardware and system parameters of the browser, computer, and operating system. Matches or anomalies in these parameters can be used as additional factors when evaluating a session and searching for links between accounts.

A full digital fingerprint may include the following components:

• Network parameters: IP address, geolocation, internet service provider, timezone, and data available via WebRTC.
• Hardware indicators: number of logical CPU cores (Hardware Concurrency), available RAM (Device Memory), graphics card specifications, and WebGL parameters.
• Graphics rendering: Canvas fingerprints, font support, and screen resolution.
• Media stack: AudioContext and information about the device's available media capabilities.
• Browser environment: User-Agent, language packs, HTTP Client Hints headers, supported media formats, and other browser characteristics.

Canvas Fingerprinting: How Graphics Rendering Helps Distinguish Devices

Mechanics of Obtaining a Canvas Hash

HTML5 Canvas technology is designed for rendering 2D and 3D graphics directly within the browser window. At the same time, the results of this rendering can be used as a signal for fingerprinting.

A script can ask the browser to render a small test object, such as a snippet of text with various fonts, gradients, shapes, or shadows.

The result depends on many parameters: the GPU, drivers, operating system, browser, and font rendering engines. Because of this, even identical graphic scenarios across different configurations can yield slightly different results.

The resulting image can be converted into a numerical value or hash and used alongside other environmental parameters. However, an identical Canvas hash by itself does not prove that accounts are operating from the same physical device; what matters is the combination of signals and their consistency.

Why Artificial Canvas Alteration Can Also Create Anomalies

Some tools alter Canvas outputs by adding artificial noise. This approach is intended to complicate stable device identification, but it can create another issue—result inconsistency.

For example, if the same browser session yields noticeably different characteristics during repeated requests to Canvas, it can look untypical.

Therefore, risk assessment systems care not only about a specific Canvas hash, but also about how well it aligns with WebGL, the operating system, browser, device model, and other environmental parameters.

WebRTC: Where Additional Network Data Comes From

How WebRTC Interacts with the Network

WebRTC (Web Real-Time Communication) is a set of web technologies for transmitting audio, video, and other data directly between browsers.

During connection establishment, the browser may use ICE, STUN, and TURN to determine available network routes.

Depending on the browser, network configuration, proxy type, and WebRTC settings, the web page may gain access to additional details about the network environment.

If this data does not match the IP address of the primary connection, GEO, or other session parameters, such a mismatch can serve as an additional risk signal.

How Antidetect Browsers Handle WebRTC

Different browsers and privacy tools handle WebRTC in various ways: keeping default behavior, restricting access to specific network data, or changing the values exposed to the web page.

A specific WebRTC mode cannot be universally called "safe" or "dangerous." Much more important is environmental consistency: the IP address, GEO, timezone, language, browser traits, and other signals must not contradict each other.

Additional Fingerprinting Vectors: WebGL, AudioContext, and Behavioral Signals

Audio Fingerprint and System Fonts

The AudioContext method works on a principle similar to Canvas, but analyzes how audio signals are processed by the browser and system.

A script can generate a test signal, process it via the Web Audio API, and obtain a numerical result. This depends on the browser, operating system, and other environmental features, making it a useful supplementary fingerprint component.

Another parameter is system fonts. Using CSS, Canvas, and text dimension measurements, the availability of specific font families can be determined.

An untypical set of fonts or its mismatch with the declared operating system can also help narrow down possible device configurations.

Behavioral Factors

In the broader scope of anti-fraud and bot detection, not only technical device parameters are analyzed, but also how a user interacts with the interface.

Such signals may include:

• cursor movement patterns;
• keystroke intervals;
• form-filling behavior;
• speed of sequential actions;
• time spent on the page before interacting with elements.

An isolated behavioral signal usually does not dictate the outcome by itself; the overall session context matters.

Parameters That Help Systems Evaluate Environmental Consistency

Clustering: How Payment Data Can Link Accounts

Why the Browser Environment Is Only Part of the Picture

Even a stable browser and network environment does not mean a platform will evaluate an account in total isolation from other signals.

Payment information can also form part of the account's overall context. For example, links can occur due to:

• using the same payment instrument across multiple ad accounts;
• repeated billing issues or high decline rates;
• mismatches between payment details and the general account profile;
• reusing identical billing credentials across a large number of working profiles.

This does not mean a single match will automatically trigger a ban across all accounts. However, repeating payment details can establish an extra technical bridge between them.

Allocating Payment Instruments within a Team

For teams managing multiple ad accounts or projects, separate payment instruments help minimize operational dependence on a single card.

With Pay2.House, you can issue dedicated virtual cards for different ad accounts and set individual spending limits for each.

This approach simplifies expense allocation and budget control: an issue with a single card or specific account doesn't mean the whole team loses its working payment tool.

At the same time, separate cards alone do not guarantee a complete absence of account links – advertising and anti-fraud systems can factor in a much wider array of signals.

Infrastructure Layers to Monitor

What to Check Before Launching Ads

• Network environment. Ensure your IP address, GEO, and regional parameters do not contradict each other.
• Browser profile. Check whether User-Agent, operating system, WebGL, Canvas, language, and other characteristics align.
• WebRTC. Verify that the browser does not leak unexpected network data conflicting with the primary connection.
• Fingerprint stability. Drastic changes in parameters within the same profile can look suspicious.
• Payment infrastructure. Pre-allocate payment tools, check available limits, and verify card operability.
• Operational stability. Avoid erratic and unnecessary changes to critical account settings.

Frequently Asked Questions (FAQ)

Is changing the User-Agent enough to alter a digital fingerprint?

No. User-Agent is just one of many parameters in a browser environment. WebGL, Canvas, AudioContext, fonts, device characteristics, and other signals remain accessible independently. If they conflict with the User-Agent, it creates an additional anomaly.

What services can be used to analyze browser fingerprints?

BrowserLeaks, Pixelscan, and CreepJS are commonly used for technical diagnostics of browser environments. They display various fingerprint components and help spot inconsistencies between browser, network, and device settings.

However, a third-party checker result does not mean an ad platform evaluates the account using an identical model.

Is a disabled WebRTC automatically a suspicious signal?

Not necessarily. Different browsers, corporate environments, and privacy tools may restrict WebRTC in various ways. Therefore, it is more accurate to evaluate overall browser and network consistency rather than any single parameter.

Can using the same card in multiple ad accounts link them together?

Payment credentials can be one of the signals linking accounts. However, there is no universal rule where using a single card automatically causes a ban on all connected cabinets.

For teams handling multiple projects, splitting payment instruments primarily simplifies expense tracking, limit controls, and operational risk management.

Conclusion

A fingerprint is not a single magical hash that instantly identifies a user. It is a combination of network, browser, hardware, payment, and sometimes behavioral signals analyzed together.

That is why infrastructure should be managed comprehensively: by controlling browser environment consistency, network parameters, and payment workflows rather than searching for a single "safe" Canvas, WebRTC mode, or BIN.

On the payment side, Pay2.House helps teams distribute spending across individual virtual cards, set custom limits, and reduce reliance on a single payment instrument. For scaling, this provides a more controlled infrastructure without forcing you to hold your entire ad budget on one card.