How and on what do antifraud systems detect you?

[Carding Forum]

Recently, information has begun to surface that Amazon scanners are detecting the use of antidetects.
Many people panic and immediately start changing browsers, hardware, etc., although the problem may be in the actions of the user himself.
We have identified all the main parameters on which antifraud catches us and will offer ways to reduce the risks of detection.

The main causes of problems​

The main tasks of the antidetect:
• Substitution of our real digital fingerprint
• Make us as similar as possible to a real buyer

Unfortunately, there is not a single browser in the public domain that can make you a real buyer in the store.

This is due to the fact that each AF system has its own criteria for operation. They analyze different information, different metrics and make different conclusions based on this data.

Conventionally, one antique is better suited for affiliate fraud, and the other for Amazon

But there are general recommendations that will significantly increase the efficiency of using the browser.

What are the main parameters that antifraud analyzes?​

Ip is the most important parameter to analyze, and it is the one that most often causes problems.

Problem
• Your real IP will be exposed. Many people think that Antik changes their IP automatically, but this is not true. First, you need to buy a quality IP.
• Using a proxy for the wrong geo. If you make an order to Germany, but at the same time you have an IP from Mexico, this will at least raise questions from the antifraud.
• Dirty IP. In the hope of saving money, many people buy cheap and low-quality proxies or even free ones. Naturally, they will not pass the test, because they are already on many stores' scam lists.

Solution
• Use only high-quality and proven proxies. There is no need to save on this matter.
• Choose the right geo for your order
• Use different proxies for each account

Fonts​

One of the main factors that indicates fingerprint substitution

Problem
Each OS has a set of fonts used: standard and system
Standard: Arial, Times New Roman...they are found in any OS.
But system fonts are unique for each system.

How it works: Let's say the user has a Windows laptop, but the fingerprint indicates MacOS.
Because of such differences, the antifraud will understand that we are trying to replace our fingerprint.
The difference will also be noticeable not only in the set of fonts, but also in their design: MacOS and Windows can display the same fonts differently.

Solution

• Select the OS of the device you plan to work from in the digital fingerprint.

Browser​

All antidetects work on the basis of one of the standard browsers.
Usually it is Google Chrome, Firefox.

Problem
Each browser has its own unique parameters and functions that distinguish it from others. Ordinary users will not notice this, unlike AF systems. This is how they understand that we have replaced our fingerprint.

Solution
Your digital fingerprint should contain data that matches the antique. This can be viewed in Useragent.
All manufacturers of antiquities provide information on the basis of which browsers they work.

Problem
The imprint can become:

• Unrealistic, since the parameters in the device fingerprints are linked, manual changes may result in a combination of data that does not occur at all or occurs too rarely.
• Too unique that it will attract the attention of anti-fraud systems.

Solution
Do not change the fingerprint parameters that concern the device itself: Canvas, Audio, WebGL.

WebRTC​

— describes the parameters for transferring audio, video and content between browsers and applications. The project began to be used as a replacement for Flash.

Problem
It often happens that this parameter shows your real IP, even if you use a proxy.

Solution
If you see a leak of your real IP via WebRTC, the best solution is to check with the anti-detection developer what is best to do with this parameter. This is due to the fact that some anti-fraud systems see that a person changes IP, but do not take any measures against the user. This is especially true at the current time, when many sources and sites in Russia are blocked.
Mobile device on the web. Some users try to emulate a mobile device from web versions of antidetects.

Problem
Mobile devices differ from web versions in hundreds of parameters, including screen resolution, network operation, data transfer methods, device types, etc. Considering that antidetections do not provide 100% emulation even on the web version, with the mobile version it will be even lower.

Solution
Even if your antidetect has functionality for emulating the web version for mobile, it is better to use it with caution and not test it on accounts that are important to you. Otherwise, there is a risk that they may be sent for verification or even blocked.