How to Interpret a Digital Fraud Prevention Response

user_id is a persistent identifier of the client environment.

Put simply, it is an ID that describes a specific browser-device pair. The ID remains stable even if a user changes device, browser, or network settings. For example, if the user:

The ID stays the same.

If the user opens another browser or sends a request from another device, you will see a different ID. This is because every browser-device pair has its own unique ID.

A change in user_id can be normal: a user may sign in from their phone or install a new browser. But it can also indicate a dangerous scenario. For example, someone may have stolen the user’s authentication token and is trying to sign in with it.

Using several accounts from one user_id can also be normal. For example, an entire family may use one computer. But in another context, it can be a fraud signal. For example, an attacker may create many accounts to receive referral-program bonuses.

user_id is especially useful when you need to understand whether you are dealing with a familiar environment.

new_user: true means that DFP has not encountered this client environment during previous visits to your resource. new_user: false means that your resource has already been visited from this environment.

new_user: true does not necessarily mean you are dealing with a new person or a new account. The user may have visited before from another browser or device. Conversely, several people can use the same environment. This field only shows the history of visits to your resource from a particular client environment.

This field is useful when it is important to distinguish familiar environments from those visiting your resource for the first time, for example during account sign-in.

If a user signs in from a completely unfamiliar environment, the risk that their password was stolen is higher. It is better to request additional confirmation, for example by sending a code by email.

confidence_score: 1 means DFP is confident that user_id was identified correctly. Values below 1 mean lower confidence.

If DFP encounters an environment that has not visited your resource before (new_user: true), it assigns a new user_id. In these cases, confidence_score is always 1.

If DFP encounters an environment that has already visited your resource, it returns the user_id linked to it. In this case, confidence_score may differ from 1. The lower the value, the more current environment parameters differ from the set DFP saw earlier. However, there are still enough matches to recognize the environment.

bot_score shows how similar a request is to automated traffic. The value ranges from 0 to 1.

High bot_score does not mean that you should immediately block a request. The scenario matters. If a bot calls an open API, this is normal behavior. But the risk is much higher if a bot-like client tries to reset a password, create many accounts, or apply a promo code.

bot_score is useful where automation can harm the business.

hosting: true means that the sender’s IP belongs to a hosting subnet.

For a typical consumer product, this may be suspicious. Real users usually access it from home, mobile, office, or corporate networks. Hosting subnets are more often used for scripts, scrapers, bots, test environments, and bulk requests.

However, hosting: true does not automatically prove fraud. A request may come from corporate infrastructure, a proxy, monitoring, an internal tool, or a test environment.

bot_hosting: true means that the sender’s IP belongs to a hosting subnet from which we have detected bot activity or other suspicious activity.

This is a stronger risk factor than hosting: true. The hosting field only indicates the subnet type, while bot_hosting adds reputation context.

isp_active_subnet: true means that the user connected to the Internet through a regular Internet service provider network, one used for home, mobile, or corporate Internet access.

This provides additional context about the user’s network. By itself, the parameter does not confirm that a request is safe or suspicious.

This field can serve as an additional signal for your scenario. For example, if it is important to protect against bot registrations and you see a low bot_score together with hosting: false and bot_hosting: false, then isp_active_subnet: true is another sign that the request resembles one from a regular user.

incognito: true means that the user opened the page in incognito or private browsing mode.

We all use incognito mode sometimes, for example when signing in to an account from someone else’s computer. But it can also be used to abuse a resource, for example by resetting cookies and appearing to be a new user.

Incognito mode alone does not prove abuse. But if it appears together with a VPN, new behavior, repeated actions, or the same user_id, it is worth considering.

Incognito mode is useful to consider in promotions, voting, surveys, free limits, and paywall scenarios. It becomes an additional signal, most often together with user_id.

vpn: true shows that DFP detected signs of VPN use.

A VPN is not the same as fraud. A user may enable a VPN for privacy, work, access from a corporate network, or a stable connection while traveling.

But a VPN matters when region, network, or sign-in history is important for your scenario. For example, if you restrict access by country, use regional pricing, issue bonuses by geography, protect payments, or track suspicious sign-ins.

It is better to interpret vpn this way: the network context is hidden or changed. You then need to consider what the user is doing and what other signals arrived together with the VPN.

mobile, os, and engine provide request context:

These fields do not indicate suspicious behavior on their own. But you can use them as additional context when analyzing requests.