A review of the anti-fraud system of the financial organization M&T Bank

In this article, using the example of the https://www.mtb.com/ website, we will examine what data is collected by a financial organization's anti-fraud system.

Let's use a tool that determines where various parameters and browser fingerprints are collected.

Let's open the bank's registration page https://www.mtb.com/log-in

The site checks the following data obtained from the user's browser:

Page establishes Webrtc connection, gets result from rendering audio. Collects Canvas prints in a large number of Canvas, including giving a job to render persistent and new (dynamic) Canvas:

The site collects the footprint, getting information about the video card and supported resolutions using WebGL technology.

The site's anti-fraud system collects information about the device's battery, connection type and properties, information about installed plugins in the browser, and requests access to the device's camera. The site checks Java support in the browser and tries to get a list of Usb devices.

The site also obtains data about DoNotTrack mode usage, User-agent, device platform, which are standard for antifraud systems.

Screen size and touch support in the browser

The site collects a list of fonts installed on the user's system.

Important is checking the language in the browser, the time zone of the system and matching the results to the ip address of the site visitor.

Let's have a look in Dev Tools at the information collected by the site

In addition to browser information, the site tracks and records user actions (browser resizing, clicks and touch events, text input) with timestamps on pages.

After entering text into a field, the data was written to Local storage

And sent to the server

Conclusions:

We have reviewed most of the parameters tracked by a financial organization's anti-fraud system. The site collects detailed information about the browser and system, user actions on the pages, but despite this, the site does not block mass automated account registration, provided that several important parameter values in the anti-detect browser are substituted with values corresponding to a large number of real users of the site and the correspondence of values between each other.