Browser Fonts: key parameters for anti-fraud systems

10.01.25

In today's world of technology, anti-fraud systems are using increasingly sophisticated methods to detect fraudulent activity. One of the important parameters for uniqueizing users and analyzing their devices are the fonts installed in the system. Let's take a look at how fonts can be used in antifraud, their role in device identification, spoofing techniques and counterfeit detection methods.

###### History and role of fonts in browsers

The fonts used by devices are a key characteristic affecting the display of web pages. Browsers provide information about available fonts through CSS and JavaScript APIs, allowing websites to tailor the display of content to the user's system. In anti-fraud systems, fonts are used for uniqueness, as the set of installed fonts can vary significantly depending on the device, operating system, version, and installed applications.

###### Methods for obtaining font data

1. **CSS Font-Family Fallback**.
Uses the font-family style to determine if text is displayed using the specified font. If the browser does not support the font, it uses the default font.

2. **Canvas Fingerprinting**.
Use the CanvasRenderingContext2D API to render text and measure its dimensions to determine if a font is present. This is a popular method for creating a “fingerprint” of a device.

3. **CSS Queries for Font Support**
Using [@font-face](# “@font-face”) and CSS properties, you can check for font availability.

4. **JavaScript-based Font Enumeration**
JavaScript allows you to check font availability by measuring the width and height of text using different fonts.

###### How fonts are used in antiface

1. **User Uniqueization**
Installed fonts can vary depending on the operating system, installed software, and user settings. This creates a unique “fingerprint” of the device.

2. **Counterfeit detection**
If fraudsters are using anti-detect browsers, the set of available fonts may not match the platform declared in the User-Agent.

3. **Comparison with other parameters**
For example, anti-fraud systems can check the set of available fonts against Canvas or WebGL data to find inconsistencies.

###### Methods of font spoofing and their detection

1. **Font set emulation or spoofing**
Attackers can use programs to change the list of available fonts. However, such substitutions can be detected by analyzing the size of rendered text or the behavior of other APIs.

2. **Font blocking**
Some browsers or plugins may hide the list of fonts to make identification more difficult. But such attempts also create suspicious patterns.

3. **Substitution detection**
Anti-fraud systems use correlations between font sets and other system characteristics, such as platform or processor architecture.
Let's look at examples of how systems obtain information about fonts. Let's open the page <a href="https://browserleaks.com/fonts" target="_blank">browserleaks.com/fonts</a>

![](/media/mdeditor/1_20250110150019844842.png)

Under Font Metrics: Fingerprint, the site shows the MD5 hash of the metrics of all the fonts found in our browser. The site found 146 fonts of which 112 contain unique sizes. In the Report section, we can see the dimensions, width and height of the checked string with the characters “mmmMMMMMMMMMMmmmlllmmmLLL₹▁₺₸ẞॿmmmiiimmmIIImmmwwwmmmWWW” for each of the fonts. The site checks over 1,400 known fonts and searches for them in the user's browser. In the Unicode Glyphs: Fingerprints section, the site shows an MD5 hash derived from the rendering results of Unicode special characters. Below is detailed information about the size of each of the checked characters for different font families.

Let's look at an example of fonts obtained on our test page <a href="https://test-webapi.tech/glyph" target="_blank">test-webapi.tech/glyph</a> open the page in Chrome browser and wait for the test results:

![](/media/mdeditor/2_20250110150249677293.png)

This page draws a large number of characters and symbols for each of the fonts and generates an MD5 hash for each of the detected fonts, after that a total MD5 hash (Overall MD5) is generated from the hash of all fonts and the number of fonts found in the user's browser. Also on the page for an example there is a test variant of detection of user's system and browser, which consists in estimation of MD5-hash values of some fonts. In our example, the site detected not 146 but 227 fonts and determined that we are using Windows OS and a browser with Chromium engine.

Let's repeat the test in our anti-detect browser without font substitution:

![](/media/mdeditor/3_20250110150326531770.png)

As a result, we got a different MD5 hash from the real browser, fewer fonts, the site identified our system as Windows Server, and a browser with the Chromium engine. Let's try to swap the font set in the anti-detect browser and repeat the test:

![](/media/mdeditor/4_20250110150355136792.png)

In this test, the anti-detect browser has substituted a set of fonts, the number of fonts is the same as the original Chrome browser, but the Overall MD5 hash is different from the original browser, which means that the sizes of the syllables for some fonts are different. This way we can identify users quite accurately by font set and its metrics.

Let's try opening our page in the Firefox browser:

![](/media/mdeditor/5_20250110150428006658.png)

Our test page has determined from the font lettering that we are using the Firefox browser. Note that the character sizes of the Arial font in the Firefox browser are different from the character sizes of the same font in the Chrome browser.

Let's repeat the test on mobile devices:

![](/media/mdeditor/6_20250110150503395946.jpg)

Note that the Chrome mobile browser returns the same values for most fonts. Also note that font rendering is different on the same devices and in the same version of browsers, which allows us to unique visitors quite accurately, especially using the additional data we talked about in our previous articles.

Let's try to test the anti-detect browser using a mobile device profile:

![](/media/mdeditor/7_20250110150533590383.png)

As a result of this test, we see that the anti-detect browser adds fonts that match the mobile device fonts, but the metric values of some fonts match the desktop version of the browser. The site has determined that we are using Windows Server, which in no way matches an Android mobile device.

This is also how Anti-Fraud systems can get information about system fonts in the browser. Let's look at examples of Chrome and Firefox browsers on desktop and mobile devices:

**Desktop Chrome**

![](/media/mdeditor/8_20250110150606488805.png)

**Firefox**

![](/media/mdeditor/9_20250110150628328712.png)

**Android Chrome**

![](/media/mdeditor/10_20250110150658773554.jpg)

**Android Firefox**

![](/media/mdeditor/11_20250110150742028511.jpg)

As a result of this test, we can see that browser system font families and font sizes are different on different devices in different browsers. This is how sites can determine the type of device and browser engine used.

###### Conclusion
Browser fonts are a powerful tool for anti-fraud systems. They are used to create unique “fingerprints” of devices and detect fraudulent activities. Their analysis in combination with other parameters, such as Canvas and WebGL, makes algorithms of antifraud systems more reliable.

*Bannykh M.V.

Posting terkait

Antidetect

Comparison of network fingerprints in different browsers and their impact on antifraud systems.

Network fingerprinting in antifraud systems: p0f, JA3, JA4 and other user identification methods

Modern antifraud systems use network fingerprints such as p0f, JA3 and JA4 to identify devices and detect bots.

Bannykh M.V.

30.01.25

Antidetect

Bank mtb.com registration with browser settings analysis.

A review of the anti-fraud system of the financial organization M&T Bank

Analyzing the data that the bank's anti-fraud system collects from mtb.com and methods to circumvent blocking.

Bannykh M.V.

29.03.25