It's well known that people can be identified from the way they write, or even type. Now, in a paper, Balaji Padmanabhan and Catherine Yang claim that users can also be identified by their surfing behaviour. According to the Wharton Business School's Knowledge@Wharton:
The authors conclude that by observing these patterns, an e-commerce company can distinguish between two individuals with nearly 100% accuracy, sometimes with as few as three Internet sessions, and potentially use that information to deter fraud. The number of sessions needed to identify an individual rises with the number of unique users a site has because there are more people to differentiate.
While Padmanabhan and Yang focus on whether individuals have clickprints, the number of sessions needed to identify a unique individual, and potential fraud prevention applications, the paper also shows how companies can track users just by watching behavior. "Our main finding is that even trivial features in an Internet session can distinguish users," says Padmanabhan. "People do seem to have individual browsing behaviors."
This could be useful in preventing fraud. For example, if you use an ecommerce site regularly, it could build up a clickprint based on your normal use. If your account is used with a radically different clickprint, this could prompt the system to make extra checks.
Some profiling is already used in the financial services industry. If you're a non-gambler who never travels, for example, you're more likely to get a phone check if you use a card to withdraw $10,000 in a Las Vegas casino.
