Account takeover doesn’t usually show up as a failed login. The attacker already has a valid session (a stolen cookie, a leaked token, or credentials reused from another breach), so from the platform’s point of view, it looks like the legitimate customer just kept browsing.
What actually changes
What doesn’t carry over cleanly is the device and behavior underneath the session. A device fingerprint built from canvas rendering, WebGL, audio processing, fonts, and hardware signals is specific to the machine and browser that generated it. When a session moves to a different device (a new browser, a different OS, a different piece of hardware entirely), that fingerprint shifts, even though the session token itself is still “valid.”
Behavioral patterns shift too. Typing cadence, mouse movement, and scroll behavior are hard to reproduce across different people even when both are using the same account.
Where the threshold comes from
Skyfense tracks fingerprint similarity continuously during a session and flags a drop below roughly 67% similarity as a likely hijack signal. That threshold isn’t arbitrary. Normal fingerprint variation within a single real session (browser updates, minor environment changes, network shifts) stays well above it, while a genuine device swap drops well below it. Sessions that cross the line get re-evaluated rather than trusted on the strength of a still-valid cookie.
The result is a check that doesn’t depend on the attacker doing anything wrong at the login step, because there often isn’t one.