Incognia
Incognia answers the identity question with geography. Its premise is that where a person is, over time, is a harder credential to fake than what device they are holding, because people handle important account actions from places they habitually occupy. The platform learns a user's trusted locations, typically home and workplace, from background location signals and motion sensors collected through a mobile software development kit. It treats a departure from that pattern at the moment of login or payment as a risk indicator, and the company reports that 90 percent of device authorizations on its network occur at a trusted location.
Incognia ID is sold as a persistent identity that survives factory resets and device swaps, paired with tamper and location spoofing detection, and clusters of devices are surfaced to expose device farms. The company describes the combination as identity affirmation rather than identity validation, and is explicit that the signal supports an identity claim rather than proving the claimant is present. A banking and fintech line covers account takeover, device authorization at high risk events and new account fraud. It also includes a transaction risk model that scores a payment high, low or unknown from hundreds of inputs.
Incognia reports that the Brazilian fintech will bank cut fraud losses by 90 percent and mobile account takeover by 80 percent with its risk based authentication. Food delivery, ride hailing and marketplace lines are sold from the same network and are not covered in this profile. The network spans close to a billion devices and more than 500 million mapped places. Its services agreement names Amazon Web Services in the United States as host and deletes personal data within 180 days, and it has a SOC 2 Type II report covering all five trust services criteria. Founded in 2010 by Andre Ferraz and Alan Gomes, it pivoted to fraud prevention in 2020 and has offices in California, New York, Sao Paulo and Recife.
Capability Axes
Capability grades
15 of 15 axes rated · 8 graded A or B
Recognizing a person after a factory reset, learning which places one individual trusts and spotting spoofed locations are inference problems, as is clustering devices to expose farms. Without the models, device fingerprinting and raw location keep some value, and the network of close to a billion devices is the asset a rival could not copy.
Signals affirm an identity claim rather than validate it, assessments come back high, low or unknown, and the client alone decides whether to approve, decline or investigate. What an institution should not do on the signal alone, or how a wrongly flagged customer gets overridden, is not addressed.
Hundreds of scenario dependent data points are the stated reason for giving no single model figure, yet identification accuracy of 99.999999 percent and a zero percent takeover rate for location enabled sessions are published without definition, sample or method. Its 17 times improvement over facial recognition is equally unsupported.
The Brazilian fintech will bank cut fraud losses by 90 percent and mobile account takeover by 80 percent with risk based authentication, though neither figure carries a period or method. Company claims of tripled revenue, 200 percent net revenue retention and an average sixfold return describe the vendor more than any customer.
Aggregated and statistical data improves the algorithms across clients through what the services agreement calls the network effect, so one client's users inform assessments for others. That comes with no opt out or training boundary, despite the pledge that SDK data serves only to provide the service.
Processor status is set in the services agreement, and dated global and United States privacy policies treat location permission as an operational requirement rather than consent, resting on legitimate interest. Transparency is left to the client application, and the applications collecting through the SDK are not named.
An annual SOC 2 Type II examination covers all five trust services criteria, with the report available under a nondisclosure agreement. No trust center or ISO certification is published, and the site calls the attestation a certification, which a SOC 2 report is not.
Annual control assessments against European, Californian and Brazilian privacy regimes come with an attestation letter, and no financial services authorization is claimed. The Gramm Leach Bliley Act, and whether a location signal can count toward strong customer authentication in European banking, go unaddressed.
Habitual location as a risk signal fails for identifiable groups rather than at random: people who move often, rent short term or work shifts across sites look away from trusted places while doing nothing wrong. By Incognia's own figure, 90 percent of authorizations happen at a trusted location, which defines the exposed 10 percent, yet no outcome testing across those groups is published.
Risk assessments are framed as statistical estimates with no warranty on AI outputs, liability is capped at three months of fees, and the client indemnifies Incognia against unlawful discrimination claims. A legitimate customer away from habitual places can be flagged at the moment of payment, with no published way to learn why or contest it.
First hand collection through Incognia's own SDK feeds the map of more than 500 million places, a meaningful point where resold location data is common. Third party AI infrastructure is permitted by the agreement without being named, and no model provider or technique is identified.
An official Node.js library on npm documents signup, login, payment and feedback calls, alongside mobile and web SDKs and a developer portal behind sign in. Integration sits inside the institution's own app release cycle, and no authentication or orchestration platform is named as a connector.
Personal data is processed and stored on Amazon Web Services in the United States and deleted within 180 days, per the services agreement. European and Brazilian customers get no region choice described.
Entry runs through a meeting with a specialist, with no rate, unit or tier published, though a proof of value agreement for trials is. Whether charges follow devices, monthly active users or assessments decides how cost scales, and that is not stated.
A banking and fintech line treats account takeover, new account fraud and transaction scoring as separate jobs, with mule account research written for banks and will bank named as a financial customer. Financial services is one of several verticals, alongside food delivery and ride hailing, and offices in the United States and Brazil extend reach into Latin America.
What Changed
Material product, regulatory, evidence and commercial changes at Incognia, each verified against a live source and tagged to the capability axis it bears on. Funding rounds and awards are not product changes and are not logged.
Incognia launched Real Time Scam Prevention for banks, which flags likely scam payments before money moves by checking for signs of a real world relationship between sender and recipient, drawn from apartment level location intelligence and persistent device recognition. It combines that with other risk signals and pools intelligence across participating banks without any of them seeing another's location data. Incognia reports identifying about 70% of scam transactions in an analysis at a bank with more than 80 million active users.
Incognia launched AI Agent Detection for financial institutions, which identifies agentic activity and assesses the risk of each action an agent initiates separately from the agent itself, combining signed request verification, agent origin classification and bot detection with Incognia's device, location and account signals. When an action needs more confidence, it can be checked against the customer's trusted devices and account history. The same release adds a read only MCP server that lets fraud analysts query evidence and device and account links from compatible AI apps.
Incognia added behavioral biometrics to its web risk intelligence, so it can now assess mouse movement and clicks, keyboard interaction, and copy, paste and cut activity, including whether those events are trusted browser events or synthetically generated. The signals are evaluated alongside its browser, device, integrity, bot and automation, and Verified IP Location signals, with step up to Cross Device Authentication on a trusted phone when web evidence is not enough.
Alternatives to Incognia
Vendors in the same categories as Incognia whose profiles look most alike, each with a line on what the product does. Similar is not the same: check that each one does the job you need. No vendor pays for placement.
Fraud.net unifies fraud prevention, anti money laundering compliance and risk management on one platform for banks, credit unions, payment processors, acquirers, remittance companies…
Refine Intelligence automates the customer outreach banks use to resolve fraud and AML alerts.
Coris supplies merchant risk infrastructure to the parties that underwrite merchants rather than to merchants themselves, covering software platforms with embedded payments, independent…
Cybera sells banks, crypto platforms and cyber insurers two products aimed at authorized payment scams.
ThreatMark builds a behavioral baseline for each banking customer and watches for departures from it, profiling how a person physically uses a device, keystroke rhythm, navigation habit…
Accertify is an enterprise fraud prevention and payments company based in Itasca, Illinois, and led by president Mark Michelon.
The index publishes no overall score or ranking. See what we assess and the methodology.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | Data Protection Terms | Implementation | Source |
|---|---|---|---|---|
|
Not published. No price, unit, tier or contract term is shown; trials run under a published proof of value agreement.
|
Quoted per customer. Nothing indicates whether charging follows devices, monthly active users, risk assessments, transactions, applications or seats, or whether the persistent identity, location intelligence, spoof detection and transaction risk products are licensed together or separately. The 200 percent net revenue retention Incognia reports implies a basis that scales with usage or coverage within existing accounts. | Not tiered on any published pricing. Incognia publishes global and United States privacy policies, a services agreement that names Amazon Web Services in the United States as host and deletes personal data within 180 days, an annual SOC 2 Type II report covering all five trust services criteria under a nondisclosure agreement, and annual assessments against European data protection requirements. The agreement lets it use aggregated data to improve its algorithms across clients. | No implementation, integration or professional services fee is published. Delivery is a software development kit in the customer's mobile app with web coverage, plus an official Node.js library for server calls, so the work sits inside the institution's own release cycle and app store submission. Trials run under a published proof of value agreement. | Vendor Published |
Incognia publishes no rate, unit, tier or contract price as of 2 October 2026, and its entry route is a meeting with a specialist. It publishes a proof of value agreement for trials, and its funding material states an average sixfold return on investment and savings of millions of dollars per contract, which place contract sizes in enterprise territory without giving a price. The value of the product rises with the network behind it, and the client applications feeding that network are not named, so a buyer cannot assess coverage in its own market before contracting.