Why did you choose device ID binding for unauthorized payments, and what alternatives exist?

Binding to device ID for unauthorized payments is often chosen as a way to identify the user's device without the need for full authentication. This allows limiting the number of payment attempts from a single device, reducing the risk of fraud, and simplifying UX.

However, this approach has limitations: the device ID can be changed (for example, when changing devices or resetting settings), and it is not always unique or accessible due to platform restrictions.

Alternatives:

• Using cookies or localStorage to store a unique session identifier.
• Binding to IP address (but it can change and is not unique).
• Using biometrics or browser fingerprints for more accurate identification.
• Requesting minimal authentication (e.g., via OTP on the phone) to confirm identity.

The choice depends on the balance between user convenience and security level.