**Last updated**: 16 July 2026 | [**Change log**](/products/fraudsight/changelog/)

Move to Ravelin SDK
The ThreatMetrix SDK is being phased out. Instructions for our [FraudSight API](/products/fraudsight/device-data/web) and [Payments API](/products/payments/enable-features/fraud-assessment/device-data/web) have been updated to use the Ravelin SDK.

# Web device data

When combined with order and transaction details, device data (IP address, Device Id, geolocation information, etc.) can be a strong indicator for fraud or used via GeoIP lookup to create manual rules based on location.

Utilizing device data with Access FraudSight is a two-step process. Step one is to collect the device data. Step two is to submit an [assessment](/products/fraudsight/assessment) that will use the device data for evaluation.

Described below is step one for Web (JS).

## ThreatMetrix JS

ThreatMetrix JS library for web sites. It leverages the ThreatMetrix platform to detect fraud and security vulnerabilities originating from browsers in real-time.

### Overview of implementation

1. Create a JavaScript file containing the "ThreatMetrix JavaScript V4" data below. The name of the file should be anonymous, e.g asdfghjkl.js
2. Rename the function threatmetrix.profile (from the file asdfghjkl.js) to something anonymous, e.g. awddc.prfl
3. On the web page where device data collection will occur, place the following (or similar) in the head section  `<script type="text/javascript" src="path/to/asdfghjkl.js"></script>`
4. Call the device profiling function (awddc.prfl) from the web page using the following (or similar)  `<script type="text/javascript">awddc.prfl ("PROFILING_DOMAIN", "ORGANISATION_ID", sessionid);</script>`


**Note**: See “Details required” section below describing function parameters.

details
summary
ThreatMetrix JavaScript v4
Change the function name `threatmetrix.profile` to one of your own in the following:

```json
var threatmetrix=threatmetrix||{};threatmetrix.version=4,threatmetrix.create_url=function(t,e,r,n,c){function i(){return Math.floor(2742745743359*Math.random())}function a(){return o(i())}function o(t){return(t+78364164096).toString(36)}var m=i(),u=i(),l=885187064159;u=((u=u-u%256+threatmetrix.version)+m)%2742745743359,l=(l+m)%2742745743359;var s="https://"+t+"/"+(m=a()+o(m))+e,h=[(u=o(l)+o(u))+"="+r,a()+a()+"="+n];return void 0!==c&&c.length>0&&h.push(a()+a()+"="+c),s+"?"+h.join("&")},threatmetrix.beacon=function(t,e,r,n){var c="turn:aa.online-metrix.net?transport=",i="1:"+e+":"+r,a={iceServers:[{urls:c+"tcp",username:i,credential:r},{urls:c+"udp",username:i,credential:r}]};try{var o=new RTCPeerConnection(a);o.createDataChannel(Math.random().toString());var m=function(){},u=function(t){o.setLocalDescription(t,m,m)};"undefined"==typeof Promise||o.createOffer.length>0?o.createOffer(u,m):o.createOffer().then(u,m),setInterval(function(){o.close()},1e4)}catch(t){}},threatmetrix.load_tags=function(t,e,r,n){threatmetrix.beacon(t,e,r,n);var c=document.getElementsByTagName("head").item(0),i=document.createElement("script");i.id="tmx_tags_js",i.setAttribute("type","text/javascript");var a=threatmetrix.create_url(t,".js",e,r,n);i.setAttribute("src",a),threatmetrix.set_csp_nonce(i),c.appendChild(i)},threatmetrix.csp_nonce=null,threatmetrix.register_csp_nonce=function(t){if(void 0!==t.currentScript&&null!==t.currentScript){var e=t.currentScript.getAttribute("nonce");null!=e&&""!==e?threatmetrix.csp_nonce=e:void 0!==t.currentScript.nonce&&null!==t.currentScript.nonce&&""!==t.currentScript.nonce&&(threatmetrix.csp_nonce=t.currentScript.nonce)}},threatmetrix.set_csp_nonce=function(t){null!==threatmetrix.csp_nonce&&(t.setAttribute("nonce",threatmetrix.csp_nonce),t.getAttribute("nonce")!==threatmetrix.csp_nonce&&(t.nonce=threatmetrix.csp_nonce))},threatmetrix.cleanup=function(){for(;null!==(hp_frame=document.getElementById("tdz_ifrm"));)hp_frame.parentElement.removeChild(hp_frame);for(;null!==(tmx_frame=document.getElementById("tmx_tags_iframe"));)tmx_frame.parentElement.removeChild(tmx_frame);for(;null!==(tmx_script=document.getElementById("tmx_tags_js"));)tmx_script.parentElement.removeChild(tmx_script)},threatmetrix.profile=function(t,e,r,n){void 0!==t&&void 0!==e&&void 0!==r&&8===e.length&&(threatmetrix.cleanup(),threatmetrix.register_csp_nonce(document),threatmetrix.load_tags(t,e,r,n))};
```

## Details required

To call the device data function you need the following details:

| Placeholder | Description |
|  --- | --- |
| `ORGANISATION_ID` | For testing, use: `afevfjm6`For live, use: `dzppsd1h` |
| `PROFILING_DOMAIN` | For testing, use: `ddc-test.worldpay.com`For live, use: `ddc.worldpay.com` |
| `sessionId` | You must generate a unique value for the page view to represent that specific device data collection.A valid sessionId is between 30 and 128 characters long and consists of only upper or lowercase English letters (a-z, A-Z), digits (0-9), hyphens (-) or underscores (_). To make an incorrect match unlikely we recommend a UUID. |


## Example sessionId generation

You must submit the sessionId in the [assessment](/products/fraudsight/assessment) request in order for the device data to be applied as part of the risk assessment. We recommend you generate this in the backend as part of the page generation. Alternatively, you can generate it via JS and then submit it, so it's available in the backend.

```
function create_uuid() {
  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
   var r = Math.random() * 16 | 0,
     v = c == 'x' ? r : (r & 0x3 | 0x8);
    return v.toString(16);
 });}
```

## Call ThreatMetrix function

```
var sessionid = create_uuid(); // function to create UUID
awddc.prfl ("PROFILING_DOMAIN", "ORGANISATION_ID", sessionid); // call Threatmetrix
```

## Linking the device data with the assessment

When sending the [FraudSight assessment](/products/fraudsight/assessment) request, include the sessionId in `deviceData.collectionReference`

**Next steps**

[Assessment](/products/fraudsight/assessment)