Cross-Account Collusion — Shared Device Fingerprint

Synthetic-identity fraud signature: multiple accounts created on the same device share a device_fingerprint. Find every PAIR of accounts that share a fingerprint — production fraud teams add IP blocks, browser fingerprints, and behavioral patterns on top, but device alone catches the obvious cases.

Use a self-join with a1.account_id < a2.account_id to avoid double-counting and self-pairs. Show account_a, account_b, device_fingerprint, a_signup, b_signup, hours_apart (rounded to 1 decimal — accounts created within hours of each other are the most suspicious).

Order by hours_apart ascending (closest signups first).