A computer system identifies one or more characteristics corresponding to a memory of a user device based on analyzing information stored in the memory of the user device during one or more instances of a first time period. The computer system detects an untrusted user device attempting to access an account during a second time period. In response to the detecting the untrusted device attempting to access the account, the computer system compares one or more characteristics of the information stored in a memory of the untrusted user device to the identified one or more characteristics. In response to determining that a similarity level between the one or more characteristics of the information stored in the memory of the untrusted device and the identified one or more characteristics is above a threshold level, the computer system allows access to the account.