Threats / 06 Mobile app fraud

Device spoofing is a technique used by those who want to convince an app that they’re using a real, physical mobile device, when actually they’re not. Instead, they’re using emulators or virtual devices that have been modified and configured to mimic the specifications and behavior of a mobile device. In Android, for example, it’s possible to modify the fingerprint, system properties, and user agents of an emulator using setprop utility from the OS so that it gets recognized as a valid, physical mobile device by your mobile application or its backend system.

As with location spoofing, mobile games are a common target for fraudsters using device spoofing. By using an emulator on their computer, they’re able to beat other players who are using their mobile devices. That’s because by using an emulator on their computer, fraudsters enjoy access to better game controls via their keyboard, mouse, or joysticks. An emulator can also be used to spoof the location in location-based mobile games. And for tech-savvy fraudsters, emulators can also be used to facilitate cheating or hacking of the mobile game itself.

Bad actors can also use emulators and virtual devices to deplete your mobile ads budget significantly. By setting up a device farm full of emulators, they can run a bot or automation script inside it to automatically click on advertisements in your mobile app. These bots may also end up giving you a false impression of users, click rates, and overall growth. A rapid rise in engagement might actually be a result of actions carried out by controlled “zombies” instead of real human users.

By carrying out app cloning, fraudsters can trick you into believing that they’re using a genuine instance of your mobile application. They can clone your app by attempting to reverse-engineer, build, and redistribute a modified version of it to public app stores (Google Play and Apple App Store). Or they can create a custom container that wraps your application inside - known as app wrapping or virtualization-based repackaging - and distribute it publicly.

A big motivation for bad actors cloning your mobile application is the ability to spread malicious code and to trick your end users - especially non-technical ones - into thinking it’s the real deal. Bad actors can use malicious code to extract sensitive information from your users, such as authentication credentials or payment or financial information. In addition, cloning attempts can also enable fraudsters to extract intellectual property from your application and monetize it elsewhere.

Imagine your business offers some premium content for free via your app for end users who live in a particular region or location. Other users living outside that region would have to pay to access it. Fraudsters might try to cheat this system by spoofing their location. And so without any protection they’d be able to unlock premium content without needing to pay, denying you potential revenue.

Then there are the softer initial results of fraud that can grow over time to have a really negative impact further down the line. Device spoofing as we’ve covered is where players use emulators to gain an unfair advantage over those playing your mobile game the way you intended it to be played. This activity can lead to a resentful environment and increasing levels of churn among your loyal players, which will contribute to drop in your revenues.

Fraudsters often use VPNs or proxy servers located in other regions to fool location checking systems. They also use location spoofing apps to send fake or simulated location data to the system. Fortunately, preventing location spoofing fraud isn’t as difficult as you might imagine. Blocking the usage of VPN services or proxy servers is effective. And both iOS and Android provide APIs that you can use to verify if the current device location is mocked or simulated.

The last few years have seen all of us walking a delicate tightrope between convenience and security. One such example is the ability to authenticate your app using your own phone number without having to create a new account with your e-mail account. But this convenience carries risk with it. SIM swap fraud targets these types of apps or systems. 

To prevent SIM swap fraud, the emphasis should be on how your authentication system could be improved. For example, enabling multi-factor authentication such as one-time passcode apps (such as Google Authenticator), hardware tokens, and biometrics. Another option is to implement device binding - having a one device per account policy. So, in other words a successful authentication would require access to both the phone number and the tied device itself.

Dynamic repackaging and device spoofing rely on software-based execution environments, known as virtualized environments (which we’ve also covered in this guide.) And location spoofing fraud is often performed via spoofed or non-authentic devices. To protect your app against these attacks, you should make sure that you use a security solution that’s capable of checking for and blocking any attempt to run it in such environments.