Mobile app fraud: trust the install, not just the request

The threat

A claim endpoint used by an app can be called by anything that can copy its requests. Without a trusted device identity, every reinstall and every script looks like a new user.

What we stop

• Scripted calls that do not come from your genuine app, when the platform proofs are on.
• Repeat claims from the same install or the same household.
• Replayed requests: attestations are single-use.

Device checks for rooted, hooked and spoofed devices

These checks come with the mobile SDKs from version 0.7.0 and appear in the signals of each event, read with your secret key. Each is true, false, or null when it could not be checked. They run on the device, so a determined attacker can hide from them; use them as evidence in your rules, for example a human check for rooted devices. They are recorded and returned to you but not scored yet: they do not change the trust score or the decision unless a rule of yours acts on them.

• Root and jailbreak: installs on a rooted Android device or a jailbroken iPhone.
• Hooking frameworks: tools attached to the app to change how it behaves.
• Emulators and simulators, debuggers, and Android developer mode.
• Traffic interception and a VPN running on the device.
• Location spoofing, when the app already has location access.
• Cloned apps: an Android app running in a clone or parallel space.

See the signals →

Platform proofs

Play Integrity on Android, and App Attest and DeviceCheck on iOS and macOS, are checked on our server once your project knows your app. Without a proof the device is still identified, but it is scored as unattested and the decision is stricter.

Install the SDKs →

Identify an Android install

val checker = FpChecker(
    context,
    FpCheckerConfig(baseUrl = "https://api.fpchecker.com", publishableKey = "pk_..."),
)
lifecycleScope.launch {
    val intentToken = fetchIntentFromBackend() // your backend calls POST /v2/intents
    when (val r = checker.identify(intentToken)) {
        is FpIdentifyResult.Success -> sendToBackend(r.attestation)   // the backend decides
        is FpIdentifyResult.Failure -> log("identify failed: ${r.reason}")
    }
}

Frequently asked questions