Device Spoofing
Device spoofing means falsifying the identity or properties a mobile app sees about its device. An attacker might change reported identifiers, imitate a different phone model, or make an emulator appear to be a physical handset.[1][2]
The aim is often to appear as a new or trusted device, avoid a restriction, or conceal repeated account creation. A device label is a claim made by the client. Device binding needs stronger evidence than a value that can be copied or changed.[3]
Examples
- An operator changes reported device identifiers between registrations to make repeat signups look unrelated.
- An emulator reports the model and OS version of a common Android phone while running automated onboarding.
- A hooked system API returns an expected device value instead of the one the app would normally observe.
How Cipherstep helps
Cipherstep’s Attestation SDK collects device, operating-system, and runtime observations and seals them for server-side analysis. The Decision API checks supported observations for inconsistencies and signs of emulation or instrumentation, rather than trusting a single reported identifier.
Your backend requests fresh attestation at a protected action, waits for the completed evaluation, and applies its policy before the action proceeds. Analysts can review the findings and available user and device history in the Data Explorer to investigate repeat activity.
Identifiers can also change after legitimate resets or reinstalls. An inconsistency is a reason to assess the session, not proof of fraud. Available device history is not a permanent identity across every reset, and emulator detection does not establish who is using it.[1]