Automation Abuse

Investigate automated registrations and repeated abuse using device, runtime, and account context. Add client evidence to rate limits and transaction controls.

A small fleet can support a large account operation.

A phone farm puts rows of real devices under coordinated control. The same signup, promotion, or account action can run across them again and again. Each request may look like an ordinary mobile user; together, they can flood your service with disposable accounts and repeated abuse.

Physical phone farms and SIM-rental services give operators repeatable access to mobile accounts. These separate law-enforcement case studies show account scale and downstream harm; they are not estimates of all mobile automation abuse.

Accounts controlled per phone

Two phone-farm facilities · DOJ indictment · accounts per device

76,000social accounts controlled by 1,250 phones, according to the indictment

Average across the alleged fleet60.8

About 61 accounts for every phone in the fleet.

Derived average: 76,000 accounts ÷ 1,250 phones = 60.8. These are allegations describing two facilities in a 2025 indictment, not proven findings or an industry average. The ratio does not imply every phone controlled the same number of accounts.

U.S. Department of JusticePage 10 · paragraph 33

View underlying data

Accounts controlled per phone — Two phone-farm facilities · DOJ indictment · accounts per device
Category	Value
Average across the alleged fleet	60.8

Fraud cases linked to the service

Operation SIMCARTEL · RIA summary of Europol findings · 2025

49 million+fake online accounts created using the SIM-rental platform

Austria1,700

Latvia1,500

Mass account creation became infrastructure for fraud.

RIA reports 1,700 linked cyber-fraud cases in Austria and 1,500 in Latvia, and more than 49 million fake accounts created using the platform. The account figure is cumulative, not concurrent. SIM rental is distinct from a physical phone farm; these counts are not an app-specific automation rate or an AI attribution.

RIA · Estonian Information System AuthorityInternational situation · SIMCARTEL

View underlying data

Fraud cases linked to the service — Operation SIMCARTEL · RIA summary of Europol findings · 2025
Category	Value
Austria	1,700
Latvia	1,500

More plausible accounts, produced with less effort.

OWASP describes bulk account creation as a foundation for subsequent misuse. The FBI’s AI warning adds a related concern: criminals can generate large numbers of fictitious profiles and convincing messages with less manual work.^[3]^[4]

The infrastructure is already industrial: a bank of phones or rented numbers can support large populations of accounts. AI can supply the profiles and messages around that activity. The cases above illustrate the scale of the infrastructure; neither source measures how much of it was driven by AI.^[1]^[2]^[4]

Physical devices do not guarantee genuine activity.

Real phones can be rooted or jailbroken, instrumented, and controlled in parallel. Cipherstep examines supported operating-system and runtime observations so your backend can act on evidence of manipulation, even when the hardware is physical.

The example combines OS modification, instrumentation, runtime hooks, and contradictory device identity observations. Completed network analysis adds an activity-pattern finding: an unusual concentration of newly observed accounts. Strong runtime findings drive the block; inconsistency and account velocity help analysts investigate the wider operation.

Your backend can stop this registration and review related sessions in the Analyst Portal. RASP can interrupt supported runtime manipulation. A farm operating clean apps may produce no runtime finding, so retain account limits, promotion rules, and review of coordinated activity. A bank of phones is not, by itself, proof of fraud.^[3]

Real phones can still work as one operation.

Illustrative session · highlights show the decision and supporting findings.

Rows of physical phones connected to computers, shown with a purple duotone treatment. — Supplied phone-farm photographs · illustrative settings, separate from the synthetic evaluation.

Rows of exposed mobile phone boards connected by cables in a device farm, shown with the same purple duotone treatment. — Supplied phone-farm photographs · illustrative settings, separate from the synthetic evaluation.

Decision API response

JSON

GET/v1/evaluations/{evaluationId}

{
  "evaluationId": "6f626279-59b7-4dc3-9557-b2bd7db0a103",
  "userId": "registration-example",
  "status": "complete",
  "analysis": {
    "decision": "block",
    "signals": [
      {"type": "device_identity_inconsistent", "confidence": 100},
      {"type": "dynamic_instrumentation_detected", "confidence": 90},
      {"type": "ip_new_user_velocity", "confidence": 80},
      {"type": "jailbreak_detected", "confidence": 90},
      {"type": "physical_device_observed", "confidence": 80},
      {"type": "runtime_hooking_detected", "confidence": 95}
    ]
  },
  "analysisVersion": 5,
  "networkPending": false
}