Device farms and emulator fraud expose gaps in digital onboarding

At a glance

What this is: Oz Forensics argues that device farms and emulator-based fraud industrialise synthetic onboarding by bypassing face-centric checks and driving up verification costs.

Why it matters: Identity teams need to treat device integrity as part of onboarding governance, because biometric assurance alone will not stop large-scale synthetic registration, subsidy abuse, or distorted risk models.

Context

Device farms and emulator fraud exploit a governance gap in digital onboarding: organisations often validate the person while overlooking the device and environment producing the biometric signal. That leaves KYC and liveness controls exposed to automation that looks legitimate at the surface but is synthetic at scale.

This matters across identity verification, fraud prevention, and IAM-adjacent onboarding workflows because the first trust decision now happens before the face check, not after it. When the device is fake, downstream assurance, account lifecycle, and risk scoring are all built on a false start.

Key questions

Q: What breaks when device farms are not detected in onboarding?

A: When device farms are not detected, onboarding controls validate the appearance of a user while the fraud actor controls the session at scale. That leads to synthetic accounts, wasted verification spend, and polluted risk data. The failure is structural, because the organisation is paying to authenticate traffic that should have been blocked as non-genuine before biometric processing.

Q: Why do emulator attacks increase fraud risk in digital onboarding?

A: Emulator attacks increase fraud risk because they let one operator run many parallel sign-up attempts while bypassing assumptions that depend on a physical handset. The result is industrialised abuse of incentives, referral flows, and identity verification budgets. In high-volume onboarding, the business impact is not only fraud loss but distorted growth and model quality.

Q: How can teams tell if onboarding controls are failing against synthetic users?

A: Warning signs include unusually high registration volume from a small number of device patterns, repeated failures that look like automation, and verification spend rising faster than real customer growth. The key signal is mismatch between apparent acquisition and downstream retention, because synthetic users often convert poorly once the initial incentive is collected.

Q: How should identity teams combine device checks with liveness controls?

A: Teams should treat device integrity as the gate before liveness, then reserve biometric processing for sessions that pass the environment check. That sequencing prevents expensive verification from being spent on synthetic traffic and gives fraud teams a cleaner signal set. It also improves governance because device trust and face assurance are evaluated separately, not blended into one score.

Technical breakdown

Emulators turn onboarding into parallelised fraud

An emulator reproduces a mobile device in software, so one host can run many onboarding sessions at once. Device farms add physical phones managed by automation, which increases realism and scale. In both cases, the attacker is not trying to defeat a single identity proofing step manually. They are industrialising the workflow, generating traffic that looks like many ordinary users while a coordinated actor captures incentives, training data, and review capacity. The technical problem is throughput, not just deception.

Practical implication: assess onboarding risk at the session and device layer, not only at the biometric outcome.

Why presentation attack detection misses injection attacks

Presentation attack detection looks for optical signs such as glare, blur, and depth inconsistencies when a camera is presented with a face. Injection attacks bypass that sensor layer entirely by inserting video into a virtual camera, API stream, or device driver. The video can be pristine because it never passes through a physical lens. That means the system may correctly answer that a face is present while missing the more important question of whether the capture chain is genuine.

Practical implication: add environment integrity checks before biometric processing starts, or PAD will be solving the wrong problem.

Device-centric controls change the economics of identity verification

A device-centric model shifts trust from the image alone to the integrity of the environment that produced it. That includes checks for emulator signatures, rooted devices, virtual camera drivers, and automation patterns. The value is partly security and partly cost control, because the goal is to stop synthetic sessions before they consume biometric API calls, cloud processing, or manual review time. In identity programmes, this is a governance issue as much as a detection issue.

Practical implication: enforce pre-biometric screening so the onboarding cost is incurred only after the session passes basic device trust checks.

NHI Mgmt Group analysis

Device trust is the missing control plane in digital onboarding: face verification cannot carry the full burden of identity assurance when the capture environment itself is synthetic. The article shows that attackers now manipulate the device layer before any biometric logic runs. For practitioners, that means onboarding governance must treat the device as a first-class trust object, not a passive conduit.

Synthetic onboarding creates both fraud losses and assurance debt: the problem is not limited to individual fake accounts. Mass automation distorts conversion metrics, inflates customer acquisition cost, and corrupts downstream fraud and credit models with non-human behaviour. That combination turns identity fraud into a programme-level data quality issue, which is why the control failure matters well beyond the fraud team.

Device farms expose the gap between identity proofing and identity lifecycle governance: an organisation can have strong verification steps and still admit synthetic users if it does not govern the environment in which proofing occurs. This is the operational version of a verification trust gap, where the control assumes the signal source is real. Practitioners should treat onboarding integrity as part of identity governance, not as an isolated fraud check.

Device-centric verification is becoming a baseline expectation for high-volume digital businesses: fintech, crypto, lending, and superapp onboarding all face the same economic pressure to approve quickly. That makes pre-biometric environment checks the practical control boundary, because every delayed detection increases both spend and false growth signals. Identity teams should reframe onboarding assurance around source integrity, not just person validation.

From our research library:

• Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.

What this signals

Device-centric onboarding is becoming a governance requirement, not a niche fraud feature: once attackers can scale emulators and virtual cameras, identity teams need controls that evaluate capture integrity before biometric trust. The practical shift is to make device authenticity part of the onboarding decision, not a post-verification review.

Verification trust gap: this is the failure mode exposed by emulator fraud, where systems trust the source of the biometric signal instead of validating the source itself. For practitioners, the implication is simple: if the capture environment can be faked, the assurance model has already been compromised.

For practitioners

• Implement pre-biometric device integrity checks Screen for emulator signatures, rooted devices, and virtual camera drivers before any face capture or liveness workflow begins.
• Separate device risk from biometric outcome Log device trust signals independently so fraud teams can see whether a session failed because of environment manipulation rather than presentation quality.
• Throttle automated onboarding attempts Rate-limit repeated sessions from the same device patterns, IP clusters, and automation fingerprints to reduce farm-driven volume.
• Align fraud controls with onboarding economics Track the cost of synthetic sessions across biometric API spend, review labour, and incentive leakage so finance and risk owners see the full impact.
• Review KYC assumptions for mobile capture trust Reassess whether your onboarding design assumes a real camera, a real user, and a real handset, because emulator fraud breaks all three assumptions.

Key takeaways

• Device farms and emulator attacks turn onboarding into a throughput problem that can overwhelm face-centric fraud controls.
• The article shows how synthetic sessions inflate verification cost, degrade growth metrics, and contaminate downstream risk models.
• Practitioners should move device integrity checks ahead of biometric processing so non-genuine sessions never consume verification resources.

Key terms

• Device Farm: A device farm is a collection of physical smartphones or tablets that attackers control through automation to run many onboarding sessions at once. In fraud campaigns, it provides scale, repeatability, and a way to mimic real mobile behaviour while evading controls that only look at a single device.
• Emulator: An emulator is software that imitates a mobile device on desktop or server infrastructure. It lets attackers script large numbers of parallel sessions, inject media into identity flows, and present synthetic behaviour that can look normal unless the organisation checks the execution environment as well as the user.
• Injection attack: An attack that inserts synthetic or manipulated data directly into the verification flow rather than fooling the sensor itself. For identity programmes, this is a control-path problem, because the attacker may bypass the visible presentation layer and exploit the software decision point.
• Presentation Attack: A presentation attack is an attempt to fool a biometric system with a fake face, replayed video, mask, or other synthetic artefact. In practice, the control fails when it measures resemblance alone, because the attacker’s objective is to pass as the real user without actually being that person.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader access and lifecycle decisions their programmes depend on.