Mobile app fraud: are your secrets and tokens actually safe?

TL;DR: Sports and betting fraud now succeeds against genuine mobile apps because attackers target hardcoded secrets, backend API trust assumptions and session tokens, according to Approov, while AI lowers the cost of reverse engineering and abuse. The real control shift is from trusting app stores to protecting the app at runtime with zero secrets architecture, runtime secrets protection, RASP and certificate pinning.

Editorial analysis by NHI Mgmt Group, based on content published by Approov: “Sold-Out Stadiums, Stolen Wallets: Why Mobile Sports and Betting Apps Are the Scam Frontier This Season”.

Key questions

Q: What breaks when a mobile app still contains secrets or tokens in its binary?

A: The app stops being a thin client and becomes a reusable credential store.

Q: Why do legitimate mobile apps still get abused for fraud?

A: Because app store legitimacy does not protect the runtime environment.

Q: What are the signs that a mobile app’s anti-tamper controls are failing in practice?

A: Warning signs include keys that can be traced through obfuscated code, runtime hooks that still reveal sensitive flows, and protections that only slow down analysis rather than stop it.

Practitioner guidance

• Eliminate embedded mobile secrets Remove API keys, tokens and credentials from the app binary and issue only runtime secrets to verified app instances.
• Bind backend trust to app attestation Require evidence that the client is a genuine, untampered app before granting access to ticketing or betting APIs.
• Treat token theft as a session design problem Reduce bearer token lifetime, limit scope and revoke sessions aggressively when misuse or device compromise is suspected.

Bottom line: The core risk is that a legitimate mobile app can still be compromised through its secrets, APIs and sessions even when the download path was legitimate.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →