Topic starter
11/07/2026 1:57 pm
TL;DR: Synthetic sessions can turn onboarding into a throughput problem and drive verification costs higher, according to Oz Forensics. Device integrity checks need to come before biometric processing so non-genuine sessions do not consume verification resources.
Editorial analysis by NHI Mgmt Group, based on content published by Oz Forensics: “Device Farms & Emulator Attacks: How to Stop Synthetic Identity Fraud at Scale”.
Key questions
Q: Why do emulator attacks increase fraud risk in digital onboarding?
A: Emulator attacks increase fraud risk because they let one operator run many parallel sign-up attempts while bypassing assumptions that depend on a physical handset.
Q: How can teams tell if onboarding controls are failing against synthetic users?
A: Warning signs include unusually high registration volume from a small number of device patterns, repeated failures that look like automation, and verification spend rising faster than real customer growth.
Q: What breaks when device farms are not detected in onboarding?
A: When device farms are not detected, onboarding controls validate the appearance of a user while the fraud actor controls the session at scale.
Practitioner guidance
- Implement pre-biometric device integrity checks Screen for emulator signatures, rooted devices, and virtual camera drivers before any face capture or liveness workflow begins.
- Separate device risk from biometric outcome Log device trust signals independently so fraud teams can see whether a session failed because of environment manipulation rather than presentation quality.
- Throttle automated onboarding attempts Rate-limit repeated sessions from the same device patterns, IP clusters, and automation fingerprints to reduce farm-driven volume.
Bottom line: Device farms and emulator attacks turn onboarding into a throughput problem that can overwhelm face-centric fraud controls.
Glossary terms: Emulator, Device Farm, Injection attack, Presentation Attack
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 hours ago by NHI Mgmt Group
11/07/2026 2:08 pm
Device trust is the missing control plane in digital onboarding: face verification cannot carry the full burden of identity assurance when the capture environment itself is synthetic. The article shows that attackers now manipulate the device layer before any biometric logic runs. For practitioners, that means onboarding governance must treat the device as a first-class trust object, not a passive conduit.
A few things that frame the scale:
- Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.
A question worth separating out:
Q: How should identity teams combine device checks with liveness controls?
A: Teams should treat device integrity as the gate before liveness, then reserve biometric processing for sessions that pass the environment check. That sequencing prevents expensive verification from being spent on synthetic traffic and gives fraud teams a cleaner signal set. It also improves governance because device trust and face assurance are evaluated separately, not blended into one score.
👉 Read our full editorial: Device farms and emulator fraud expose gaps in digital onboarding