Topic starter
11/07/2026 1:57 pm
TL;DR: Device farms and emulator-based attacks can automate mass account creation, inject video streams, and distort onboarding economics in fintech, crypto, and superapps, according to Oz Forensics. The governance gap is no longer face verification alone, but whether identity systems can detect synthetic device behaviour before costly biometric processing begins.
Editorial analysis by NHI Mgmt Group, based on content published by Oz Forensics: “Device Farms & Emulator Attacks: How to Stop Synthetic Identity Fraud at Scale”.
Key questions
Q: What breaks when device farms are not detected in onboarding?
A: When device farms are not detected, onboarding controls validate the appearance of a user while the fraud actor controls the session at scale.
Q: Why do emulator attacks increase fraud risk in digital onboarding?
A: Emulator attacks increase fraud risk because they let one operator run many parallel sign-up attempts while bypassing assumptions that depend on a physical handset.
Q: How can teams tell if onboarding controls are failing against synthetic users?
A: Warning signs include unusually high registration volume from a small number of device patterns, repeated failures that look like automation, and verification spend rising faster than real customer growth.
Practitioner guidance
- Implement pre-biometric device integrity checks Screen for emulator signatures, rooted devices, and virtual camera drivers before any face capture or liveness workflow begins.
- Separate device risk from biometric outcome Log device trust signals independently so fraud teams can see whether a session failed because of environment manipulation rather than presentation quality.
- Throttle automated onboarding attempts Rate-limit repeated sessions from the same device patterns, IP clusters, and automation fingerprints to reduce farm-driven volume.
Bottom line: Device farms and emulator attacks turn onboarding into a throughput problem that can overwhelm face-centric fraud controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
Device trust is the missing control plane in digital onboarding: face verification cannot carry the full burden of identity assurance when the capture environment itself is synthetic. The article shows that attackers now manipulate the device layer before any biometric logic runs. For practitioners, that means onboarding governance must treat the device as a first-class trust object, not a passive conduit.
A few things that frame the scale:
- Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.
A question worth separating out:
Q: How should identity teams combine device checks with liveness controls?
A: Teams should treat device integrity as the gate before liveness, then reserve biometric processing for sessions that pass the environment check. That sequencing prevents expensive verification from being spent on synthetic traffic and gives fraud teams a cleaner signal set. It also improves governance because device trust and face assurance are evaluated separately, not blended into one score.
👉 Read our full editorial: Device farms and emulator fraud expose gaps in digital onboarding