Notifications
Clear all
Topic starter
11/07/2026 1:57 pm
TL;DR: Device farms and emulator-based attacks can automate mass account creation, inject video streams, and distort onboarding economics in fintech, crypto, and superapps, according to Oz Forensics. The governance gap is no longer face verification alone, but whether identity systems can detect synthetic device behaviour before costly biometric processing begins.
NHIMG editorial — based on content published by Oz Forensics: Device Farms & Emulator Attacks: How to Stop Synthetic Identity Fraud at Scale
Questions worth separating out
Q: How should identity teams stop device-farm fraud before biometric checks run?
A: The most effective pattern is to validate device integrity before any biometric or liveness workflow starts.
Q: Why do emulators create a larger fraud problem than single fake accounts?
A: Emulators turn fraud into a scale problem.
Q: What do security teams get wrong about liveness detection in onboarding?
A: They often treat liveness as proof that the capture source is trustworthy.
Practitioner guidance
- Implement device integrity checks before liveness Place emulator, rooted-device, and virtual-camera detection ahead of biometric processing so suspicious sessions are blocked before any expensive verification is triggered.
- Instrument onboarding for synthetic traffic patterns Track repeated device fingerprints, abnormal session concurrency, repeated retry patterns, and mismatch between registration velocity and downstream retention.
- Separate fraud cost from conversion reporting Report biometric spend, manual review hours, and incentive leakage alongside conversion metrics so business leaders can see the hidden tax on growth.
What's in the full article
Oz Forensics' full article covers the operational detail this post intentionally leaves for the source:
- Exact injection attack detection checks for virtual camera drivers, emulator environments, rooted devices, and video metadata anomalies
- How the certified liveness and injection detection layers are positioned together across the onboarding workflow
- Deployment considerations for on-premise biometric processing in sovereignty or low-latency environments
- The article's practical framing of how device-based fraud changes acquisition cost, review load, and incentive leakage
👉 Read Oz Forensics' analysis of device-farm fraud and emulator attacks at scale →
Device farms and emulator attacks: are your onboarding controls ready?
Explore further
11/07/2026 2:08 pm
Synthetic identity fraud is now a device governance problem, not only a biometric one. The article shows that face matching alone does not address the real attack surface when the capture environment itself can be virtualised or automated. In identity programmes, the trust boundary has moved earlier in the workflow, before liveness and well before account approval. Practitioners should treat device integrity as a first-class identity control.
A question worth separating out:
Q: Who is accountable when synthetic identity fraud inflates onboarding growth?
A: Accountability should sit across identity verification, fraud operations, and product growth leadership because the harm is both security-related and financial. If synthetic users consume biometric spend, manual review time, or incentives, the issue is not only fraud prevention. It is also governance of the onboarding workflow and the metrics used to judge success.
👉 Read our full editorial: Device farms and emulator fraud expose gaps in digital onboarding
