Emulator

Fraudsters rarely use their own phone to open fake accounts or drain stolen ones. They run emulators instead, so one laptop can pose as hundreds of different devices and slip past checks built around device identifiers (IDs).

What Is an Emulator?

An emulator is software that makes one machine behave like another, copying its hardware down to its quirks. A Windows PC running one can appear to a bank’s servers as an Android phone, complete with a model name, operating system (OS) and device ID.

Emulators have legitimate uses. Developers test mobile apps on them, and gamers use them to run console or arcade titles. The same features that make them useful for testing also make them valuable to fraudsters, because a fake device can be reset, cloned or switched in seconds.

How Emulator Detection Works

Emulator detection checks whether a device is real hardware or software pretending to be hardware. Software can copy what a device reports about itself, but it struggles to copy everything at once, so detection looks for inconsistencies across many signals:

Hardware that doesn’t match the claimed device: the reported model says one thing, while the graphics processing unit (GPU), central processing unit (CPU) or screen resolution says another.
An OS that doesn’t fit the hardware: a “fake OS” flag fires when the reported OS doesn’t match what the device’s other data points show.
Missing or flat sensor data: real phones have accelerometers, gyroscopes and battery readings that change constantly. Emulated devices often return default or frozen values.
Identical settings across “different” devices: a group of devices with the same battery level, screen brightness or settings points to a device farm. In one case, fraud analysts exposed a ring because every spoofed device showed 0% battery and 0% brightness.
Virtualization traces: files, drivers and system properties left behind by emulation software.

No single signal proves fraud on its own, so the right response depends on context. Developers and testers use emulators legitimately, but in sectors such as iGaming, real players almost never register from one, so many operators block these flags outright instead of sending them to review.

Android Emulator Detection Techniques

Most fraud emulators imitate Android phones, and the fastest-growing type runs in the cloud. Tools such as VMOS and GeeLark host virtual Android devices on remote servers, so a fraudster can buy an already logged-in account and open the phone in a browser. Because the device ID never changes, basic fingerprinting sees a returning customer. Common detection techniques include:

checking build properties and device fingerprints for known emulator values
testing sensor behavior, such as whether the accelerometer responds
comparing GPU and CPU details with the claimed device model
identifying specific cloud phone environments and rooted devices

Account sellers who spoke to SEON’s threat intelligence team said they rely on cloud phones like VMOS, and switch to other providers as soon as one gets detected.

“VMOS is such a good cloud emulation environment for Android that it can exceed Google Play Protect. It presents as a real device, so much so that you can essentially achieve a logged-in context.”
Husnain Bajwa, VP of Product, Risk Solutions, SEON

How Fraudsters Use Emulators

Emulators are a tool rather than a type of fraud, so they appear across many schemes:

Multi-accounting and bonus abuse: one person creates dozens of accounts, each appearing to come from a new device.
Account takeover: fraudsters spoof the victim’s device and location to pass device checks on a stolen account.
Selling verified accounts: accounts opened with real identities are moved onto emulated devices, then resold with new contact details.
Evading bans: a blocked user resets the emulator and returns as a “new” device.
App install and ad fraud: emulator farms generate fake installs, clicks and reviews at scale.

In 2020, IBM researchers found a fraud operation that used 20 emulators to impersonate more than 16,000 mobile devices and steal millions from mobile banking accounts.

Are Emulators and Virtual Machines the Same?

Both run one system inside another, but they solve different problems. A virtual machine (VM) creates an isolated computer within a computer, mainly to run software built for another OS. An emulator goes further by imitating the hardware of a specific device, which is why fraudsters prefer it when they need to look like a particular phone.

Emulator Farms

An emulator farm runs many virtual devices together, often automated with bots, to create accounts, place orders or log in at a scale no single fraudster could manage by hand. Because each instance can switch identities in seconds, device ID checks alone rarely stop them. Shared settings, network patterns and timing across the farm usually give them away.

“When five ‘different’ users arrive from the same affiliate and share the same device fingerprint, it’s either a device farm or a single person cycling through identities.”

How Emulator Fraud Affects Businesses

Older fraud checks trusted the device ID. Emulators are built to beat exactly that, which leads to:

losses from account takeover and stolen funds
promotion and bonus budgets drained by multi-accounting
chargebacks and higher chargeback ratios
fake reviews and inflated install numbers
customers locked out or harmed when their accounts are taken over

How to Stop Emulator Fraud

Effective protection combines emulator detection with device fingerprinting that looks deeper than the device ID, such as GPU, CPU and network data. Velocity checks add a second layer by flagging one device that appears in two countries minutes apart, while behavioral signals add a third.

Rules and machine learning then weigh those signals together, so real customers on unusual devices get through while emulator farms don’t.