Application security protection

Game and revenue protection

Otukan detects cheats, mods and forged purchases in Android and iOS games, and gives your game server the evidence to protect play and in-app revenue.

  • Android
  • iOS
  • Unity
Memory edits and mods is met at the client and game server boundary before it reaches the appMemory edits and modsClient and game serverYour app
  • Cheats caught in the client

    Otukan detects memory editors, speed tools, modded builds and injected code while a match runs, which is where cheats actually operate.

  • Economy decided on the server

    Purchases, rewards and results are confirmed by your backend, with Otukan's integrity evidence attached to each claim the client makes.

  • Fair to honest players

    Graded responses, observe mode and a clear appeal route keep false positives from turning into lost players and bad reviews.

Cheats and revenue abuse Otukan handles

Pick an abuse pattern to see how Otukan detects it, how the game responds and what your server receives.

Currency and stat edits

  1. Detect

    Otukan detects memory scanners and editors attached to the game process, and protects sensitive values held in memory.

  2. Respond

    The match is flagged, the session is restricted or the game closes, per your policy.

  3. Report

    Your game server receives the detection with player session, build and platform.

Speed manipulation

  1. Detect

    Otukan detects tampering with the game clock and tools that speed up or slow down the client.

  2. Respond

    The session is marked, and results from it can be held for server review.

  3. Report

    Speed manipulation is reported as its own signal, separate from other cheats.

Modded clients

  1. Detect

    Integrity checks recognise repackaged builds, altered code and injected mod menus at launch and during play.

  2. Respond

    The modded client is kept out of ranked play or stopped, according to your rules.

  3. Report

    Your team sees which check failed and on which build, so you can trace a mod's spread.

Forged purchases

  1. Detect

    Purchase claims from a hooked or modified client carry failed integrity evidence to your server.

  2. Respond

    Your backend grants items only after it verifies the store transaction and the client evidence together.

  3. Report

    Refused grants are logged with the reason, ready for revenue reconciliation.

Reward and ad farming

  1. Detect

    Emulators, automation and scripted sessions stand out from people playing on real devices.

  2. Respond

    Rewards and ad credits from flagged sessions are withheld or reduced, per your policy.

  3. Report

    Farming patterns are recorded per install and per session for your fraud review.

Controls for games and in-app revenue

Each control targets a different way cheaters and fraudsters take value out of your game.

  • Memory editing detection

    Detects tools that search for and rewrite values such as currency, health or cooldowns in the running game.

  • Anti-modding

    Recognises repackaged and patched game builds, including mod menus injected into the client.

  • Mobile game anti-cheat

    Combines speed manipulation, hooking, emulator and integrity signals into one cheat verdict per session.

  • Purchase and reward abuse

    Attaches integrity evidence to purchase and reward claims, so your server can refuse forged or replayed ones.

  • Click and ad fraud

    Separates genuine ad views and installs from emulator farms, automation and modified clients.

  • Emulator and farm detection

    Flags sessions from emulators and automated devices used for farming, multi-accounting and rank boosting.

You choose the response

Set a response for each user flow. Start by observing, then tighten flow by flow as the signals prove themselves.

Observe

Signal sent to your backend

Rolling out a new policy and measuring real-world signals.

Warn

This device looks modified. Continue with care.

Conditions some genuine users create, such as developer settings.

Restrict

Payments are unavailable on this device.

Payments, stored data and account changes.

Terminate

Session closed for your security.

Clear tampering on a high-risk flow.

How it works

  1. Map the economy

    List the values, rewards, purchases and results a cheater would target in your game.

  2. Protect the game build

    Otukan slots into your release process for each platform, and your signing credentials never leave your control.

  3. Detect during play

    Checks run at launch, at match start, during play and at the moment of each reward claim.

  4. Decide on the server

    Your backend weighs cheat evidence with game logic before granting items, rank or currency.

  5. Tune with players

    Start in observe mode, compare detections with player reports, then enforce.

Free for app publishers

Check your app's exposure

A passive review of your published app by an Otukan engineer. No files, no access to your systems. Findings go by email to the verified publisher.

You finish the request on the next page.

Otukan protects your game’s economy from the device it runs on. It detects memory editing, speed manipulation, modded builds and emulator farms while the game runs, and attaches that evidence to every purchase, reward and result your server receives, so your backend keeps authority over the economy. Evaluate it by separating what a cheater can change on the device from what your server still decides. Otukan protects Android and iOS games, including Unity titles, with each signal scoped per platform. It makes cheating slower, costlier and visible, and it is tuned so honest players keep playing without friction.

Client exposure

A mobile game runs on hardware the player owns. Anything held on that device can be read, changed or replayed by a determined player, and the tools to do it are shared freely in cheat communities. Four targets carry most of the loss.

TargetHow it is manipulatedWhat Otukan detects
Game stateCurrency, health, ammunition or cooldowns rewritten in memoryMemory scanners and editors attached to the game process
ExecutionThe game clock sped up, functions hooked, mod menus injectedClock tampering, hooking, injected code and altered builds
RewardsDaily rewards, ad rewards and events farmed at scaleEmulators, automation and scripted sessions
PurchasesFake receipts, replayed transactions, patched store callbacksHooked or modified clients making purchase claims

Each row hurts differently. State edits and execution tricks damage fairness, and in competitive games unfair matches push honest players away. Reward farming inflates your economy and drains your ad revenue. Purchase forgery takes money directly.

The two platforms are exposed in different ways, and Otukan treats them separately. On Android, modified game packages spread easily outside Google Play, and emulators make farming cheap to scale. On iOS, cheats more often arrive through jailbroken devices and tweak injection, while sideloaded copies need extra steps. Each detection on this page is scoped to the platform where it applies, and your evaluation should test both if you ship both. For cheat detection in depth, see mobile game anti-cheat.

Server authority

Some decisions must never rest on the client, however well it is protected. Your game server should own them.

  • Outcomes. Match results, rank changes and leaderboard entries are accepted only after server-side plausibility checks.
  • Purchases. Items are granted only after your server verifies the transaction with the store’s server-side APIs.
  • Inventories and ledgers. Currency balances and owned items live on the server, and the client displays them.
  • Rates. Progression speed, reward frequency and ad credits are capped by server rules.

Otukan strengthens each of these with a signal the server cannot produce on its own. A reward claim arrives with evidence on whether the client was modified, whether a memory editor is attached and whether the session runs on an emulator. A result from a flagged session can be held, reviewed or discounted instead of accepted at face value. The same pattern protects the requests themselves; see mobile API protection.

That split gives each side a clear job. Otukan raises the cost of cheating on the device and reports what it sees. Your server enforces the rules of the economy.

Player experience

Performance

Players notice a stutter long before they notice a cheater. Protection has to fit your frame budget, so Otukan lets you place checks at natural pauses: launch, match start, reward claim and purchase. Continuous checks are kept for the signals that justify them. Measure a protected build on the lowest devices you support before rollout.

False positives

Honest players run emulators to stream, use accessibility tools, play on older devices and sometimes install software that looks suspicious. Start in observe mode and compare detections with player reports and support tickets before any signal leads to a penalty. Graded responses help: record, then separate matchmaking, then hold rewards, with bans kept for strong and repeated evidence.

Appeal and recovery

Every enforcement path needs a way back. Give flagged players a clear message, a route to support and a review that looks at the evidence your server recorded. Otukan’s detections carry the check, build and platform behind each decision, so your support team can explain it or reverse it with confidence. Sector context is covered on mobile game security, and engine specifics are on Unity app security.

Common questions

  • Will anti-cheat checks affect frame rate?

    Otukan is built to stay out of your frame budget. You decide which checks run continuously and which run at natural pauses such as launch, match start, purchase and reward claim, so heavier work stays away from the frames that matter. Before rollout, compare a protected build with your baseline on the low-end devices your players actually use.

  • What should happen to a player the system flags?

    Match the response to the confidence and the stakes. A single weak signal can simply be recorded. Repeated detections might move a player into a separate matchmaking pool or hold their rewards for review. Bans are best reserved for strong, repeated evidence and paired with an appeal route, so an honest player on an unusual device can get back in.

  • Can the client validate its own purchases?

    No, and it should not try. Purchase tokens from Google Play and transactions from the App Store should be verified on your server with each store's server-side APIs before any item is granted. Otukan adds what the store cannot tell you: whether the client making the claim shows signs of modification, hooking or an emulator.

  • Do you protect Unity games?

    Yes. Otukan protects Unity games on Android and iOS, alongside games built natively for each platform. Unity titles often expose game logic and values in predictable places, which makes memory editing and modding especially attractive, so those detections are central to a Unity deployment. Tell us your Unity setup and target platforms when you get in touch.

On the mobile engineering team?

How protection fits your build, signing and release, platform by platform.

Keep play fair and revenue yours

Tell us the platform, the engine and where value leaks from your game today, such as currency edits, modded builds or forged purchases. We do not ask for game source, builds, signing keys or player data.

Or request a technical demo