Evaluate a mobile anti-cheat solution by what it protects on the device, what it leaves to your servers and what it costs honest players. Map the client exposure first, meaning game state, rewards, purchases and code execution, then decide which rules only your backend can enforce, and finally test frame rate, false positives and how a flagged player appeals. This guide is for studios shipping on Android and iOS, including Unity games, with each platform scoped separately. Otukan protects the game client against tampering, memory editing and speed manipulation, and feeds your game servers the signals they need to act.
The control itself is covered on mobile game anti-cheat.
Client exposure
Cheaters go where value lives. Chart what a modified client could change, then match each target to a control.
Client and server threat map
| Target | Typical cheat | Client-side answer | Server-side answer |
|---|---|---|---|
| Game state | Memory editors changing health, currency or cooldowns | Memory protection and tamper detection | Server-side plausibility checks |
| Rewards | Replayed or forged reward claims | Integrity checks on the client | Rewards granted only by the server |
| Purchases | Patched purchase checks, tampered receipts | Detection of modified code | Store receipt verification on your backend |
| Execution | Speed hacks, hooking, repackaged builds, bots on emulators | Runtime detection of each technique | Rate and behaviour analysis |
Questions about your game
- Which values are worth money to a cheater: soft currency, rank, loot outcomes, timers?
- Which engine and build output do you ship, for example Unity with IL2CPP or Mono, or a native engine, and does each option cover that output?
- Do modified copies of your game circulate outside the official stores?
- Which cheats need a rooted or jailbroken device, and which run on a stock phone?
How Otukan answers. Otukan detects memory editors, hooks on your game’s timing and clock functions, hooking frameworks, emulators and modified or re-signed copies of your game while it runs, on Android and on iOS. It also catches hooks placed on purchase and reward code paths, and on Android it detects accessibility services that drive input without a player. Protection covers Unity games as well as natively built ones.
Server authority
A client can be hardened; it can never be trusted with the final word. Anything that creates value belongs on your servers.
What only the backend enforces
- Are match results, reward grants and leaderboard scores calculated or checked on the server?
- Are in-app purchases verified with the store on your backend before items are granted?
- Does the server check that progress speed is plausible for a human player?
- Which client signals should the server weigh before a suspension, and which are merely context?
| Decision | Where it belongs | Role of client signals |
|---|---|---|
| Granting a purchased item | Backend, after store verification | Flag a patched client for review |
| Awarding event rewards | Backend | Withhold rewards from a tampered session |
| Ranked matchmaking | Backend | Move flagged players to separate pools |
| Account suspension | Backend, with human review | Evidence attached to the case |
How Otukan answers. Otukan sends runtime threat signals to your game backend with the session and with purchase receipts, so your servers combine what the client saw with their own view of the match. Bans and rewards stay server decisions; Otukan makes a tampered client harder to build and easier to spot.
Player experience
Anti-cheat that stutters, or bans the wrong people, damages the game it is meant to protect. Test the experience as rigorously as the detection.
Performance
- Measure frame rate, load time and battery use on the lower-end devices your players actually own.
- Profile the busiest scenes, not only the menu.
False positives
- Decide whether desktop emulators used to play mobile games are allowed, placed in separate matchmaking or refused.
- Test controller apps, screen recorders and streaming tools that honest players use.
Appeal and recovery
- Who reviews an appeal, what evidence is kept and how is an account restored?
- Do responses escalate in stages: observe, then separate matchmaking, then suspension?
| Stage | Example response |
|---|---|
| First signal | Observe and log for the anti-cheat team |
| Repeated signal | Move the player to separate matchmaking |
| Confirmed cheating | Suspend with a clear notice and an appeal route |
How Otukan answers. You choose how the game responds in each mode: ranked play can be restricted while casual play stays open. Start in observe mode, where checks report without affecting players, and tighten once your team trusts the signal. We expect you to measure performance in your own game on your own devices, and we support that test from the first build.
Measuring overhead is covered on performance and compatibility. Sector context is covered on mobile game security. Other decision guides are collected on Otukan solution guides.