You identify automated abuse through mobile clients by combining evidence, not by trusting one clue. Otukan gathers signals from inside your protected app, including whether it is your genuine release, whether it runs on real hardware and whether automation tools are driving it, and sends them with each sensitive request. Your backend adds account behaviour and turns the result into a classification: scripted client, emulator, device farm, bot on a genuine phone or person. Each class gets the response its action deserves. Otukan covers Android and iOS apps, including Flutter and React Native, and makes automation costlier to run and visible to your team.
For the broader app-to-backend trust model, see mobile API protection.
Automation types
Bot operators choose the cheapest tool that works. Knowing which tool they use tells you which signal will catch it.
| Automation type | How it works | Operator’s cost | Signals that expose it |
|---|---|---|---|
| Scripted APIs | A program calls your API directly, imitating the app | Lowest | Missing or failed genuine app evidence |
| Emulators | Your real app runs on virtual devices at scale | Low | Environment checks for virtual hardware |
| Device farms | Racks of cheap physical phones run the app with automation | Medium | Automation services, matching setups, many accounts per install |
| Genuine-device bots | Tools drive the app on an ordinary phone, sometimes the victim’s own | High | Instrumentation, automated input, accessibility misuse |
Operators move up the table when the cheaper rows are closed. That movement is a win: each step costs them more per account, per purchase and per reward.
Platform differences
Automation looks different on each platform. Android emulators are widely available and device farms often run modified Android builds, so environment and integrity signals carry much of the weight there. On iOS, simulators do not run App Store builds, so operators lean on real devices and jailbroken handsets; runtime tooling and install patterns matter more. Otukan builds and tunes its checks for each platform separately and labels which platform produced each signal.
Industry patterns are covered on mobile game security and ecommerce mobile app security.
Signal combination
Any single device property can be faked, borrowed or explained away. A model name can be spoofed, a real phone can host automation, and a developer’s handset can look odd for honest reasons. Otukan treats each signal as one vote.
Why one property is not enough
- Emulator checks alone miss device farms and genuine-device bots, and flag QA teams.
- Integrity checks alone confirm the app is yours, but an unmodified app can still be automated.
- Network context alone penalises customers on shared or mobile networks.
- Behaviour alone arrives late, after the bot has already acted.
How Otukan combines them
Signals from the app, covering integrity, environment and runtime tooling, travel with the request. Your backend adds what only it knows: account age, velocity and history. The classification that results is stronger than any input, because an operator must now fake several independent things at once, on each session, without leaving a pattern across installs. Otukan also reports which signals contributed, so your fraud analysts can see why a session was classified the way it was and challenge the rule when a legitimate group is caught.
Business response
A classification is only useful when it changes what happens next. Otukan’s rollout links each class to your authentication and transaction rules.
- At sign-up, emulator and farm classifications can require a stronger check or limit what a new account can do.
- At sign-in, scripted callers are refused and uncertain sessions are stepped up rather than blocked.
- At checkout or redemption, genuine-device bots can be paused at the high-value step while browsing continues.
- In games, altered or automated clients can be kept out of rankings and reward pools.
Before enforcement, Otukan works with your team to reproduce each automation type in an authorised lab, repeat the same journeys on legitimate devices and approved test rigs, and run install, update, sign-in and your most targeted flow on the protected release, recording versions, devices, expected results and the reviewer.
The evaluation questions buyers ask are covered on the mobile bot detection solution guide. For fare and seat bots in travel apps, see travel and mobility application security.