Understand Device Risk Before Sensitive Actions
A set of standardized risk signals describing device integrity and suspicious activity — designed to inform your existing risk decisions, not replace them.
Each item below is a risk signal, not proof of fraud. A single signal — such as a rooted device — does not by itself indicate malicious intent. Signals are designed to be combined and weighed alongside your own fraud and authentication systems.
Signal Catalog
Standardized Device Risk Signals
Root Detection
Whether an Android device has been rooted, which removes some of the operating system's standard protections.
Jailbreak Detection
Whether an iPhone has been jailbroken, which bypasses some of iOS's built-in restrictions.
Developer Mode
Whether developer options are switched on. Common among developers and testers as well as in some attack setups, so context matters.
USB Debugging
Whether USB debugging is enabled, which allows deeper access to the device from a connected computer.
Sideloaded Applications
Apps installed from outside the official app store, which have not been through the store's review.
Accessibility Risk
Apps holding accessibility permissions, which some malicious apps abuse to read the screen or act on the user's behalf.
Screen-Sharing Risk
Signs that the screen is being shared, cast or recorded — a tactic used in remote-access scams.
Call-Forwarding Risk
Whether calls are being forwarded to another number, which can be used to intercept verification calls.
Network Risk
Indicators that the device is connected to an unsafe or suspicious network.
Emulator Indicators
Signs that an app is running in an emulator rather than on a physical phone.
App Integrity
Whether an app appears to have been modified or tampered with, compared with the version its publisher released.
How signals are meant to be used
Device risk signals describe the state of a phone at the moment of a sensitive action — logging in, adding a payee, approving a payment. Your team decides what each signal means for your own risk policy: for example, asking for extra verification, limiting a high-value action, or simply recording the signal for later review.
Because many signals have innocent explanations, they are most useful in combination — and alongside what your own fraud and authentication systems already know about the customer and the transaction.
FAQ
Common Questions About Device Risk
Does a device risk signal prove that a transaction is fraudulent?
No. Each item is a risk signal, not proof of fraud. A single signal — such as a rooted device — does not by itself indicate malicious intent. Signals are designed to be combined and weighed alongside your own fraud and authentication systems.
Are device risk signals generally available?
No. They are part of the Trust Platform roadmap and not yet generally available. Which signals exist on which platform, and when, is confirmed directly with enterprise teams during evaluation.
Are all signals available on both Android and iOS?
Not necessarily. Some signals only make sense on one platform — root detection applies to Android and jailbreak detection to iOS, for example. Platform coverage is confirmed during evaluation.
Can device risk signals be used together with threat intelligence?
That is the intent. Device risk signals, threat intelligence and the SDK are designed to work together as one platform, and each is also designed to be adopted independently.
Explore the Trust Platform