Glossary
What is a device emulator?
A device emulator is software that mimics a real mobile device. It is a standard development tool, and also a means of simulating installs and in-app events fraudulently at scale.
The legitimate use
Emulators are core development infrastructure. No team can own every device configuration their app must support, so automated test suites run against emulated devices across OS versions, screen sizes and locales.
Any detection system therefore has to distinguish a developer's test device from a fraud operation, which is a real classification problem rather than a matter of blocking emulators outright.
The fraudulent use
For a fraudster, emulators solve a cost problem. A device farm requires buying, powering and maintaining physical handsets; an emulator farm is software on commodity servers.
Each emulated instance installs the app, generates the tracked events, resets, and repeats with a fresh device identity. Volume is limited by compute rather than by hardware, which is a substantially better cost structure for generating fake installs.
How emulators are detected
- Hardware inconsistencies. Sensor data that is absent, constant, or physically impossible.
- Known emulator characteristics in system properties and build identifiers.
- Network origin. Emulator farms run in data centres, which their IP addresses reveal.
- Performance profiles that do not match the device being claimed.
- Behavioural signatures — no touch variance, no orientation change, no interruptions.
Why it stays a race
Every detection signal can be spoofed by an operator willing to invest: sensor values can be synthesised, build properties edited, residential proxies rented, touch patterns randomised.
So emulator detection catches unsophisticated fraud reliably and sophisticated fraud inconsistently. The defence that does not depend on winning the technical race is the economic one — pay for outcomes deep enough that emulating them costs more than the payout — and, behind it, a holdout that measures whether the source produces any lift at all.
Common questions
Should I block all emulator traffic?
From paid campaigns, generally yes. Blocking it entirely will also block your own QA and test automation, so most teams exclude emulators from attribution rather than from the app.
Can emulators fake sensor data?
Sophisticated ones can, and increasingly do. It is one of several signals rather than a definitive test, which is why detection combines many weak signals rather than relying on one.
More in fraud and validation
How invalid traffic is manufactured, and how it is caught.