Securing Google Play Billing

Anything running on the user device can be tampered with. If your trust model lives in the client, you have already lost. This skill shows you how to move trust to your backend and defend against the attack patterns you will actually see in production.

Phase 1: Assess

Before you write a line of defensive code, answer these questions about your current integration:

• Where does purchase verification happen today? Client, backend, or both?
• Does your database enforce a unique constraint on purchaseToken?
• Do you set obfuscatedAccountId and obfuscatedProfileId on every purchase flow?
• Do you poll the Voided Purchases API on a schedule?
• Do any access decisions rely on System.currentTimeMillis() from the device?

Any "no" answer maps to a layer you are missing below.

Phase 2: Plan the Layered Defense

Fraud prevention is not a single check. It is a stack of controls where each layer catches a different attack class. Plan all of them, even if you ship them incrementally.