Android Device Integrity & Anti-Fraud

Prove a request comes from a genuine, unmodified build of your app, installed by Google Play, running on a real non-tampered Android device — not an emulator, a repackaged clone, a bot farm, or an instrumented (Frida/Xposed) copy. The hardware-backed root of trust is the Play Integrity API; everything else on this page is defense-in-depth around it.

• SafetyNet Attestation is dead. SafetyNetApi.attest was deprecated and the service is fully shut down. Do not call it or copy old SafetyNet code — Play Integrity is the replacement.

• Not authentication. Integrity answers "is this a legitimate app instance on a genuine device?", not "who is the user?". Combine with real sign-in (authentication) and a backend risk engine.

• The verdict is made on your server, never on the client. A rooted device can patch any local check to return "clean". Trust only a token your backend decrypted and verified.

• iOS counterpart: device-integrity (App Attest / DeviceCheck).

• Android primitives: Keystore, EncryptedFile, network-security config, TLS pinning → mobile-security.

• KMP boundary: expose a commonMain interface DeviceIntegrity returning an opaque token string; bind an androidMain actual that calls Play Integrity. Keep raw tokens out of shared code — pass the base64 through to your backend. See expect-actual.