Appdome, the leader in protecting mobile businesses, today announced IDAnchor™, the industry’s first Customer Identity Protection (CIP) solution for the mobile economy. IDAnchor fingerprints each release, installation, and device used to access, log in, and generate transactions in a mobile app. It combines this immutable chain of trust with real-time threat signals to bring sign-in alerts and unrecognized device notifications to every mobile app in the world and create a perimeter defense around Identity Verification (IDV), Customer Identity & Access Management (CIAM), and other services in mobile apps.

“Mobile brands have learned the hard way that successful authentication doesn’t mean there’s a trusted identity, engagement, or transaction in an app,” said Tom Tovar, Co-Creator of Appdome. “They also want the ability to tell when there’s unauthorized activity on an unrecognized device, application, or installation. IDAnchor solves all these challenges easily.”

What is Customer Identity Protection?

Customer Identity Protection (CIP) is the missing link needed to strengthen biometric authentication, CIAM, and IDV in mobile apps. By adding a perimeter defense around identity assertions in a mobile app, CIP ensures that no part of the value chain – the mobile app, installation, or device – has been compromised or impersonated during login, authentication, engagement, or purchasing in mobile apps.

Mobile apps and identity products often assume the integrity of the mobile environment when creating, verifying, or using customer identities in mobile apps. However, fake or compromised devices, operating systems, and accounts, as well as malware-controlled sessions, can undermine signal fidelity from the mobile environment, giving fraudsters the upper hand. CIP monitors the source of each customer identity while it’s being used by the application, installation, device, or user. Customer Identity Protection detects if any part of that value chain has been compromised or impersonated, or if there are any signs of on-device threat staging, manipulation, spyware, and other risks that can compromise biometric authentication, CIAM, IDV, Ad Attribution, and other processes in a mobile app.

IDAnchor™ is CIP for Mobile Apps

Unlike static and ephemeral device binding, IDAnchor™ creates a living, cryptographically bound, tamper-resistant chain of trust that spans the entire mobile app lifecycle. IDAnchor fingerprints the mobile DevOps workspace and each app release, installation, device, and session to enable mobile brands to bind customer identity from the point of origin, through the distribution chain, to user acquisition and use in a mobile app.

Each IDAnchor fingerprint is securely stored and built to persist across device resets, app re-installs, OS updates, and sophisticated evasion techniques, including device cloning, app spoofing, Trojan installations, and threats that target customer identity in mobile apps. If, at any time, the chain of trust is broken, brands know customer identity is at risk.

Mobile brands can now offer their users the same powerful, real-time “Is this you?” sign-in alerts made famous across Apple and Google applications. Detect sign-ins or identity assertions from unrecognized devices, apps, or installs and trigger real-time responses like user-facing alerts, step-up authentication, or session blocks. From mobile banking to social, healthcare, and ride-sharing apps, Appdome makes it possible for every mobile brand to own the ATO moment and protect users with confidence.

“IDAnchor gives brands a dynamic way to know if the source of the identity assertion can be trusted and if the user’s device, instance and environment are real, the same, unaltered, and uncompromised before, during, and after calling any identity-based service,” said Avi Yehuda, Co-Creator and CTO of Appdome.

Built-In Threat Signals for Identity Assurance

IDAnchor combines real-time threat signals with the chain of trust to solve a wide range of mobile threats, including:

·       Deepfake attacks used on alternative or compromised devices.

·       KYC fraud and fake account creation on synthetic, cloned, or altered mobile devices.

·       Install/re-install abuse for inflating ad campaign metrics.

·       Emulator farms that mimic real user engagement and devices.

·       Loyalty and referral abuse from GAID/IDFA and device resets.

·       Social engineering scams where users are tricked into installing Trojan versions of legitimate apps.

·       Geo-fraud carried out through location spoofing, fake GPS apps, VPNs, IP cycling, and other techniques.

·       Transaction and On-Device Fraud carried out by attackers using fake devices, synthetic identities, and stolen credentials.

“Without CIP, anyone or anything could successfully authenticate or engage inside an app,” said Chris Roeckl, Chief Product Officer at Appdome. “With IDAnchor™, brands can detect the full range of fraud, ATOs, and scams and get the true device attributes being used in each session.”

IDAnchor™ Feature Overview