# What is an emulator?

Source: https://kavralab.com/glossary/emulator/

An **emulator** is software that imitates the hardware and operating system of another device, most often an Android phone running on a desktop computer. Developers use emulators to test apps. Fraudsters use them to run many fake phones from one machine, each posing as a new customer, with its identifiers and location reset at will.

## How an emulator works

A phone app expects to run on a phone: an ARM processor, a touchscreen, a camera, motion sensors, a SIM card and a battery. An emulator provides software stand-ins for all of these on a regular computer. The app starts, sees what looks like a phone, and runs normally. Android Studio's official emulator is the best known, and consumer products built for playing mobile games on a PC work the same way.

Each emulated phone is just a file on disk. It can be copied, reset to a clean state or started in dozens of copies side by side. Many emulators let the user set the phone model, device identifiers, GPS location and network settings by hand, which is exactly what fraud tooling needs.

## How emulators are used in fraud

Mobile apps often get more trust than websites. Many businesses assume a phone means a real person, and some offers exist only in the app. Emulators exploit that trust at scale. One operator can register hundreds of "phones", each with its own device identifiers, and use them for [fake account creation](https://kavralab.com/solutions/fake-accounts/), [bonus abuse](https://kavralab.com/solutions/bonus-abuse/), referral farming, fake app installs, rideshare and delivery fraud, and location spoofing in apps that check where a user is.

- **Reset between accounts**: wipe the emulator image so the next signup looks like a new phone.
- **Fake location**: set GPS to a city where the offer or license applies.
- **Automation**: drive the app with scripts instead of a human finger.
- **Pair with proxies**: route each instance through its own [mobile proxy](https://kavralab.com/glossary/mobile-proxy/) so the network matches a phone.

Emulators are the cheap end of mobile fraud. When an app starts catching them, operators move to rooted real phones or to [device farms](https://kavralab.com/glossary/device-farm/), which cost more per account but pass hardware checks. Watching which tier of tooling an attack uses tells you how much the operator expects to earn from it.

## Emulator vs virtual machine

**Emulator**

- Imitates a different kind of device, often a phone
- Can translate one processor type into another
- Fakes sensors, SIM, camera and battery
- Main fraud use: mobile app abuse

**Virtual machine**

- Runs another computer of the same kind
- Uses the host's processor directly, so it is fast
- Fakes disks, network cards and screen
- Main fraud use: disposable desktops and browsers

## Signs a device is an emulator

Emulators imitate the parts of a phone that apps commonly check. The parts nobody checks often give them away.

| Area | Real phone | Emulator |
|---|---|---|
| Sensors | Noisy, constantly changing motion data | Missing, flat or perfectly repeated readings |
| Hardware | Matches the claimed model | Generic or desktop graphics and processor traits |
| Battery | Drains and charges over time | Always full or always charging |
| Build details | Retail device build | Traces of emulator files, services or test builds |
| Touch input | Uneven pressure and timing | Clicks or scripted taps with perfect timing |
| Platform checks | Passes operating system attestation | Often fails or skips attestation |

## How to detect emulators

Checking one or two known emulator traits is not enough, because fraud-focused emulators patch the obvious ones. Detection works when the claimed device is tested against its hardware, sensors, graphics, operating system checks and network, and inconsistencies are weighed together. Kavra's native iOS and Android SDKs and its web script do this on every session, and link emulator instances that belong to the same actor. See [emulator detection](https://kavralab.com/detect/emulators/).

## FAQ

### Are Android emulators legal?

Yes. Emulators are standard tools for app development and testing, and many people use them to play mobile games on a computer. Using an emulator is not fraud. It becomes a problem when it is used to break an app's rules, for example by creating many accounts, faking location or pretending to be different phones to claim repeat rewards.

### Can an app tell if it is running on an emulator?

Usually, yes. Apps can check for emulator files and settings, hardware and graphics that do not match the claimed phone, missing or artificial sensor data, and operating system attestation results. Emulators designed for fraud hide the obvious clues, so reliable detection combines many checks and looks for contradictions rather than a single tell.

### Why do some games and banking apps refuse to run on emulators?

Because emulators make cheating and fraud much easier. In games they enable bots and unfair advantages. In banking and payments they are used to impersonate devices, bypass location rules and automate fraud. Some apps block them outright, while others allow them but add verification to sensitive actions.

---
Kavra Lab: bot and fraud detection that explains every decision. Book a demo: https://kavralab.com/contact/