Get that answer reliably, and a surprising amount of downstream work gets simpler. App Protector's new Get Device Identifier method exists to answer exactly that question. This article talks about a persistent, unique device identifier that survives app reinstalls, on both iOS and Android.
Most teams already have some form of device signal, they just don't have one that holds up. A few reasons why:
The result: most apps have a device identity that lasts exactly as long as the user wants it to. For fraud detection, licensing, and abuse prevention, that's close to useless.
Mobile fraud increasingly relies on device churn. This includes uninstalling, resetting, or spoofing identifiers to look like a fresh, low-risk device on every attempt. A persistent identifier breaks that pattern: a device that's already been flagged, or that's associated with prior fraudulent sessions, stays recognizable even after a reinstall, a factory-reset-adjacent cleanup, or an attempt to appear new.
For enterprise and B2B mobile apps, license enforcement usually assumes one install equals one seat. Without a persistent identifier, that assumption breaks the moment a user reinstalls, and it becomes trivially easy to share a single license across devices by uninstalling and reinstalling with different accounts. A stable device ID lets licensing logic tell the difference between "the same licensed device, reinstalled" and "a new device trying to claim the same seat."
Promotions, referral bonuses, and trial periods are usually scoped per device, which only works if a device can't simply erase its history by uninstalling. Reinstall abuse, claiming the same welcome bonus or trial repeatedly from one physical device, is a direct, measurable revenue leak for consumer and fintech apps alike, and it's specifically what a reinstall-resistant identifier is built to close off.
For regulated industries, this isn't only a fraud-ops nice-to-have. DORA already treats ICT risk controls, including fraud detection capability, as part of a financial entity's operational resilience posture, subject to supervisory scrutiny. And the incoming PSD3/PSR package is going to shift more fraud liability onto payment service providers directly, which raises the value of any signal that improves fraud detection accuracy before a transaction completes, not after. A persistent device identifier is exactly that kind of signal: it doesn't replace behavioral fraud detection, but it removes one of the easiest ways to defeat it.
Get full access to advanced mobile security for 30 days, featuring both App Hardening to make your app tamper-proof and App Shielding to actively detect and block attacks in real time. Explore a user-friendly portal and see how your app stays protected at every stage. No upfront payment needed.
