Cloud phones fraud has become a primary concern, according to a new report from Group-IB released on April 21, 2026. The cybersecurity firm documented how remote-access Android devices, once used for basic social media tasks, have evolved into sophisticated instruments for creating untraceable accounts used in scams and money laundering operations.

These devices operate as physical mobile phone motherboards stored in data centers and rented for as little as $0.10 per hour. Because they use genuine hardware, real serial numbers, and legitimate Android software, cybersecurity systems struggle to detect them. To a bank’s fraud detection system, a criminal using a cloud phone in another country appears identical to a legitimate customer using a standard smartphone.

How Cloud Phones Bypass Bank Security

Banks have successfully blocked software emulators for years, but criminals have shifted tactics. Cloud phones preserve consistent device telemetry, meaning they do not trigger the device-change detection mechanisms that financial institutions rely on to flag account takeovers. Fraudsters now sell these cloud phones pre-loaded with fully verified banking and virtual wallet accounts on darknet markets for as little as $50, creating a turnkey solution for money laundering.

The report identifies three key discoveries about cloud phone operations. First, industrial-scale cloud phone farms housed in data centers facilitate mass creation of dropper accounts, which are false accounts created using stolen credentials specifically designed to receive and transfer stolen funds. These dropper accounts represent the critical final link in many Authorized Push Payment (APP) scams. Second, the invisibility factor means these accounts do not trigger standard device-change detection. Third, accessibility has democratized fraud, with platforms like Redfinger, GeeLark, and LDCloud making sophisticated infrastructure available with minimal investment.

Financial Impact and Industry Losses

APP fraud continues to lead industry losses globally. According to the UK Finance Annual Fraud Report 2023, APP fraud losses reached £485.2 million in 2023, with dropper account fraud identified as the single most contributing incident type. The problem continues to grow and spread across other regions, representing a dangerous shift in the money mule economy.

A buyer who purchases a pre-verified bank account gains access to an account already logged into a specific cloud phone. Because the account and phone are sold together, the bank never detects a new device login, making detection significantly more difficult for financial institutions.

New Detection Methods for Cloud Phones Fraud

Financial institutions must move beyond static device authenticity checks to multi-layered intelligence approaches. Group-IB recommends three detection strategies. Device-environment correlation involves identifying anomalies such as a device’s battery level remaining at 100% or showing no motion during use. Behavioral and app analysis flags devices with an unusually high number of financial apps, the presence of anonymization tools like VPNs, or a suspicious lack of standard pre-installed applications. Graph-based analytics moves beyond single-device evaluation to identify clusters of accounts linked by shared infrastructure patterns.

Group-IB’s Fraud Protection platform has begun deploying new detection rules to identify these remote environments, resulting in a drastic decrease in fraudulent logins for early adopters. The company urges financial institutions to adopt multi-layer intelligence platforms that combine device fingerprinting with network intelligence and behavioral modeling.

Protecting Against Cloud Phone Fraud

End-users can take several steps to protect themselves. Never complete account verification processes under third-party instruction, as banks and government institutions will not ask customers to authenticate accounts through unfamiliar apps or remote environments. Enable device-based security features by using official mobile banking apps, biometric authentication, and strong device-level security settings.

Users should remain cautious of easy income schemes involving bank accounts, such as fake job offers requiring account verification, government officials requesting account verification, or bank representatives asking to move money to safe accounts. If someone suspects they have been targeted, they should contact their bank immediately, update passwords, and enable multi-factor authentication on all accounts.