DeviceTrust: Open-Source Android Library Turns Device Signals Into Fraud Risk Scores

A developer has released DeviceTrust, an open-source Android library built with Kotlin and C++ that collects low-level device integrity signals to assess fraud risk. Rather than relying on a simple rooted-or-not boolean check, the library assigns weighted scores to multiple signals such as detected hooking frameworks, unlocked bootloaders, and suspicious mounts. These scores are combined into a risk level that guides how an app should respond — from allowing normal access to flagging a session for server-side review. The approach addresses a key weakness in traditional root detection, where a single check can be easily bypassed using tools like Frida. DeviceTrust is available via a public dependency and is intended to complement broader fraud-prevention strategies rather than act as a standalone security gate.