Android and iOS

Replay attacks against mobile transactions

Code tampering, account abuse, data exposure and client manipulation.

Threats and abuse1 min readEditorial methods

A previously valid request can be submitted again for another operation. Protection must define where and how often evidence can be used, alongside its integrity.

Evaluation approach

Design freshness, single use and transaction binding together. The server needs state management to prevent the same business operation from occurring twice.

Application example

Define transaction identifiers and idempotency behavior to distinguish network-driven payment retries from malicious replay.

Limits and considerations

Trusting only the device clock does not provide sound freshness verification.

Malicious replay and legitimate retries

A user may resubmit a request after a connection drops. Handling that safely differs from preventing old evidence from being reused in another context. Design operation identifiers and repeat-acceptance rules together.

For payments and similar consequential operations, the server should return a consistent result for the same identifier. Old evidence must not authorize a new amount or recipient. Test these conditions under concurrent requests as well.

Checks and decisions

  • Use server time
  • Assign transaction identifiers
  • Test replay scenarios

Reject abusive replay while ensuring legitimate retries cannot create duplicate transactions.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.