Device Identity
Device binding
for UPI and banking apps
Device binding links a customer's account to one specific phone, so a stolen password, OTP or session cannot be used from another device. Done well, it rests on a key held in the phone's secure hardware.
What is device binding?
In UPI and mobile banking, device binding means the app is registered to a particular handset and often a particular SIM. When the customer sets up the app, the bank records that pairing. Later requests must come from that bound device, which stops a fraudster who has only the customer's credentials.
Banking regulators and payment networks expect this kind of binding for payment apps. See the NPCI UPI mobile app security page for what the framework requires of your app.
Not all device binding is equal
| Approach | What it proves | Weakness |
|---|---|---|
| SIM or phone number match | The number is the same | A SIM swap moves the number to the attacker |
| Stored device ID or token | A token was previously issued | The token can be copied from a rooted or cloned phone |
| Hardware-backed key | The private key in secure hardware signed this request | Strongest: the key is not exportable; still needs a clean runtime to be trusted |
Hardware-bound identity, checked on every request
NonaShield generates the signing key inside the device's secure hardware at enrolment. Each request carries a signature over the token and the request body, verified independently at the edge and in the backend. The key never leaves the device. A cloned app or a stolen session has no key to sign with.
See hardware-backed possession proof and hardware-bound identity with location checks.
Where device binding falls short on its own
- It proves which device, not that the person is acting freely. A customer coached by a scammer still signs.
- It can be undermined on a compromised phone unless the app also checks the runtime. Pair it with mobile RASP.
- Re-binding after a lost phone needs a safe recovery flow, or the recovery path becomes the attack.
Frequently asked questions
What is device binding in UPI?
Registering the UPI app to a specific phone, usually with its SIM, so payments can be made only from that device.
Is SIM binding the same as device binding?
No. SIM binding ties the account to a phone number. A SIM swap can defeat it. Device binding with a hardware-backed key ties the account to the phone itself.
Can device binding stop account takeover?
It stops takeover from a different device. It does not stop a customer being coached into approving a payment, so it should be paired with behavioural and risk checks.
How does NonaShield implement device binding?
With a key generated in the device's secure hardware at enrolment, a signature on every request, and verification at the edge and in the backend.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.