Sessions driven by malware or remote access tools, where the backend only sees a legitimate user doing legitimate things.
Mobile channel protection for banking, payments, and digital identity
We protect the whole path between your user, their device, your application, and your backend.
12 billion+
protected app instances to date
75+
countries where Licel solutions are deployed
since 2011
protecting mission-critical mobile apps
Independently evaluated and approved
Third-party evaluation, year after year
DexProtector EMVCo SBMP SPT, for six consecutive years. The first software protection tool approved for both Android and iOS.
The Licel vTEE EMVCo SBMP TEE, for both platforms, Android and iOS. The only TEE of any kind currently approved by EMVCo.
Approvals are renewed annually and lapse if they aren’t.
See what we hold, and verify it.
Certified
ISO/IEC 27001:2022 and CSA Cyber Trust (Advocate tier)
Member
GlobalPlatform and PCI Security Standards Council
Mobile fraud starts on the device
Direct losses are rarely the whole cost to a business. There’s the acquisition spend for onboarding bogus accounts, follow-up investigation and audit work, and the genuine customers who leave once fraud happens to them.
Account takeovers
Onboarding and eKYC fraud
Synthetic identities passing liveness checks through virtual cameras and injected video, opening accounts that look clean on day one.
App tampering and cloning
Repackaged versions of your app sending valid requests, and modified builds with your security controls stripped out.
Automated API abuse
Bots and scripted clients at scale: credential stuffing, scripted account creation, and promotion abuse.
Data leaving the app
Sensitive screens captured, mirrored to an external display, or read from a lost device.
Threats are shifting constantly
Mobile app protection was built to stop attackers reverse-engineering code. That’s still vital today, and it’s also no longer enough on its own. The risks above happen at runtime, on a device you don’t control.
Most security stacks have no visibility into any of them. The question is rarely whether the mobile channel is being attacked but whether you’d know.
Mobile Channel Protection is the approach we built to close that gap. It covers the whole path between the user, device, application, and backend: the app itself, the environment it runs in, and everything it sends home.
“Onboarding fraud used to be a big problem for us. Licel’s solutions provide layers of visibility into what’s happening on the device in the moment, which gives our fraud team enough depth to block fraudulent accounts at the point of creation. ”
Risk Executive of a European digital bank
Integrity, Intelligence, Isolation
Three layers: protection and integrity control at the app, actionable threat intelligence from the tamper-proof signals this protection generates, and logical isolation for the sensitive operations that need more.
Integrity
DexProtector
DexProtector enables Android and iOS apps and SDKs to defend themselves, and produces trustworthy signals about the environment they operate in. Code hardening makes it expensive for attackers to reverse engineer. Integrity control detects modifications to the app and its environment. Runtime protection (RASP) detects dynamic instrumentation and hooking frameworks, emulators, and debuggers while the app is running. Network communication hardening protects the channel to your backend, and mobile API protection enables the backend to verify the request came from a genuine, unmodified app.
DexProtector has been independently evaluated and approved by EMVCo under SBMP SPT for six consecutive years.
A post-build step in your existing pipeline
Protection is applied automatically after your app is built, as a step in your existing pipeline. There are no changes to the source code, and nothing is uploaded to us; it runs in your own environment. The protection runs with negligible impact on performance. It is measured on every release and is proven at 12 billion installation instances.
This is the protection layer that everything else rests on, because signals from an unprotected app can be faked.
Intelligence
Alice Threat Intelligence
Alice works from signals DexProtector already produces. Its sensors sit inside the protected app, hardened by the same anti-tampering that protects everything else, so what arrives at the backend can be trusted. That’s the part most fraud tooling can’t establish: a signal from a compromised device will say whatever an attacker wants it to say.
Alice correlates across sessions, devices, and time to establish patterns such as which environments are being instrumented, where repackaging attempts cluster, and which attack techniques are spreading across your install base. Fraud teams work with it live via the enterprise API, or retrospectively through the dashboard.
Visibility you can act on
Alice runs alongside the SOC and SIEM systems you already have rather than replacing them. And because the sensors ship with DexProtector, turning it on is a configuration change rather than a project.
Isolation
The Licel vTEE
Some operations need more than a hardened application around them: key handling, PIN entry, request authorization, token generation, transaction binding, and other sensitive cryptographic operations. Hardware secure elements handle parts of this well, but they’re fragmented across devices, restricted on some platforms, and absent on others, meaning the protection stops where the hardware does.
The Licel vTEE is a virtual Trusted Execution Environment. It runs sensitive operations in a separated execution context inside the app, extending the hardware root of trust through the parts of a workflow that hardware alone doesn’t cover. It is complementary to a secure element, keeping critical logic out of the ordinary application layer, where it would otherwise be exposed.
Isolation where hardware stops
Plaintext before encryption, fallback logic, and derived secrets all sit outside the hardware boundary, in an ordinary app process. That’s where the Licel vTEE works and helps protect the modern payments ecosystem. Integrated and configured through DexProtector, the Licel vTEE is independently evaluated and approved by EMVCo under SBMP TEE for both Android and iOS, and is the only TEE currently approved under the program.
“We work around long release cycles and there’s little appetite internally for disruption. We appreciated Licel’s solutions integrating within our own infrastructure and fitting easily around our existing development processes. The Licel vTEE helps us to deliver our solution to more devices independent of the level of Android Hardware KeyStore Support.”
Mobile Security Product Owner of an Asian mobile wallet provider
Banking, payments, and digital identity
Mobile banking
Account takeovers, eKYC fraud, ATS malware, and authorized push payment fraud, addressed at the device where they originate.
Mobile wallets
DexProtector and the Licel vTEE are evaluated and approved under both EMVCo specifications that apply to wallet applications, which removes a common blocker from your own certification path.
SoftPOS
Licel components help enable SoftPOS providers to comply with PCI MPoC requirements.
Digital identity
Wallets, mobile driving licenses, and eIDs need isolation for key operations and verifiable device integrity as they operate on devices you don’t control.
Sharper every year since 2011
We shipped our first mobile protection license in 2011, and we’ve been protecting mission-critical apps ever since.
More than 15 years defending the same kinds of applications against adversaries that are constantly evolving their attacks has shaped everything that we build. There’s no sales-led product roadmap here; what gets built is decided by people who understand the attacks and what’s at stake.
Claims about protection strength are cheap, but independent evaluation isn’t. That’s why we submit to EMVCo evaluation every year rather than just once: approval isn’t a badge that you earn once and then get to keep. It lapses unless it’s renewed, and renewal means putting the current version of the product in front of an accredited laboratory again rather than the one that passed last time.
Where it all started
JCardSim
JCardSim is a groundbreaking open-source Java Card runtime simulator, maintained by Licel. Since 2011 it has helped speed up the development process for Smart Card apps, enabling users to test how their applet will perform in an instant. These days it’s used to test modern solutions like e-SIMS and Smart Cards for eID solutions.
JCardSim was the first solution we created, and it has had a big influence on our other solutions. Taught in universities around the world, JCardSim was the winner of the Oracle Duke’s Choice Award in 2013.
Also available is JCardSim GP; a separate module that enables the GlobalPlatform specification.
Trusted by
Talk to us
We're happy to have a straightforward conversation about your threat landscape and whether Licel’s mobile channel protection solutions fit your requirements.
Try it on your own app
We issue a free trial license so your team can run a proof of concept in your own environment. It typically lasts around two weeks, with our engineers on hand throughout.
