Fraud Detection in Pokémon Go

I play Pokémon Go. (There, I've admitted it.) One of the interesting aspects of the game I've been watching is how the game's publisher, Niantic, deals with cheaters.

There are three basic types of cheating in Pokémon Go. The first is botting, where a computer plays the game instead of a person. The second is spoofing, which is faking GPS to convince the game that you're somewhere you're not. These two cheats are often used together -- and you see the results in the many high-level accounts for sale on the Internet. The third type of cheating is the use of third-party apps like trackers to get extra information about the game.

None of this would matter if everyone played independently. The only reason any player cares about whether other players are cheating is that there is a group aspect of the game: gym battling. Everyone's enjoyment of that part of the game is affected by cheaters who can pretend to be where they're not, especially if they have lots of powerful Pokémon that they collected effortlessly.

Niantic has been trying to deal with this problem since the game debuted, mostly by banning accounts when it detects cheating. Its initial strategy was basic -- algorithmically detecting impossibly fast travel between physical locations or super-human amounts of playing, and then banning those accounts -- with limited success. The limiting factor in all of this is false positives. While Niantic wants to stop cheating, it doesn't want to block or limit any legitimate players. This makes it a very difficult problem, and contributes to the balance in the attacker/defender arms race.

Recently, Niantic implemented two new anti-cheating measures. The first is machine learning to detect cheaters. About this, we know little. The second is to limit the functionality of cheating accounts rather than ban them outright, making it harder for cheaters to know when they've been discovered.

"This is may very well be the beginning of Niantic's machine learning approach to active bot countering," user Dronpes writes on The Silph Road subreddit. "If the parameters for a shadowban are constantly adjusted server-side, as they can now easily be, then Niantic's machine learning engineers can train their detection (classification) algorithms in ever-improving, ever more aggressive ways, and botters will constantly be forced to re-evaluate what factors may be triggering the detection."

One of the expected future features in the game is trading. Creating a market for rare or powerful Pokémon would add a huge additional financial incentive to cheat. Unless Niantic can effectively prevent botting and spoofing, it's unlikely to implement that feature.

Cheating detection in virtual reality games is going to be a constant problem as these games become more popular, especially if there are ways to monetize the results of cheating. This means that cheater detection will continue to be a critical component of these games' success. Anything Niantic learns in Pokémon Go will be useful in whatever games come next.

Mystic, level 39 -- if you must know.

And, yes, I know the game tracks works by tracking your location. I'm all right with that. As I repeatedly say, Internet privacy is all about trade-offs.

from Fraud Detection in Pokémon Go