> For the complete documentation index, see [llms.txt](https://docs.payments.thalescloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.payments.thalescloud.io/nfc-wallet-sdk-android/security-and-privacy/security-countermeasures.md).

# Security countermeasures

The NFC Wallet SDK includes countermeasures for common mobile threats.

This page lists the runtime security countermeasures built into the NFC Wallet SDK.

## Coverage by flow <a href="#security-countermeasures" id="security-countermeasures"></a>

### SDK initialization and provisioning

Provisioning includes wallet secure enrollment and Tokenization.

During SDK initialization and provisioning, the NFC Wallet SDK protects against:

* **Debugger attached**
* **Man-in-the-middle (MITM) attack**
* **Digital wallet application data backup**
* **Rooted mobile device**
* **SDK Bind**
* **Use of emulator**
* **Non-designated application signing certificate**

### Payment

During payment, the NFC Wallet SDK protects against:

* **Debugger attached**
* **Digital wallet application data backup**
* **SDK Bind**
* **Non-designated application signing certificate**

## Countermeasures

Countermeasures applied for each threat are listed below.

<details>

<summary><strong>Debugger attached</strong></summary>

* **Threat**: An attacker attempts to reverse engineer the digital wallet application by attaching a debugger at runtime.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`
* **SDK behavior**: Return an error when a debugger is detected during the flow.

</details>

<details>

<summary><strong>Man-in-the-middle (MITM) attack</strong></summary>

* **Threat**: An attacker attempts to intercept or modify the communication channel between the digital wallet application and the NFC Wallet backend.
* **Applies to**: SDK initialization, provisioning
* **Build type**: `release`
* **SDK behavior**: When using the `release` build with a misconfigured TLS (SSL) certificate, the following errors may occur:
  * HttpStatusCode: -2
  * ErrorMessage: Unable to communicate with gateway.
  * SdkErrorCode: COMMON\_COMM\_ERROR

</details>

<details>

<summary><strong>Digital wallet application data backup</strong></summary>

* **Threat**: Data stored in the **digital wallet application** is backed up and restored to a different device.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`, `dev`
* **SDK behavior**: Wipe local digital wallet application data.

</details>

<details>

<summary><strong>Rooted mobile device</strong></summary>

* **Threat**: Running the digital wallet application on an Android rooted device.
* **Applies to**: SDK initialization, provisioning
* **Build type**: `release`, `dev`
* **SDK behavior**: Return an error during SDK initialization and provisioning when the device is detected as rooted. After enrollment, a change in device root state triggers the server to prompt the end user to re-enroll on the next SDK call to the server (via the `ProvisioningServiceListener.onError()` callback).

</details>

<details>

<summary><strong>SDK Bind</strong></summary>

* **Threat**: The SDK bundle (`.aar`) contains two main artifacts (`.jar` and `.so`). These artifacts are bound and must be used together. Always use the same build type for both artifacts.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`, `dev`
* **SDK behavior**: Return an error when the `.jar` and `.so` artifacts do not match.

</details>

<details>

<summary><strong>Use of emulator</strong></summary>

* **Threat**: Using an emulator to make NFC transactions.
* **Applies to**: SDK initialization, provisioning
* **Build type**: `release`, `dev`
* **SDK behavior**: The SDK cannot be initialized in an emulator. An error will be returned when an emulator is detected.

</details>

<details>

<summary><strong>Non-designated application signing certificate</strong></summary>

* **Threat**: The digital wallet application must be signed with a designated certificate. The SDK uses the signing certificate hash to verify application authenticity. See [Fetching application binding key](/nfc-wallet-sdk-android/get-started/configuration/2.-onboarding.md) for more information.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`, `dev`
* **SDK behavior**: Return an error when the application signing certificate does not match the designated certificate.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.payments.thalescloud.io/nfc-wallet-sdk-android/security-and-privacy/security-countermeasures.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.