> For the complete documentation index, see [llms.txt](https://docs.payments.thalescloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.payments.thalescloud.io/nfc-wallet-sdk-android/security-and-privacy/security-countermeasures.md).

# Security countermeasures

The NFC Wallet SDK includes countermeasures for common mobile threats.

This page lists the runtime security countermeasures built into the NFC Wallet SDK.

## Coverage by flow <a href="#security-countermeasures" id="security-countermeasures"></a>

### SDK initialization and provisioning

Provisioning includes wallet secure enrollment and Tokenization.

During SDK initialization and provisioning, the NFC Wallet SDK protects against:

* **Debugger attached**
* **Man-in-the-middle (MITM) attack**
* **Digital wallet application data backup**
* **Rooted mobile device**
* **SDK Bind**
* **Use of emulator**
* **Non-designated application signing certificate**

### Payment

During payment, the NFC Wallet SDK protects against:

* **Debugger attached**
* **Digital wallet application data backup**
* **SDK Bind**
* **Non-designated application signing certificate**

## Countermeasures

Countermeasures applied for each threat are listed below.

<details>

<summary><strong>Debugger attached</strong></summary>

* **Threat**: An attacker attempts to reverse engineer the digital wallet application by attaching a debugger at runtime.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`
* **SDK behavior**: Return an error when a debugger is detected during the flow.

</details>

<details>

<summary><strong>Man-in-the-middle (MITM) attack</strong></summary>

* **Threat**: An attacker attempts to intercept or modify the communication channel between the digital wallet application and the NFC Wallet backend.
* **Applies to**: SDK initialization, provisioning
* **Build type**: `release`
* **SDK behavior**: When using the `release` build with a misconfigured TLS (SSL) certificate, the following errors may occur:
  * HttpStatusCode: -2
  * ErrorMessage: Unable to communicate with gateway.
  * SdkErrorCode: COMMON\_COMM\_ERROR

</details>

<details>

<summary><strong>Digital wallet application data backup</strong></summary>

* **Threat**: Data stored in the **digital wallet application** is backed up and restored to a different device.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`, `dev`
* **SDK behavior**: Wipe local digital wallet application data.

</details>

<details>

<summary><strong>Rooted mobile device</strong></summary>

* **Threat**: Running the digital wallet application on an Android rooted device.
* **Applies to**: SDK initialization, provisioning
* **Build type**: `release`, `dev`
* **SDK behavior**: Return an error during SDK initialization and provisioning when the device is detected as rooted. After enrollment, a change in device root state triggers the server to prompt the end user to re-enroll on the next SDK call to the server (via the `ProvisioningServiceListener.onError()` callback).

</details>

<details>

<summary><strong>SDK Bind</strong></summary>

* **Threat**: The SDK bundle (`.aar`) contains two main artifacts (`.jar` and `.so`). These artifacts are bound and must be used together. Always use the same build type for both artifacts.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`, `dev`
* **SDK behavior**: Return an error when the `.jar` and `.so` artifacts do not match.

</details>

<details>

<summary><strong>Use of emulator</strong></summary>

* **Threat**: Using an emulator to make NFC transactions.
* **Applies to**: SDK initialization, provisioning
* **Build type**: `release`, `dev`
* **SDK behavior**: The SDK cannot be initialized in an emulator. An error will be returned when an emulator is detected.

</details>

<details>

<summary><strong>Non-designated application signing certificate</strong></summary>

* **Threat**: The digital wallet application must be signed with a designated certificate. The SDK uses the signing certificate hash to verify application authenticity. See [Fetching application binding key](/nfc-wallet-sdk-android/get-started/configuration/2.-onboarding.md) for more information.
* **Applies to**: SDK initialization, provisioning, payment
* **Build type**: `release`, `dev`
* **SDK behavior**: Return an error when the application signing certificate does not match the designated certificate.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.payments.thalescloud.io/nfc-wallet-sdk-android/security-and-privacy/security-countermeasures.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.