Device Guard risk tags - ID Verification - Alibaba Cloud Documentation Center

Risk category	Risk tag	Description
Device risk (Native SDK)	`ROOT`	Indicates that the device may be rooted or jailbroken.
	`HOOK`	Indicates that a hook framework may be active on the device.
	`VPN`	Indicates that the device may be connected through a VPN.
	`Emulator`	Indicates that the application may be running on an emulator.
	`SystemVirtual`	Indicates that a system-level app cloning feature is in use. Important Android only.
	`ThirdVirtual`	Indicates that a third-party app cloning tool is in use. Important Android only.
	`AdbModel`	Indicates that developer mode is enabled on the device. Important Android only.
	`DebugModel`	Indicates that debug mode is enabled.
	`NoSimCard`	Indicates that the device has no SIM card installed.
	`VirtualVideo`	Indicates that a virtual video tool is installed on the device.
	`UsingVirtualVideo`	Indicates that a virtual video tool is currently in use.
	`MirroredScreen`	Indicates that screen mirroring or recording is active. Important iOS only.
	`RiskROM`	Indicates that the device is running a high-risk custom ROM. Important Android only.
	`UnusualROM`	Indicates that the device is running a non-standard ROM. Important Android only.
	`AutoOperation`	Indicates automated operations, such as scripting or auto-clicking.
	`BlackTool`	Indicates that high-risk tools are installed on the device.
	`CloudPhone`	Indicates that the application may be running on a cloud phone. Important Android only.
	`BootUnLock`	Indicates that the device's bootloader is unlocked. Important Android only.
	`BootCountLittle`	Indicates the device has a low boot count, suggesting it is new or temporary. Important Android only.
	`ChargeScreenBright`	Indicates that the screen remains on while the device is charging. Important Android only.
	`ChargeScreenNoSecure`	Indicates that the device has no screen lock enabled while charging. Important Android only.
	`ChargeWithUsb`	Indicates that the device is currently charging via USB. Important Android only.
	`FakeDevice`	Indicates device spoofing, such as tampering with the device model or other characteristics.
	`AbnormalPort`	Indicates that anomalous ports are open or in use on the device. Important Android only.
Device risk (Web SDK) Important Due to browser sandbox restrictions, the detection capabilities of the Web SDK are limited to the browser layer. It cannot access low-level information such as hardware sources or drivers, which creates bottlenecks in detecting injection techniques. Therefore, it is recommended to combine server-side image liveness detection and business risk control measures to build a multi-layered defense-in-depth system, rather than relying solely on the Web-side Device Guard for decision-making.	`VirtualBrowser`	Indicates that the session may originate from a virtualized or automated browser environment.
	`VirtualCamera`	Indicates that a virtual camera may be installed.
	`UsingVirtualCamera`	Indicates that a virtual camera may be in use.
	`AutoOperation`	Indicates the use of automation tools.
	`BrowserTampered`	Indicates that browser parameters may have been tampered with.
	`Debugger`	Indicates that the page's JavaScript (JS) is being debugged.
	`CloudPhone`	Indicates that the session may originate from a cloud phone environment.
	`WebCrawler`	Indicates activity associated with a malicious crawler or scripted protocol abuse.
	`CookieDisabled`	Indicates that cookies are disabled in the browser.
	`Incognito`	Indicates that the browser is in incognito mode.
	`MediaHook`	Indicates that the browser's media stream API is being hooked.
	`NoRefer`	Indicates that the verification page was accessed without a referrer. Note This risk tag requires integration with ID Verification and is not available in standalone Device Guard deployments.
	`UnmatchOsUrl`	Indicates a mismatch between the verification page URL and the device. Note This risk tag requires integration with ID Verification and is not available in standalone Device Guard deployments.
Device token risk	`TokenIsNull`	Indicates that the `deviceToken` is empty.
	`TokenTampered`	Indicates that the `deviceToken` has been tampered with.
	`TokenInvalid`	Indicates that the `deviceToken` is invalid.
	`TokenExpired`	Indicates that the `deviceToken` has expired. The token is valid for seven days.
General	`BizIdNotMatch`	Indicates a mismatch between the `bizId` passed by the business service and the `bizId` bound to the token. This mismatch is common in attacks such as token swapping or replay. Note If this risk tag appears frequently, check for inconsistencies between the `bizId` used in the `getDeviceToken` call on the client and the `bizId` passed to the Device Guard query API.
	`DeviceBadNet`	Indicates that Device Guard failed to initialize due to a poor network condition. Note If this risk tag appears frequently, review the client-side integration. This issue often occurs when the client initialization and the `getDeviceToken` API call do not follow the standard sequence diagram. We recommend adjusting the timing of the token acquisition as described in the official documentation.
	`ReportingGap`	Indicates that Device Guard failed to report some collected data. Note If this risk tag appears frequently, review the client-side integration. This issue often occurs when the client initialization and the `getDeviceToken` API call do not follow the standard sequence diagram. We recommend adjusting the timing of the token acquisition as described in the official documentation.
Customer scenarios	`MiddleRiskEnv`	Indicates a medium-risk environment associated with fraudulent activities. This is a composite assessment. Note This composite risk tag combines multiple indicators based on extensive analysis of online threats and attacks.
	`PermittedDevice`	Indicates a device the customer has added to an allowlist. By default, its `GuardRiskScore` is 0.
	`BlackListedDevice`	Indicates a device the customer has blocklisted for repeated malicious activity. By default, its `GuardRiskScore` is 100.
Large model detections Note These risk tags are only available in the `FACE_GUARD_PRO` edition.	`QwenSeekRisk`	Indicates that the large model has identified a high-risk environment during the verification process. Note This composite risk tag results from a multi-factor analysis that uses large model inference and threat intelligence.
	`QwenHighRiskEnv`	Indicates that the large model has identified a high-risk environment associated with fraudulent activities. Note This composite risk tag is derived from a multi-factor analysis of accumulated threat intelligence and attack patterns.
	`QwenRegPool`	Indicates a match with the large model's knowledge base of known risks. Note This risk tag results from a multi-factor analysis that uses the large model to detect fraud rings.
	`QwenHighRiskBehavior`	Indicates high-risk behavior identified by the large model. Note This risk tag results from the large model's multi-factor analysis of behavioral patterns.
Others	`NoRisk`	Indicates a low-risk device. This tag is returned when no other risks are detected.
Others	`NoTag`	Indicates that no data was returned. The system returns this tag if it cannot retrieve risk data due to an error in ID Verification.