Emulators would be immediately identifiable. This method can only work if the fraudstee has no fraud detection mechanism at all.
Instead of emulating the OS, you could emulate app by simulating the I/O network traffic.
PayTV pirates did this with smart cards: just replaced the entire thing with a chip that knew what to respond for each challenge/demand.
Bluestacks in different configurations was among the things I tried.
Lost interest and decided the developers just don't want me as a potential customer.
For mobile web various fingerprinting techniques are available. As a fun (and quite irrelevant) example, you can immediately tell chrome, safari, firefox and node apart just with:
atob('Ψ')
x