IIRC in Puzzle & Dragons (one of the highest grossing F2P mobile games ever) the matches are purely client side, with a simple "I won" or "I lost" sent to the s

IIRC in Puzzle & Dragons (one of the highest grossing F2P mobile games ever) the matches are purely client side, with a simple "I won" or "I lost" sent to the server after the match. I don't think it has leaderboards as a focus, which I bet is not an isolated decision. In general, the design of online games of any kind need to take into account all the potential issues & hacks and not be designed in a vacuum. There's no universal answer to your question, but analysing behaviour of players and flagging various kinds of suspicious activity for more detailed inspection is likely the most common way. Designing the way to respond to such incidents is also non trivial, i.e. banning the player vs deleting the score, doing it quietly vs doing a large batch and prominently talking about it with the community, etc.