The issue could still be a fail-to-band issue if fail-to-band is looking at the user agent string (I'm not sure fail to ban looks at the user agent string, but it might be worth checking out.). The user agent string would likely be different on a mobile app versus a browser login.