Otukan detects abusive accessibility behaviour on Android by watching what a service does inside your app, not by blocking accessibility itself. When a service that does not declare itself as an assistive tool reads protected content, places text into your fields or taps through an approval, Otukan withholds the sensitive views, pauses the step and sends the signal to your backend. Screen readers, switch access and voice control keep working. This control is Android-specific, because iOS does not let third-party apps act as accessibility services. Otukan sees your app’s own screens and the services acting on them, not the rest of the device.
Legitimate access comes first
What accessibility services are for
Accessibility services exist so that people with visual, motor or cognitive impairments can use a phone. A screen reader announces what is on screen. Switch access lets someone move through an app with a single button. Voice control turns speech into taps. To do that, a service needs to read your layout and act on it, which is exactly the access a banking or payments app would otherwise protect most carefully.
Why the same access attracts malware
Android malware asks the customer to enable an accessibility service, usually by posing as a system update or a helpful utility. Once enabled, it can read account numbers, catch one-time codes as they appear and press buttons on the customer’s behalf. Nothing about the device or the credentials looks wrong, because the attacker is working through the customer’s own session.
Otukan’s starting point
Blocking every service would lock out the customers who depend on them and fail accessibility obligations. Otukan therefore separates the capability from the behaviour.
| Service behaviour | Legitimate use | Abusive use | What Otukan does |
|---|---|---|---|
| Reading screen text | A screen reader announcing a balance | Harvesting balances and codes for an attacker | Withholds marked views from non-assistive services |
| Setting field values | Voice dictation into a search box | Filling a payee account number | Flags injected values in protected fields |
| Performing gestures | Switch access pressing a button | Approving a transfer the customer never saw | Holds the approval and asks for confirmation |
| Appearing on the device | Installed and configured over time | Switched on minutes before a payment | Adds timing context to the session signal |
Abuse behaviours Otukan acts on
Unauthorised reading
The most common abuse is quiet: a service copies what the customer sees. Otukan marks the views you choose, such as balances, card numbers and code fields, so that where Android allows only services declared as accessibility tools can read them. When another service is active on those screens, the signal records it.
Unauthorised input
Malware that fills fields for the customer leaves a different trace from a person typing. Otukan checks how text arrived in protected fields such as the payee account, the amount and the password. If an accessibility action placed it there, the app can clear the field and ask for it again.
Automation of approvals
The step that costs money is the confirm button. Otukan checks whether a gesture on that button came from the touchscreen or was dispatched by a service. An automated approval can be held for a second confirmation or routed to your backend for a decision. For the wider malware picture, see Android accessibility malware.
Policy testing with assistive technology
An accessibility-aware test plan
Before a protected release goes live, Otukan’s engineers run three rounds with your team. First, reproduce each abusive behaviour in an authorised lab with a test service and confirm the expected signal. Second, repeat the same journey with a screen reader, switch access and voice control enabled and confirm that the customer completes it. Third, rerun install, update, sign-in and your most sensitive flow. Results are recorded with device models, Android versions and the reviewer, and signed off by both security and UX owners.
Proportionate policy
Start with observe on every signal, look at how many real customers have which services enabled, then tighten the screens that move money or reveal codes. Viewing a statement and approving a new payee deserve different responses. Policy design is covered on threat response.
Remediation customers can follow
A paused step needs a way forward. Otukan’s messages tell the customer what was noticed and what to do: open accessibility settings, turn off services they do not recognise, and contact support on a number they already trust. Declared assistive tools do not trigger these messages, so customers who rely on them are not treated as suspects.
Overlay abuse, the frequent partner of accessibility abuse, is covered on Android overlay attack detection. For platform-wide Android controls, see Android app security. This control is part of mobile fraud prevention.