A mobile security team should evaluate banking trojan detection by whether it catches the trojan while it works inside the banking app, and whether it links separate techniques into one picture. Otukan does both. On Android it detects fake login overlays and services reading codes or pressing buttons on payment screens. On both platforms it flags rooted or jailbroken devices and instrumentation in the app. It then joins signals from the same session, so a trojan that overlays the login and later drives a transfer shows up as one attack. Otukan works from inside your app; identifying a trojan family or cleaning a phone belongs to device-level tools.
Attack behaviour
A trojan’s working day
A banking trojan usually arrives through a text message or a fake app listing, then asks the customer for accessibility access. From there it follows a routine. It waits for the banking app to open, shows a copy of the login screen to collect credentials, reads one-time codes as they arrive on screen and, when ready, opens the app itself to add a payee and approve a transfer. Each step uses a different technique, and each one passes through your app.
What the bank sees without app evidence
Without signals from the app, the bank sees a valid login from the customer’s usual device, a code entered correctly and a payment approved in the app. Server-side checks pass, because the trojan uses the customer’s own phone and session.
The victim journey, step by step
| Stage | Trojan behaviour | Otukan signal | Platform |
|---|---|---|---|
| Login | A copied login screen drawn over yours | Overlay on a protected screen | Android |
| Code entry | One-time codes read from the screen | Non-assistive service active on the code field | Android |
| Payee creation | Fields filled without touch input | Service-driven input | Android |
| Approval | Confirm pressed by a service or a remote operator | Service-driven gesture; screen sharing | Android; screen sharing on both |
| Throughout | Modified system or hooked app | Root, jailbreak and instrumentation | Separate checks per platform |
Detection limits
What the banking app can see
Otukan relies on signals the platform exposes to your app about its own screens, input and process. Those signals line up with the stages a trojan passes through inside your app, which is why correlation works: one stage may be subtle, but the sequence is distinctive.
What needs device-level tools
Scanning every installed app, naming the trojan family or confirming how it was installed needs access that ordinary apps do not have. Otukan’s session record supports that work by showing exactly which stages were observed and when, so investigators start from facts rather than a customer’s recollection.
Why the sequence matters
A single overlay can come from a legitimate app, such as a chat bubble. Linking it with a service reading codes and driving an approval changes its meaning. Otukan passes both the individual signals and the linked record to your fraud engine.
Response
Proportionate by stage
Everyday actions such as checking a balance can continue with shielded content. Code entry and approvals are where holds pay off. A correlated pattern moves the whole session to your strictest response. Each stage can run in observe mode first.
Support paths for customers
A customer with a trojan is a victim, often a frightened one. Otukan’s messages say what was noticed in plain language, ask them to remove apps they do not recognise and review accessibility settings, and point to your support number rather than any number shown on screen. Assistive tools, password managers and chat bubbles are included in testing so genuine customers are not held.
What changes for the trojan operator
Trojans are run as a business. Every held approval, shielded code and blocked overlay costs the operator time on a device they may lose at any moment. When your app stops rewarding that routine, your customers become a less attractive target.
Proven in the lab
Otukan’s engineers rebuild each stage with a purpose-made test trojan inside an authorised lab, run the identical journey on a clean phone to confirm silence, and then walk through install, update, sign-in and a complete payment again. For banking-wide controls, see banking app security. Banking trojan detection is one of the controls in mobile fraud prevention.