A mobile security team should evaluate credential theft prevention on two fronts: does it protect secrets while customers type, view and copy them inside the app, and does it make stolen credentials useless when someone else tries them? Otukan covers both. It guards password, PIN and code fields against keystroke capture, screen capture and clipboard exposure, stops look-alike copies of your app from collecting logins, and gives your server evidence of the genuine app and bound device with every sign-in. Otukan works inside your app and at your backend; a phishing website or a compromised email account sits outside its view, although credentials taken there still arrive without that evidence.
Attack behaviour
Where credentials leak on a phone
Credentials are exposed at a handful of moments: while typed, while shown in a reveal-password field or a one-time code, while copied, and while sent. Attackers target each moment with a matching tool. Keyboards and input monitoring catch typing. Screen recording and mirroring catch display. Clipboard readers catch copies. A repackaged copy of your app, published under a similar name, catches all of them at once.
The victim journey
A customer receives a message about a problem with their account, installs an app that looks like yours, or grants a helpful-looking tool access to their screen. They sign in as usual. Nothing fails, and the credentials are now with someone else, who tries them from a different phone or a script.
Why the second half matters
Protecting typing and display reduces how often credentials leak. It cannot reduce it to nothing, because some theft happens far from your app. That is why Otukan pairs field protection with origin evidence at sign-in. A leaked password then becomes one piece of what a login needs, not the whole of it, and your authentication service holds the rest.
Route-to-control table
| Theft route | Moment | Otukan control | Platform notes |
|---|---|---|---|
| Keystroke capture | Typing | Input path checks and keyboard controls | System keyboard on iOS; no-learning flag on Android |
| Screen capture | Display | Hide revealed secrets during capture | Each platform’s own capture signals |
| Clipboard exposure | Copy and paste | Block copy-out; clear pasted values | Behaviour differs per platform |
| Look-alike app | Everything | Release integrity and app evidence | Both platforms |
| Credential replay | Use | Device binding and attestation | Checked by your backend |
Detection limits
What the app can see
Otukan sees the fields, the input path, the screen state and its own integrity. That is where credentials are entered, and where protection is most direct.
What lies outside
Phishing websites, breached password databases elsewhere and compromised email accounts are beyond any app’s view. Otukan does not claim to detect them. Instead, it makes their output weaker: a password harvested on a website reaches your login endpoint without your app’s evidence or the customer’s bound device, and your authentication service can see that.
Signals and confirmation
An exposure signal says a secret was at risk, not that it was stolen. Confirming a compromise is a job for your fraud team, using the session record Otukan provides and the attempts that follow.
Response
Controls matched to each field
Hiding a revealed password during capture costs customers nothing. Requiring the system keyboard on iOS changes little for most people. Stepping up a login that arrives without app evidence is stronger, and belongs on your server. Otukan lets you choose per field and per flow, starting in observe mode.
Keeping genuine sign-ins smooth
Password managers, platform autofill and assistive tools are tested as legitimate before any control is enforced. When a sign-in is stepped up, the customer is told why in plain words and offered a safe route: confirm on a known device, reset through your recovery flow, or call support on a number they already trust.
Verified before release
For every theft route, a harvesting tool is recreated in an authorised lab and the expected signal confirmed. The sign-in is then repeated with a password manager, autofill and a screen reader to confirm the signals stay quiet, and the regression pass covers install, update, login and recovery, with devices, OS versions and reviewer recorded. Credential stuffing against your API is covered on mobile credential stuffing protection. Credential theft prevention works within mobile fraud prevention.