Otukan protects fintech and payments apps where their transaction model is exposed, sends app evidence with every payment request and builds protection into a release process that ships often. A wallet holding value, an app that initiates payments from bank accounts and an app built around partner SDKs each fail in different places, and Otukan places its controls at those points. Your fraud engine, identity provider and payment partners keep the decisions; Otukan gives them evidence about the app, the device and the session. Each control has its own Android and iOS scope.
Protection for every transaction model
Wallets
A stored-value or tokenised wallet keeps something of value in the app: a balance, a card token or a credential that moves money. The main risks are account takeover, tokens copied to another device and malware approving transfers. Otukan binds wallet credentials to the original app instance using platform key storage: the Android Keystore, and on iOS the Keychain and, on supported devices, the Secure Enclave. Device binding is covered on device binding.
Payment initiation
Apps that initiate payments from a customer’s bank account depend on authorisation flows between the app, the bank and your backend. Attackers target the redirect and approval steps, and script the APIs behind them. Otukan attaches attestation and request freshness evidence that your backend verifies, so scripted calls stand out. API protection is covered on mobile API protection.
Partner SDKs
Many fintech apps embed SDKs for identity verification, card issuing or payments. Those SDKs handle some of the most sensitive steps, but you do not control their code. Otukan protects the environment they run in, detects hooking and modification around them, and tests each protected build with the exact SDK versions you ship.
| Model | Most exposed step | What Otukan provides | Who else decides |
|---|---|---|---|
| Wallet | Login, device change, transfer | Device binding, runtime integrity, malware signals | Your fraud engine |
| Payment initiation | Authorisation and redirect | App attestation, request freshness | Account-holding bank, your backend |
| Partner SDK flows | Onboarding, card provisioning | Environment integrity, camera injection signals | SDK provider |
Clear fraud boundaries
Otukan, your backend and your identity services each own part of the problem. We agree the split with you before launch, so every responsibility has a clear owner.
- Otukan, in the app. Collects and protects signals about app integrity, device state and how the session is driven, attaches them to sensitive requests, and applies the on-device response you choose.
- Your backend and fraud engine. Verifies Otukan’s evidence, combines it with account history and transaction patterns, and decides whether to allow, step up, hold or decline. For account-level abuse, see mobile fraud prevention.
- Your identity services. Verify who the customer is at onboarding and step-up. Otukan’s camera injection and automation signals make injected media and scripted sessions stand out. For remote onboarding, see KYC fraud prevention.
The payment decision stays on your server, away from any device an attacker controls, and Otukan makes that decision better informed.
Built for a fast release process
Fintech apps ship often, and partner SDKs update on their own schedule. Otukan fits your existing build and release pipeline, signing keys stay with you, and response policy changes without a new release. Android and iOS builds pass through different store reviews and often reach customers on different dates, so Otukan keeps release records per platform.
Release checklist Otukan runs with you
- Protected builds run the same automated test suite as unprotected builds, on both platforms.
- Every partner SDK version in the release is exercised through a complete journey on the protected build.
- Install, update from the previous version and first launch are tested across your supported OS range.
- Start-up time and crash rate are compared with the previous release.
- The build is checked against current store review guidance for each store.
- Policy changes that need no code are made without a new release.
Third-party integration
Otukan treats each SDK update as a change to your security surface. We record which SDK versions shipped with which protected build and retest when either changes. Where an SDK runs its own security checks, we align the two so they do not conflict, and agree with you which result your backend treats as authoritative.
For the wider application security picture, return to mobile app security. If your app is already published, request a free App Exposure Check of the public store release.