Otukan defends against account takeover at the steps where attackers need your app to cooperate: logging in, recovering an account, enrolling a new device and changing contact or payee details. At each step, Otukan proves the request came from your genuine app, on the device the session belongs to, and flags overlays, malware-driven input and remote control. Those signals travel with the request, so your authentication service and fraud engine step up or decline with evidence rather than guesswork. Stolen passwords and lifted tokens lose most of their value. Signals are tuned per platform: overlay, accessibility and remote access defences run on Android; on iOS, Otukan uses capture, mirroring, jailbreak and hooking signals.
The attack chain Otukan breaks
Account takeover is a chain. Otukan places evidence on each link, so an attacker who gets past one still meets the next.
Credential theft
Attackers collect passwords from breaches, phishing sites and the victim’s own phone. On the device, the routes are overlays that imitate your login screen, keyloggers and screen recording. Otukan protects login screens against these routes on Android, where other apps can draw over yours, and on iOS it reacts to screen capture and mirroring. Leaked credentials are then fired at your login API by scripts; Otukan’s attestation evidence lets your server tell those scripts apart from your app.
Session abuse
A session token is often worth more than a password, because it has already passed authentication. Tokens lifted from a rooted device, a backup or intercepted traffic get replayed from the attacker’s own phone. Otukan binds every session to the app instance it was issued to, so a replay arrives without the proof your backend expects.
Malicious interaction
Some takeovers happen on the victim’s own phone. Malware uses accessibility services to read the screen and tap through a transfer, or a caller persuades the victim to install a remote access tool. Credentials and device are both genuine, so Otukan looks at how the session is being driven: accessibility abuse, overlays and remote access on Android, and screen sharing and mirroring on both platforms during sensitive steps.
How Otukan covers the chain
Otukan combines runtime, malware and API protection into one set of takeover signals.
| Chain link | Otukan control | What your backend gets | Platform notes |
|---|---|---|---|
| Credential theft on device | Overlay, input and screen capture protection | Evidence that login input or screens were exposed | Overlays and accessibility: Android. Screen capture handling differs per platform |
| Credential stuffing | Mobile API protection with attestation verified on your server | Proof that login calls come from your genuine app | Play Integrity on Android and App Attest on iOS assert different things; Otukan treats each on its own terms |
| Session reuse | Device binding | Proof that the session is used on the device it was issued to | Android Keystore; iOS Keychain and Secure Enclave on supported devices |
| Malicious interaction | Malware and remote access signals | Evidence that something other than the customer is driving the session | Signals differ sharply between platforms |
| Modified client | Runtime integrity and anti-tampering | Confidence that every other signal is genuine | Root and hooking on Android; jailbreak and hooking on iOS |
Runtime integrity sits under every row. A hooked or repackaged app could fake its other signals, so Otukan’s mobile RASP checks detect that, and their status accompanies every takeover signal.
Proven before it goes live
Every Otukan takeover signal is tested three ways. We reproduce the behaviour in an authorised lab and confirm the signal fires. We run the same journey on a legitimate device and confirm it stays quiet. Then we repeat install, update, login and recovery on the protected build to confirm your customers’ experience is unchanged.
Clear ownership: app, authentication, fraud engine
What Otukan does in the app
Otukan collects and protects signals, attaches them to sensitive requests and applies the on-device response you choose: record, warn, pause a screen or block an action. It is the component closest to the session, which is why its evidence adds what server-side checks cannot see on their own.
What your authentication service does
Your authentication service decides who the customer is and when to ask for more proof. Otukan tells it when that moment has come, for example when a login arrives from a new app instance, an unbound device or a session under remote control.
What your fraud engine does
Your fraud engine sees account history, device history and transaction patterns. Otukan’s signals sharpen its decision to allow, hold or decline. We agree with you which team owns each response, and we start in observe mode so you see the effect on genuine customers before anything is enforced.
This control is part of mobile fraud prevention. For sector context, see mobile banking app security, e-commerce app security, telecom app security and superapps application security. For a step-by-step view of the takeover path, see the account takeover prevention guide.