The screens worth protecting from capture are those that show data a screenshot could turn into fraud or a privacy breach: card numbers, one-time codes, identity documents, recovery phrases, statements and personal records. On Android, Otukan prevents screenshots and recordings of the screens you mark and keeps them blank in the recent-apps view. On iOS, the platform does not let an app block a screenshot, so Otukan detects recording and mirroring, covers marked content while they are active, masks the app switcher preview and reports screenshots after they are taken. Each control is scoped to its platform, and no control stops a second camera.
Platform distinctions: prevention, detection and unavailable controls
Buyers often hear “screenshot protection” as one feature. On mobile it is three different things, and the platforms offer them differently.
| Capture route | Android | iOS |
|---|---|---|
| Screenshot of a marked screen | Prevented | Detected after it is taken |
| Screen recording | Prevented: marked screens record as blank | Detected; marked content is covered while recording runs |
| Mirroring to another display | Prevented on marked screens | Detected; marked content is covered |
| App switcher preview | Kept blank | Replaced by a cover view |
| Recording by another app | Receives a blank image of marked screens | Possible only through the system broadcast feature, which Otukan detects as capture |
| Photograph with a second camera | Not available to any app | Not available to any app |
What this means for your policy
On Android, you can rely on prevention for marked screens and use signals mainly to understand behaviour. On iOS, protection depends on detection, so the response matters more: hide the field, pause the step or record the event for review. Treat the two platforms as separate rows in your requirements, and ask for per-platform test evidence for each route.
Testing each route
Otukan proves every marked screen with your engineers before release. Take a screenshot, start a recording, mirror to an external display and send the app to the background, then confirm the expected outcome on each platform. Repeat the same journey on an unmarked screen to confirm nothing changes there. Finish with install, update, sign-in and the protected flow, and record devices, OS versions and the reviewer.
Sensitive screens: scope to documented exposure
Start from the data, not from the screen list. For each screen, write down what it exposes and what a capture would let someone do.
| Screen | Data exposed | What a capture enables | Suggested control |
|---|---|---|---|
| Card details | Card number, expiry, security code | Card-not-present fraud | Whole screen, plus field masking |
| One-time codes and signing prompts | A code valid for minutes | Account or payment takeover while it is valid | Whole screen |
| Identity document review | Document images and personal data | Identity fraud | Whole screen |
| Recovery phrase or backup codes | Account recovery secrets | Full account takeover | Whole screen, show once |
| Statements and personal records | Transactions, health or benefit data | Privacy exposure | Field masking on the sensitive values |
Public sector apps show several of these at once. Sector guidance is covered on government mobile app security.
Mark screens deliberately
Protecting the whole app looks safer and works worse. Customers cannot send support a picture of an error, tutorial videos your own team records come out blank, and every protected screen needs testing on every release. A documented list of marked screens is easier to defend in an audit and easier to maintain.
User experience: support, accessibility and legitimate sharing
Support
When a customer reports a problem on a protected screen, a screenshot is not an option. Show a short reference code on the screen that support can ask for, and tell agents which screens are protected so they do not ask customers to capture them.
Accessibility
Capture controls change what an image of the screen contains, not what assistive technology reads out. Test every marked screen with screen readers, magnification and switch access on each platform, and keep labels meaningful when a field is masked.
Legitimate sharing
Customers still need to send a payment receipt or share their account details with an employer. Give them a share action that produces a clean document with only the fields meant to leave the app. It is safer than a screenshot and more useful to the person receiving it.
The rest of the fraud controls are on mobile fraud prevention.
For streaming and media apps, see streaming and media application security. A free App Exposure Check of your public store release is a quick way to start the conversation.