Otukan interrupts fraud at the points where an attacker has to act inside your app: signing in with stolen credentials, driving a session through malware or remote control, feeding fake media into onboarding, or steering a payment. The protected app reports what it can observe about itself, the device and how it is being used, and those signals travel with each sensitive request, so your fraud engine and identity service decide with better evidence. Otukan covers Android, iOS, Flutter and React Native apps, and scopes every signal per platform, because Android and iOS expose different behaviour.
Fraud journey
Fraud on mobile rarely happens in one step. It follows the customer journey, and each step offers a different route in. Otukan maps a control to each one.
| Journey step | Common fraud path | What Otukan detects in the app | Who decides |
|---|---|---|---|
| Onboarding | Synthetic identities, injected camera feeds, scripted sign-ups | Camera source integrity, emulators and automation, app integrity | Identity verification service |
| Login | Credential stuffing, stolen sessions, logins from a cloned app | App and device attestation, runtime integrity, device binding | Authentication service |
| Account recovery | New device enrolment, social engineering, SIM swap follow-up | New or unbound device, remote access, overlays on recovery screens | Identity and fraud teams |
| Payments and payee changes | Malware-driven transfers, remote-controlled sessions, coached victims | Accessibility abuse, overlays, screen sharing, remote control | Backend fraud engine |
Recovery deserves special attention. It is designed to let a customer in without their usual factors, which makes it attractive to attackers, and Otukan treats it as a high-risk flow. Overlays and accessibility abuse are Android signals; screen capture and device integrity signals exist on both platforms in different forms. For a step-by-step view of the takeover path, see the account takeover prevention guide.
Control boundaries
App signals
Otukan reports on the app’s own integrity, the environment it runs in and how the session is driven: a hooked or repackaged build, a rooted or jailbroken device, another app drawing over the screen on Android, an accessibility service performing taps, or a screen being shared. Runtime integrity underpins all of these, because a modified app could forge its other signals. Otukan checks integrity first, so your fraud engine knows whether the other signals come from an intact app. Mobile RASP covers those runtime checks, and malware detection covers malicious apps in detail.
Backend fraud decisions
Your fraud engine sees what the app cannot: account age, payee history, amounts, velocity across accounts and signals from other channels. Otukan’s app signals arrive as one more strong input. The engine weighs them, and your policy decides whether to allow, step up, hold or decline. The decision stays on the server, where it holds even when the attacker controls the device.
Identity services
Authentication and identity verification confirm who the person is. Otukan strengthens them by making sessions harder to replay, tokens harder to move to another device, and selfie checks harder to feed with fake media. For request-level evidence, see mobile API protection.
Clear ownership makes the whole chain work. When an overlay fires during a payee change, the app pauses the step, the backend holds the transfer, and your fraud team contacts the customer and closes the case.
Measurement
Connect signals to confirmed cases
Otukan records each signal with the sensitive request it accompanied, so you can join it to case outcomes confirmed by investigation or chargeback. For each signal, look at two numbers: how often it was present on confirmed fraud, and how often it fired on customers who turned out to be genuine. Signals that line up with real cases earn stronger responses.
Start by observing
Deploy new signals in observe mode first. Measure the legitimate-customer rate per platform, OS version and app version before any signal blocks or delays a customer. Some genuine users run screen readers, remote support tools or unusual devices, and a policy tuned on real traffic keeps them moving.
Report what you can defend
Otukan reports which signals were active, on which platforms and app versions, over which dates, and how they compared with confirmed cases. That gives your risk committee evidence it can check. Loss reduction is measured in your environment, against your own fraud mix, which makes the result yours to stand behind.
For the wider application security picture, return to mobile app security. If your app is already published, you can request a free App Exposure Check of the public store release.