Mobile controls protect an onboarding flow by making sure the evidence reaching your KYC decision was produced honestly: by your real app, on a physical device, through the device’s own camera, by a person who is not being steered by someone else. Otukan checks each of those conditions across the whole journey, from the first screen to the final submission, and sends the results to your backend with the application. It works on Android and iOS, each with its own checks. Otukan does not verify documents, faces or identities; those decisions stay with your identity provider and compliance team.
Journey map
Fraud enters onboarding at different points. Mapping them tells you which control belongs where.
Before capture
Application farms run your app on emulators or banks of reset phones and fill in forms with scripts. Otukan examines the environment the moment onboarding starts: virtual devices, automation frameworks, rooted and jailbroken systems, and a modified copy of the app. Stopping a farm here also spares you the cost of running your identity checks on it.
During capture
The document scan and the selfie are where synthetic and stolen identities are pushed in. Otukan checks that frames come from the device’s physical camera and that no code is rewriting what the camera returns. The verdict is attached to the images. Camera injection detection goes deeper into this step. Voice steps are covered on voice and audio injection detection.
At submission and across the session
The final request is where scripts try to skip the app entirely. Otukan binds its signals to requests your app sends, so a call assembled outside the app arrives without them. Throughout the session, Otukan also watches for screen sharing and remote control, the signs of an applicant being coached by a fraudster or of a mule account being opened on someone’s behalf.
| Stage | Main risk | Otukan signal |
|---|---|---|
| Start of onboarding | Emulators, farms, modified app | Environment and app integrity |
| Document and selfie | Injected or replayed media | Capture-path integrity |
| Form entry | Scripted values, skipped validation | Hooking detection |
| Submission | Requests forged outside the app | App-bound request evidence |
| Whole session | Coached applicants, remote control | Screen sharing and remote access |
Control ownership
Onboarding involves several parties. A written boundary stops gaps and double work.
| Question | Owned by |
|---|---|
| Is the app genuine and the device environment honest? | Otukan |
| Did the images come from this device’s camera? | Otukan |
| Is the document authentic? | Your identity provider |
| Is the applicant live and matching the document? | Your identity provider |
| Should the account open, and under what limits? | Your compliance and risk teams |
Hand-offs between parties
The weak points sit at the hand-offs. Images travel from the app to your backend and on to the identity provider; results travel back and join the application record. Otukan’s verdict is attached at the start of that chain, so your backend can tell when it has been dropped or swapped on the way. Your backend should refuse to forward a submission that arrives without it, and your provider’s result should be stored next to it, so an analyst reviewing a case sees device, capture and identity evidence together.
Otukan’s signals feed the last three questions but never answer them. That keeps each party accountable for its own result and makes audits simpler: when an account is opened in error, you can tell which check saw what.
Evidence
A KYC control earns its place when you can measure both what it stops and what it costs.
Attack scenarios you can reproduce
For each risk in the journey map, we reproduce the attack in an authorised lab and record the expected signal. Examples include an emulator running the onboarding flow, a virtual camera feeding a stored selfie and a scripted submission sent without the app. The same journey is then repeated on a legitimate device to confirm silence, and the regression pass covers install, update, sign-in and onboarding.
Genuine completion alongside
Every signal is first run in observe mode on your real applicants. You track how many applications carry each signal and how many of those later prove fraudulent, next to the share of honest applicants who finish. Controls move to enforcement only when that picture justifies it.
The parent overview is on mobile fraud prevention. Sector context is covered on fintech app security and insurance application security.