Application controls can observe the part of a scam that happens inside your app and on the phone it runs on, not the conversation that set it up. Otukan reports when a payment or payee change runs during an active phone call, where the platform exposes call state, while the screen is shared, while another app draws over the confirmation on Android, or from a device new to the account. It cannot hear the call, read the messages or judge what the customer intends. Those context signals let your app interrupt at the decision point with a clear way out, on Android and iOS.
Attack journey: coercion, remote guidance and credential capture
Most scams follow the same arc. Mapping it shows where an app has something to observe and where it has nothing.
| Stage | What the scammer does | What happens in your app | Observable by the app |
|---|---|---|---|
| Contact | Calls or messages posing as the bank, police or a courier | Nothing yet | No |
| Pretext | Creates urgency: a compromised account, a parcel fee, a safe account | Nothing yet | No |
| Remote guidance | Stays on the call and walks the customer through the app, sometimes asking to see the screen | Payment screens open during a call or a sharing session | Yes: call state, screen sharing |
| Credential capture | Asks the customer to read out a code or enter it on a fake page | A new device logs in or enrols | Yes: unbound device |
| Action | The customer adds a payee and sends the money themselves | Genuine customer, genuine device, correct credentials | Partly: only through context |
| Cash-out | Funds move onward through other accounts | Outside the app | No, this is your backend’s domain |
The hardest case is the last one inside the app. When the genuine customer pays on their own phone with their own password, device and integrity checks all pass. Context is the only evidence the app holds, which is why social engineering protection is built on it.
Visible boundaries
What the app can report
- A phone call active during a payment or payee step, where the platform exposes call state to the app.
- A shared, recorded or mirrored screen during the same step.
- On Android, an overlay over the confirmation screen.
- A new payee, a new device or a warning that was dismissed and retried.
What the app cannot know
Software on the phone does not detect intent. It cannot hear what the caller says, confirm whether a call is from your bank, see a second phone, or notice pressure applied in person. A customer paying a relative while talking to them looks similar to a customer being coached. Otukan labels every signal as a detection, not a confirmed scam, and leaves the decision to your backend and your fraud team.
Weighing combinations
A single condition is weak. A call during a first payment to a new payee, with a shared screen or a retried warning, is much stronger. Otukan sends the conditions together so your rules can weigh the combination.
Response design: contextual interruption and recovery
Interrupt at the decision
Put friction where the scam needs the customer to act: adding a payee, raising a limit, sending the first payment to someone new, or changing recovery details. Leave balance checks and routine payments alone.
Write for someone under pressure
The customer may be frightened and on the phone with a persuasive stranger. Keep the message short and specific. Name what the app noticed, state what your staff never ask for, and give one clear action: end the call, wait, or contact you on a number they already hold. Avoid wording that blames the customer.
Give time and a second channel
A cooling-off period on new payees, or a call-back from your team, breaks the scammer’s urgency. Verification that happens outside the current session is harder for the caller to steer.
Recovery after a scam
If a customer reports a scam, the app should guide them through the next steps in order: secure the account, remove unfamiliar devices, reset credentials and contact your team through the official channel. Record the signals from the session so your fraud team can link them to the report.
Signal review over time is covered on mobile app threat monitoring. For the complete set of fraud controls, see mobile fraud prevention. For a structured way to evaluate options, see the social engineering protection solution guide.
For an outside view of your published app, request a free App Exposure Check.