Malware abuses a valid mobile session by letting the real customer sign in and then taking over what happens next. The device is theirs, the credentials are correct and every login check passes. Once inside, the malware reads the screen, taps through a new payee and approves a transfer, often while hiding the screen from the person holding the phone. Otukan detects that takeover from inside your app: automated input, abused accessibility services, obscured screens, remote control and tampered builds, each tied to the transaction on screen. The app pauses the step, and the signal reaches your backend so the payment can be held too.
Session abuse
Most mobile fraud defences are built around the question “is this the right person on the right device?”. On-device fraud answers yes.
Why genuine credentials are not enough
The attack starts with a lure: a text message, a fake app update, a call from someone claiming to be the bank. The customer installs something and grants it a permission. From then on, every factor your login relies on belongs to the victim. Device binding sees a known phone. Biometrics see the right face. The session token is valid. What changes is who is operating the app once the session is open. Lures that arrive by text message are covered on phishing and smishing detection.
What the fraud looks like from inside the app
| Moment | What the malware does | What Otukan can see |
|---|---|---|
| After sign-in | Reads the balance through accessibility events | A non-assistive accessibility service active on your screens |
| Adding a payee | Types beneficiary details by software | Input arriving without touches from the screen |
| Confirming | Covers the screen with a fake loading page | Your confirmation screen is obscured |
| Approving | Taps the approve button on the customer’s behalf | Automated gesture on a protected step |
| Guided scam | A remote operator watches or drives | Screen sharing, mirroring or remote access |
Signals
Each signal on its own has innocent explanations. A screen reader uses accessibility. A chat bubble can overlap a screen. The strength of Otukan’s approach is reading them together, in the context of what the customer is doing.
Accessibility and automation
On Android, Otukan identifies which accessibility services are active, separates assistive tools from unknown services and notices when taps or text arrive by software rather than from the touchscreen. A service that has been quiet all session and then drives a new payee screen is a very different picture from a screen reader announcing a balance.
Transaction context
Otukan ties every signal to the protected step on screen. The same accessibility service scores differently when the customer is browsing and when a first transfer to a new payee is being approved. Your backend receives the signal with the transfer request, so your fraud engine sees it alongside amount, payee history and account behaviour.
Timing and sequence
Fraud unfolds as a sequence. A payee added seconds after sign-in, a limit raised on the same screen and a transfer approved while the display is covered tell a clearer story than any single event. Otukan records the order and timing of signals within the session, so your fraud engine can judge the whole run of actions instead of scoring each tap in isolation.
The pattern is described further on automated transfer fraud detection.
Response
Detection only prevents loss when the app and the backend move together.
In the app
The protected step pauses. The customer sees a plain message that names the risk, such as another app controlling the screen, and what to do next. Where a screen is covered, the action waits until it is visible again.
On the backend
The matching transaction is held. Your team can confirm with the customer out of band, outside the app the malware is controlling, before releasing or rejecting it. Low-risk activity carries on so genuine customers are not locked out.
Proven before enforcement
Each abuse scenario is reproduced in an authorised lab and the signal is recorded. The same journey runs on a legitimate device with common assistive tools to confirm silence, and the regression pass covers install, update, sign-in and transfer.
The full set of fraud controls is covered on mobile fraud prevention. Banking context is covered on mobile banking app security. For a structured way to evaluate options, see the on-device fraud solution guide.