A fraud or security team should evaluate social engineering protection by asking three things of every option: what exactly the app observes when a customer is being coached, and how each signal is written down; how that signal turns into friction, triage and escalation at the payment step; and how device signals stay separate from confirmed scams in your records. This guide covers Android and iOS apps, including Flutter and React Native. Otukan does not read intent, calls or messages. It reports the conditions a scam leaves behind and gives the customer a moment to stop.
The control itself is covered on mobile social engineering protection. Other evaluation guides are on solution guides.
Signal contract
Agree the contract before the pilot. A signal your fraud engine cannot parse is a signal nobody acts on.
Observed behaviour
Scams leave different traces on each platform. Ask for the Android and iOS evidence separately.
| Scam pattern | Android evidence to require | iOS evidence to require |
|---|---|---|
| Caller coaching a payment | Active call while a payment or payee screen is open, where the app can read call state | Active call while a payment or payee screen is open, where the app can observe calls |
| Screen shown to the scammer | Screen sharing or mirroring while a sensitive screen is open | Screen capture or mirroring while a sensitive screen is open |
| Remote control by the caller | Remote access conditions that let another person drive the session | Third-party iOS apps cannot take control of yours; the capture signal carries this case |
| Fake window over the app | Another app drawing over the payment confirmation screen | iOS does not let apps draw over other apps; no overlay signal is needed |
| Malicious helper app | Non-assistive accessibility service active while sensitive content shows | iOS offers no third-party service that reads or taps inside your app |
| Scammer’s own phone | Login or enrolment from a device not bound to the account | Login or enrolment from a device not bound to the account |
Fields to require
- Which step raised the signal: login, payee change, payment confirmation, recovery?
- When it was raised, and when the condition started relative to the step?
- Which platform, app build and OS version reported it?
- Which severity the vendor assigns, and whether you can override it per step?
- Which pseudonymous identifier links it to the session your fraud engine already knows?
How Otukan answers. On both platforms, Otukan reports an active call during a payment or payee step where the platform makes call state available, screen sharing and mirroring, and access from a device not bound to the account. On Android it also detects remote access, apps drawing over the confirmation screen and non-assistive accessibility services, while trusted assistive tools stay allowed under your policy. Each signal names the step, platform, app build and the time it was raised, and Otukan combines call, sharing and new-device signals from the same session with the new-payee step. Signals travel with the payment, payee change or recovery request, so your fraud engine decides with the device context in hand.
Scam response workflow
A signal is only useful if the next person knows what to do with it.
In the app
- Which steps get friction first: new payee, first payment to a payee, raised limits, recovery?
- What does the customer see, in plain words, when a step is paused?
- Can a genuine customer complete the step after the warning, and how is that recorded?
In your fraud operation
- Who triages a paused payment, and in which queue?
- When does a signal trigger an outbound call from your contact centre?
- Which combination of signals raises a case to your fraud investigators?
- How do you tune a step that pauses too many genuine customers?
How Otukan answers. Otukan adds friction and a warning at the moments scammers target, such as payments and payee changes. Under your policy it can pause a payment before confirmation, apply a cooling-off period or hold a new payee, with the response set per flow: observe, warn, restrict or terminate. The customer sees a plain-language message explaining what was noticed and what to do next, and Otukan records when a warning is dismissed and the same step repeated, which gives your triage queue its strongest lead. Start in observe mode to measure the effect on genuine customers before you enforce.
Case records and retention
A device signal says a condition was present. It does not say a scam happened. Keep the two apart.
Separate the records
- Detection: the signal as raised by the app.
- Confirmed scam: the case your investigators closed, with the evidence they used.
- Business outcome: the payment stopped, recalled or reimbursed.
Handle the data
- Which fields leave the device, and do any contain message content, contacts or location?
- How long are signals kept, and who agreed that period?
- Who can link a pseudonymous identifier back to a named customer, and is that access logged?
- Has your privacy team reviewed the data flow before collection starts?
How Otukan answers. Otukan analytics keeps detections, confirmed attacks and business incidents apart and filters by each, so a device signal is not counted as a proven scam in your reports. Otukan does not listen to calls or read messages. Telemetry uses pseudonymous identifiers and leaves out message content, contacts, precise location and file contents. Retention is agreed with you before collection starts.
Pilot scorecard
| Question | How to answer it |
|---|---|
| Did the signals fire on a coached test payment? | Replay the scenario on test devices per platform |
| How many genuine customers saw friction? | Measure in observe mode before enforcing |
| Could the fraud engine use the signal? | Confirm the fields arrive with the request |
| Did investigators trust the record? | Review closed cases with and without signals |
If your app is already published, a free App Exposure Check of the public store release shows how it looks from the outside. Mapping the victim journey to app-visible signals is covered on the on-device fraud solution guide.