Operators protect subscriber accounts by treating each self-service change as a decision that needs evidence from the device. Otukan supplies that evidence at the moments that matter: SIM and eSIM changes, number transfers, plan upgrades and account recovery. It confirms the request comes from the genuine operator app, on the device the subscriber enrolled, without hooking, emulation or someone else steering the screen, then passes those signals to the operator’s fraud and identity systems. Otukan works at the app layer. Signalling attacks and SIM swaps carried out in retail channels are outside its reach and belong to network controls.
Sensitive subscriber actions
A handful of self-service actions account for most of the damage when an account is taken over. Otukan maps each one to the evidence it needs and the system that decides.
| Action | What an attacker wants | What Otukan provides | Operator system that decides |
|---|---|---|---|
| SIM or eSIM change | Move the subscriber’s number to a device they hold | Device binding, attestation, remote-access context | Provisioning and fraud engine |
| Number transfer authorisation | Port the number out and receive one-time codes | Binding state, runtime integrity, app instance age | Porting and fraud checks |
| Account recovery | Reset credentials without the subscriber | New instance detection, emulator and tamper signals | Identity service |
| Plan and add-on changes | Run up charges or resell services | Automation and attestation signals | Billing and revenue assurance |
| Profile and contact updates | Redirect notifications and recovery channels | Remote-session signals, binding state | Identity and fraud engine |
Recovery and eSIM changes carry the most weight because a successful takeover there also captures the codes that protect the subscriber’s other accounts, including banking. For the takeover chain in detail, see mobile account takeover prevention.
Why operator apps attract takeover
A mobile number has become a key to other services. Banks, marketplaces and email providers send one-time codes to it, and many use it for account recovery. Whoever controls the number can often reset those accounts too. The operator’s self-service app is therefore a target in its own right: an attacker who signs in to it can request a new eSIM, change the contact details or authorise a transfer without visiting a store. Protecting those actions protects the subscriber well beyond the operator’s own services.
App compromise versus network attacks
Operator fraud crosses several layers, and a clean line between them keeps the right team on the right problem.
| Layer | Example attack | Who owns the control | What Otukan contributes |
|---|---|---|---|
| App | Cloned or hooked self-service app, scripted API calls | Mobile and application security | Detection, response and signals |
| Device and session | Remote control, screen sharing, new device claiming the account | Fraud and identity teams | Binding, remote-access and integrity evidence |
| Retail and contact centre | Social engineering of staff to swap a SIM | Store and contact centre procedures | Context on the subscriber’s app activity, where your team requests it |
| Network and signalling | Interception or rerouting within the mobile network | Network security | Outside scope |
Knowing the difference matters when a fraud case lands. If the app request came from the bound device with clean signals, investigators can look elsewhere quickly. If it came from a fresh instance on an emulator, the app layer is where the attack began. For binding in detail, see device binding.
Working with your fraud teams
Signals where decisions happen
Otukan attaches its evidence to the self-service request itself, so the fraud engine, identity service or provisioning system sees it at the moment of decision. There is no second channel to reconcile later.
Shared playbooks
For each protected action, the operator and Otukan agree what each signal means, what response the app applies and who reviews the result. That record helps fraud, security and customer care act on the same facts.
Care for everyday subscribers
Operators serve every kind of customer: prepaid users on older phones, families sharing a device, people who rely on the contact centre to walk them through an app. Otukan’s test plan includes those groups, so a signal that would catch a fraudster does not also lock out a grandparent topping up a phone.
A measured rollout
Each signal can begin in observe mode. Operator analysts see how often each fires across the real subscriber base, then enforcement moves action by action. Controls for API abuse are covered on mobile API protection, and in-app fraud controls on mobile fraud prevention. Every control named here is part of Otukan mobile app security, which covers the full product.