A mobile security team should evaluate voice and audio injection detection by one question: does the product prove the audio came through the device microphone in an unmodified app? Otukan answers it at the capture point. It flags virtual and software-defined audio inputs, instrumentation on your app’s capture functions, emulated devices and altered copies of your app, then attaches that evidence to the recording. Your voice verification or liveness service still decides whether the speaker is live and who they are. Otukan closes the routes that bypass the microphone; judging the sound itself belongs to those services. Android and iOS checks are built separately.
Capture path
Where voice enters your app
Apps use voice for enrolment, voice login, call-back confirmation and spoken consent. In each case the journey is the same: microphone, operating system audio stack, your app’s capture code, upload, and a decision on your server or at your provider. An attacker who wants a cloned or recorded voice accepted does not need to fool the ear. It is enough to replace the audio somewhere along that path.
The points attackers reach
| Point on the path | Manipulation | Otukan check |
|---|---|---|
| Input device | A virtual microphone or software audio source replaces the physical one | Input route classification |
| Operating system | A rooted or jailbroken device reroutes system audio | Device integrity status |
| App process | Capture functions are hooked to return prepared audio | Instrumentation detection |
| Hardware | An emulator simulates the whole device | Emulator detection |
| App itself | A repackaged copy uploads a file instead of recording | Release integrity check |
Platform differences
Android exposes more detail about audio devices to apps, and its open audio stack gives virtual audio tools more room to operate. iOS tells an app less about routes, and it also leaves far fewer ways to replace audio on a device that is not jailbroken. Otukan uses each platform’s own signals and records which checks ran on which platform.
Control boundary
Four different questions
Voice fraud controls are often bundled together, which makes evaluation hard. Separate them:
- Injection detection (Otukan): did the audio come through the microphone of an intact app on a physical device?
- Content classification: does the audio sound synthetic or manipulated?
- Liveness: is a live person speaking right now?
- Identity proofing: is this the person the account belongs to?
A strong voice journey uses all four, and each is tested on its own.
What Otukan hands over
Each capture carries its input route, process integrity result, device status and app integrity result. Your provider receives the sample with that context, so a synthetic voice pushed through a virtual input fails before classification starts.
Evidence your provider can use
The capture evidence is designed to be read by a machine and a person. Your verification service can apply a simple rule, such as refusing any sample recorded through a virtual input, while your fraud analysts see the same record when they review a disputed enrolment. Because the evidence is produced for every capture, not only suspicious ones, you also learn which routes genuine customers use most.
For camera and document capture, see camera injection detection.
Customer impact
Test the real ways people speak
Genuine customers use wired and wireless headsets, hearing aids, car systems and speakerphone, sometimes with background noise and assistive settings enabled. Each is recorded in the test plan as a legitimate route, confirmed on physical devices and repeated through install, update, sign-in and the voice step itself.
Recovery routes
When a capture is refused, the customer needs a clear next step: switch to the built-in microphone, remove a virtual audio app, or complete verification another way, such as a document check or a branch visit. Otukan’s messages describe the problem in plain words without accusing the customer. A refused capture is also recorded, so your team can spot customers who meet repeated refusals and reach out to them.
Proportionate policy
Start in observe mode to see which input routes your real customers use. Then refuse only the routes that bypass the microphone, and keep the decision on voice content with your provider. Microphone access from outside your flows is covered on detecting unauthorised microphone access. Voice capture checks belong to Otukan’s mobile fraud prevention family.