Fraud Anatomy
Overlay attacks on
Android banking apps
An overlay attack places a fake or invisible window over a real banking app so the user's taps and typing go to the attacker. It relies on risky permissions that victims are often talked into granting, and apps can defend by ignoring obscured touches and detecting interfering windows.
How does an overlay attack work?
A malicious app that the victim has installed and granted permissions waits until a banking app opens. It then draws a window over it. The window may be a perfect copy of the login screen that captures what the user types, or a transparent layer that makes the user's taps land on something else (often called tap-jacking).
The permissions behind it
- Draw over other apps: lets an app display content above others.
- Accessibility services: intended to help users with disabilities, but able to read screens and perform taps when abused.
- Social engineering: victims are talked into granting these permissions, often together with installing a remote-access app.
How apps defend against overlays
- Mark sensitive views to ignore touches when another window is covering them (the Android filter-touches-when-obscured setting).
- Block screenshots and screen recording on sensitive screens.
- Detect when another window or accessibility service is interacting with the app and respond, for example by hiding sensitive fields or stepping up authentication.
- Use behavioural signals to spot input that does not match how the customer normally behaves.
- Warn customers inside the app about permission requests and screen-sharing requests.
What regulators say
NPCI's mobile app security circular lists screen overlay prevention as a recommended control for UPI apps, alongside mandatory screen-mirroring prevention. NPCI circular → See also screen-sharing fraud and what mobile RASP detects.
Frequently asked questions
What is an overlay attack?
An overlay attack draws a fake screen or an invisible layer on top of a real app so the user taps or types into the attacker's interface, letting the attacker capture credentials or trigger actions.
How do overlay attacks happen on Android?
Malware typically abuses the 'draw over other apps' permission or an accessibility service to place a window above a banking app. Android has tightened this in recent versions, but fraudsters still target users who have granted risky permissions.
Is overlay protection required for UPI apps?
NPCI's circular lists screen overlay prevention as a recommended control for UPI apps, and screen-mirroring prevention as mandatory.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.