Case Study

Behavioural Detection of a Remote-Access Scam

A remote-access scam bypasses software-only behavioural tools by mimicking human typing. See how NonaShield's hardware-witnessed proof of intent catches it.

The Passive Sensor Engine

47+ Behavioural Vectors.

The SDK's biometric collector runs a 32-channel passive sensor engine with zero extra UX friction — 47+ distinct named metrics in total, grouped below.

// Touch Primitives

Pressure Dynamics (avg + variance) Finger Contact Ellipse (major/minor) Swipe Velocity Profile Gesture Curvature Entropy

// Micro-Jitter & Hesitation

Micro-Jitter Score (Bézier-path deviation) Touch Ellipse Evolution Hesitation Intervals (down → first move) Tap Interval / Touch Variance

// Phone Posture & IMU

Holding Pitch & Roll (accelerometer) Gyro Yaw / Accel RMS Micro-Movement / Jerk Index Grip Variance & Tremor Zero-Crossing Rate

// Keystroke Dynamics

Key Dwell / Flight Time Typing Speed & Error Rate Backspace Frequency & Autocorrect Rate

// Session & Environment

Screen Dwell Time & Anomaly Z-Score Back-Navigation Count / Hesitation Gaps Ambient Light & Battery Drain Rate

// Coercion-Specific (Digital Arrest / Romance Scam)

Tremor RMS — 8–12Hz fear-tremor band Grip Rigidity Score Pressure Ramp Score (grip-tightening correlation)

Fused by the Behavioural Integrity Engine into a single deviation score against a calibrated per-device baseline — not compared against a generic population average.

See It In Action

Watch the Attack Fail.

TRANSFER STARTED
TYPING LOOKS NORMAL
SCREEN IS CHECKED
REMOTE CONTROL FOUND
SESSION STOPPED
Ready to begin.

The Verdict.

"BioCatch tells you how they typed. NonaShield proves what they were seeing when they typed."

Engineered Prevention
Deterministic Trust vs Probabilistic Security
Why It Matters

What this case means for your app

In a remote-access scam the customer is a real person, on a real device, entering real credentials. Device and identity checks pass. The only thing that has changed is who is steering the session.

Behavioural signals fill that gap. Hesitation before a payment, copy-and-paste of an account number, navigation that follows a script rather than the customer's habit, and a remote-access tool running in the background are all small signals. Together they separate a guided session from a normal one.

The risk engine does not need certainty. A raised score can trigger a plain-language warning, a delay or an extra check. Read more about screen-sharing fraud prevention and digital arrest scams.

FAQ

Frequently asked questions

How can an app detect a remote-access scam?

By combining on-device signals, such as remote-access or screen-sharing tools, with behaviour in the session, such as hesitation, guided navigation and an unusual payee.

Can behavioural analysis block a scam on its own?

It raises or lowers risk. The risk engine uses it with device, identity and location signals before it steps up or blocks a payment.

Does NonaShield hear the scam call?

No. It sees the effect on the phone and in the session, not the phone call itself.