Fraud Anatomy
Screen-sharing and remote-access fraud:
how apps can prevent it
In a screen-sharing scam the victim is talked into installing a remote-access app, and the fraudster watches the screen and guides each payment. Apps can detect remote-access tools, mirroring and overlays, and add behavioural signals to spot a guided session.
How does screen-sharing fraud work?
The fraudster phones the victim posing as a bank, courier or support agent, and asks them to install a remote-access or screen-sharing app "to fix a problem". Once it is running, the fraudster can see the screen, read OTPs and tell the victim exactly what to tap. The payment is authorised by the real customer on their real phone, which is why device checks alone often pass.
What the rules ask apps to do
- The RBI's 2026 directions include the ability to identify remote access applications, to the extent possible, and prohibit login access to the mobile application. RBI directions →
- NPCI's circular for UPI apps makes screen-mirroring prevention mandatory and lists screen overlay prevention as recommended. NPCI circular →
How apps defend against it
- Detect known remote-access and screen-sharing apps and active screen mirroring, and respond.
- Detect overlays drawn on top of the app.
- Use behavioural signals, such as an unusual typing and touch rhythm or a hesitant, guided session, to spot that someone else is steering.
- Step up or limit high-risk actions when a risky session is detected.
See how a remote-access scam was caught in practice: case study → · mobile RASP guide →
A practical defence checklist
- Detect remote-access apps, screen mirroring and overlays, and decide the response on the server.
- Add behavioural signals so a guided session stands out from the normal pattern for that customer.
- Slow down or add friction to high-value actions on risky sessions.
- Warn customers inside the app that bank staff never ask them to install screen-sharing tools.
- Keep a signed record of what was detected so disputes can be investigated.
Frequently asked questions
What is screen-sharing fraud?
A scammer persuades the victim to install a remote-access or screen-sharing app, then watches the screen and guides the victim through payments or reads one-time passwords.
Which apps do fraudsters use for screen sharing?
Fraudsters use ordinary remote-support and screen-mirroring apps that have legitimate uses, which is why apps look for the behaviour (remote control, mirroring, overlays) as well as known app names.
What should a customer do if they have shared their screen?
Stop the call, uninstall the remote-access app, change banking credentials from a clean device, and contact the bank and the cybercrime helpline immediately so payments can be flagged or held.
Can an app stop screen-sharing fraud?
An app can detect remote-access apps, screen mirroring and overlays and respond, but because the genuine customer is using their own phone, device checks alone are not enough. Behavioural signals help show who is driving the session.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.