Overlay attack

An overlay attack draws a fake screen, such as a bank login, on top of a real app so that you type your details into the scammer's window.

Overlay attack: An overlay attack happens when a malicious app displays its own window above another app. The fake window looks like the real login or payment screen, so you type your password or PIN into it, and the attacker's app records everything you enter.

Android lets some apps draw over other apps, which is useful for chat bubbles or screen recorders. Banking trojans abuse it. When you open your bank app, a copied login page appears at once on top. You think you are in the real app and type your user name, password and even OTP. Some overlays also hide a prompt, so you tap Allow without knowing what you approved.

Signs include a login screen that looks slightly different, appears suddenly after opening the app or has odd behaviour such as a blank background. Check Settings for the right to appear on top and allow it only for apps you trust. Install apps only from the Play Store and avoid forwarded APKs. If you entered details into a doubtful screen, change the password from another device and call your bank using the number on your card.

Tips

• Review which apps may display over other apps and switch off any you do not trust.
• If a bank login screen looks odd or appears after a delay, close it and restart the phone.
• Never install apps from links; they are the usual source of overlay trojans.

Related terms