Signal
Overlay and accessibility sensors run with the launch gate and again on payment screens.
App Security · AppDefender.dev
FraudWatch
Fraud and risk signals for BFSI and UPI Client apps.
Overlay, accessibility takeover, overlay-on-login, and behavioural flags feed the launch score and ATS Full. Isolated per Sandbox and Production so a Client cannot mix environments.
Overlay & ATO patterns
Accessibility abuse
UPI / lending risk flags
Maker–Checker on production policy
Isolated Sandbox / Production flags
Does not replace the bank phishing desk
What it does
FraudWatch on the launch path
FraudWatch is the risk-signal layer for BFSI, UPI, and lending Client apps. Overlay on collect, accessibility takeover, overlay-on-login, and ATO-style flags feed AppDefender and ATS Full. It does not replace the bank’s email or SMS phishing desk.
UPI collect QR, mandate, BBPS confirmation, and lending drawdown screens are where these signals show up first. A valid token on a handset with an overlay is still BLOCK. Severity and action stay in ThreatDesk policy.
Sandbox and Production catalogs stay isolated. A Client cannot copy Production overlay evidence into another tenant. Maker–Checker still applies when Production risk policy changes.
What it scores
Signals this module is built for
- Overlay on login, collect, and bill confirm
- Accessibility service takeover
- ATO and cloned-session patterns
- UPI / lending / BBPS risk flags
- Feeds launch score and ATS Full
- Maker–Checker on Production risk policy
How it runs
Detect, decide, enforce
Score
Flags join the isolated catalog. Action is LOG, WARN, CLOSE, or BLOCK — operator policy.
Isolate
Reports stay on that Client and environment. Super Admin does not mix tenants.
Operators
Who owns the control
Super Admin
Owns default risk actions. Enables each environment separately.
Client Admin
Tunes Sandbox flags, then two checkers promote Production policy.
Other App Security modules
Read the product page, not a copy here
All modules