Overlay attack
In plain terms
You open your banking app and see its login screen. Except what you're seeing is drawn on top by another app, and that app is the one receiving what you type.
Definition
An overlay attack is when an app installed on the phone displays a window on top of another app as soon as it launches, in order to intercept what the user types into it.
How it works
A mobile system lets an app display an element above the others: that's what makes chat bubbles or screen filters work. The corresponding permission is therefore legitimate and exists for good reasons. A malicious app requests it under a plausible pretext, then watches which app comes to the foreground. When it's a banking app, it instantly draws a copy of its login screen on top. The user has no way to notice: they did open the right app, the screen is the one they expected, and the action is theirs. The input goes to the malicious app, which then closes its window and lets the real app appear.
Warning signs
- App that has obtained permission to display over other apps for no obvious reason
- Login screen that appears with a slight delay or an unusual theme
- Keyboard or screen appearance that differs from what you're used to
- Abrupt return to the home screen right after entering something
- App requesting accessibility permission for a feature that doesn't require it
How to verify
Open the phone's settings and look at the list of apps allowed to display over other apps, as well as those with accessibility access. Both lists should be short and every entry should make sense. This is the only place where this attack is visible, since the screen itself can't reveal anything.
What to do
Don't grant either display-over-other-apps or accessibility access to an app whose function doesn't require it — these are the two most powerful permissions on a phone. Keep the system up to date, and prefer biometrics, which can't be typed on a screen.
If it already happened
Uninstall the app in question from safe mode if it resists, then change the passwords entered during the period, from another device. Notify your bank and monitor transactions. Revoke active sessions on the affected accounts.
Frequently asked questions
- How can another app draw over my banking app?
- Because the system intentionally allows it, for legitimate uses like chat bubbles. The attack doesn't exploit a flaw: it hijacks a feature, which is why it requires a permission rather than forcing anything.
- Does biometrics protect against this?
- It helps, because a fingerprint or a face can't be typed on a screen and so can't be captured by an overlaid window. An app that offers to fall back to the PIN code "because biometrics isn't working" deserves the utmost suspicion.
Related attacks
Official sources
This article is part of the Phones and connected devices family. Last updated: 2026-09-03.