The split inside that 159 is where the underwriting sits. The samples were built to harvest credentials from 147 of the apps [5], and stolen credentials still have to be spent somewhere, which leaves the bank's server-side scoring one more look at the transaction; for 112 apps that second look is the entire defense [2]. In the other 35 the transfer starts on the customer's own handset inside the customer's own session, 22% of the tested set [1], and there is no login anomaly to catch because nothing anomalous happened at login.
Android's accessibility service, built so software can read the screen and tap on a user's behalf for people with disabilities, is what makes most of this work [7], and the same access covers the channels banks use to check their work: SMS passcodes, email, push notifications and in-app approvals are all readable and editable once the device is taken over [15]. Eward Driehuis of ThreatFabric puts it as an engineering constraint rather than a warning, saying multifactor authentication becomes "less efficient or even fully compromised if additional factors are available from the same device" [14]. Read that as a budget line. A dollar spent adding a fourth on-device factor is a dollar not spent on an off-device factor or on server-side behavioural scoring, and on this evidence only the second pair is still standing.
The most useful number here is one nobody has. Singapore, Malaysia, India and Hong Kong already require protections inside the banking app [16], and Driehuis says ThreatFabric's intelligence "does not show a significant decrease in mobile malware activity" in those regions [17]. This is probably too harsh a reading of one vendor's telemetry, and ThreatFabric sells fraud-detection software [19], so its account of its own data is not disinterested. But four mandates with no measurable decline is the nearest thing to a controlled test anyone has run on app hardening, and it suggests hardening is a compliance cost that does not price as a control.
The evidence has dated edges. The sample window closed in December 2022 [1], so anything Android has tightened since is invisible in these percentages. Zimperium's count of the U.S. leading the world in banking apps under active targeting arrives without an absolute number attached [11]. And the 54% of customers who now bank primarily by app, per Morning Consult [12], is a mobile-first population that includes iPhones, while the corpus is Android.
Which leaves 35 of 159. Nothing in the source material argues with it.
