Kavach-UPI: Remote Fraud Security Shield

Inspiration

The inspiration for Kavach-UPI stems from the alarming surge across India in financial social engineering scams, where fraudsters exploit a critical operating system blind spot. Vulnerable users are frequently tricked into installing legitimate remote-desktop utilities like AnyDesk or TeamViewer under the guise of customer support. Once the victim opens a UPI interface, the attacker observes sensitive screen information, steals one-time passwords, and takes remote control of the device to drain bank accounts. We set out to design a zero-trust, edge-computed defense system that runs locally to protect users at the exact moment of a transaction, independent of whether the underlying payment application supports native screen-capture blocking.

What it does

Kavach-UPI acts as an intelligent, on-device active security shield that dynamically flags and intercepts unauthorized screen-sharing attempts during financial transactions. By tracking real-time layout contexts, the application switches into an aggressive defense gear the moment a recognized UPI payment app or institutional banking platform is brought into the foreground. If a concurrent screen-casting, media-projection, or virtual display threat is verified, the system instantly deploys a programmatic glassmorphic layout overlay that absorbs and blocks all incoming touch inputs, freezing out remote control scripts. Simultaneously, it triggers a continuous, bilingual text-to-speech audio alert stream in English and Hindi alongside siren fallbacks to guide the user to terminate the malicious connection immediately.

How we built it

The application was built natively in Kotlin targeting Android SDK 34 within Antigravity IDE, anchoring its background tracking infrastructure via a highly resilient AccessibilityService subsystem. We integrated a dual-gear background coroutine pipeline managed under a thread-safe SupervisorJob scope to monitor active system event nodes dynamically without introducing performance bottlenecks. For device versions running Android 10 or higher, the app leverages a compressed-window UsageStatsManager query timeline to trap hidden metadata streams flagging FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION, dropping back to package registry lookups on older configurations. The state orchestration relies on low-latency coroutine communication channels to evaluate thread-safe atomic criteria, dispatching instant window manipulation commands to the main thread to drop or lift overlays programmatically.

Challenges we ran into

During the engineering lifecycle, we encountered significant hurdles with system resource leaks, cross-thread flag synchronization, and strict Android property assignments. We faced persistent background Binder proxy leaks when recursively parsing layout trees, which we resolved by enforcing a strict Depth-First Search depth cap of 15 layers and integrating a mandatory node-recycling sequence on every checked child element. Additionally, we addressed a critical dismissal loophole where overlays remained stuck on screen post-threat resolution; this was fixed by implementing a combined command handler that unifies overlay dismissal with an intentional audio wind-down delay, stabilized by a two-cycle clean polling hysteresis mechanism to prevent visual flickering.

Accomplishments that we're proud of

We are incredibly proud of architecting a highly secure, completely XML-free programmatic user dashboard that delivers instantaneous feedback while maintaining a minimal local footprint. We successfully achieved absolute edge-computing autonomy, ensuring that the entire detection, verification, and overlay interception pipeline operates entirely on-device with zero external server or cloud processing dependencies to protect user data privacy. Furthermore, creating a fully functioning, compiled binary that securely handles bilingual fallback audio alerting engines and robust programmatic input-blocking windows within a tight hackathon timeline is a monumental victory for our team.

What we learned

This project provided our team with profound insights into advanced Android OS internals, thread-safe memory management pipelines, and defensive security modeling. We deepened our proficiency in balancing foreground runtime safety permissions, working intensively with complex platform modules like AppOpsManager, custom vector animations, and SharedPreferences flag caching states. Most importantly, we mastered the art of managing long-running background tasks with high-priority UI updates, learning how to engineer automated teardown sequences that fully release system window managers, media players, and active coroutine scopes back to the operating system cleanly.

What's next for Kavach-UPI: Remote Fraud Security Shield

Moving forward, our immediate roadmap targets evolving Kavach-UPI from a standalone security application into an enterprise-ready, self-protecting software development kit (SDK). Phase one will focus on introducing TensorFlow Lite touch-velocity heuristics to analyze physical tap-sizes, pressure, and coordinate deviations, effectively distinguishing human touch inputs from robotic or scripted remote-control coordinates. Later phases involve building a native C++ NDK abstraction layer to inspect device framebuffers directly for hardware capture bypasses, ultimately creating an SDK that merchant and banking platforms can bundle inside their apps to gain native, system-level threat intelligence without requiring global accessibility permissions.