The Outlier Lab

Remote Access Tool Detection

Detecting that a customer's own trusted device is being viewed or controlled remotely during a session, the signature of tech-support, impersonation and remote-access scams.

What it measures

This signal targets a blind spot in device-based defenses: the fraud happens on the real customer's own trusted device, from their home network, often after they authenticate themselves. Indicators fall into three groups:

GroupExamples (category level)Notes
Environment stateScreen sharing or casting active; remote-desktop or remote-support software running or recently installed; OS accessibility services granted to non-assistive apps; screen overlaysMobile OSes increasingly expose some of this to apps or to platform risk verdicts
Interaction textureInput arriving in ways atypical for local touch or mouse; cursor movement without the usual micro-motion; latency patterns between screen updates and inputOverlaps with Behavioral Biometrics
Session contextAn active phone call during the session; long idle periods while "someone explains"; navigation to areas the customer never uses (transfer limits, adding payees, crypto, wire forms)Overlaps with Session Behavior Anomalies and Scam Victim Indicators

Why it matters

In a remote-access scam, the scammer (posing as tech support, the bank's fraud team, a government agency or a refund desk) gets the victim to install remote-access software or share their screen, then either moves the money directly or coaches the victim through it.

  • Losses are large and concentrated among older adults. The FBI's IC3 recorded about $1.46 billion in tech-support scam losses in 2024 and about $2.13 billion in 2025. In 2024, complainants aged 60 and over accounted for about $982 million of the tech-support losses.
  • Every traditional ATO signal looks clean: known device, home IP, correct password, OTP passed, normal geography. Without this signal the session is indistinguishable from the customer's own.
  • The money path is fast and hard to reverse: wires, instant payments, crypto purchases, gift cards, and brokerage liquidation followed by withdrawal. See Real-Time Payment Rail Fraud, Gift Card Fraud, Investment Scams (Pig Butchering).
  • Liability is shifting. Whether a remote-controlled transfer was "unauthorized" (third party at the controls) or "authorized under deception" (victim at the controls) affects error-resolution obligations. See Regulation E and Unauthorized Transfers.

By industry: neobanks and P2P apps see it at payee add and first instant transfer. Brokerages see it as a liquidation of long-held positions followed by a withdrawal to a new bank, often by older customers. Retail and gift card programs see it at high-value gift card purchases made while a call is active.

How to collect it

  • Mobile platforms are starting to help. Google's Play Integrity API includes an optional app access risk signal. From May 2025 Google also introduced in-call protections: during calls with numbers not in contacts, Android 16 blocks first-time sideloading and granting accessibility permissions, and Play Protect can't be switched off. Google piloted screen-sharing warnings in partner banking apps, first in the UK. In December 2025 it extended the warnings to US apps including Chase and Cash App, alerting users who open a participating financial app while screen sharing with an unknown caller.
  • Build app-side checks of screen-capture, overlay and accessibility state where the OS exposes them, and server-side features from session context.
  • Buy device-intelligence and behavioral-biometrics products that classify remote-control sessions, and evaluate them on your own confirmed scam cases (Vendor Selection and Evaluation).
  • Web sessions are harder: browsers expose little about other software on the machine, so interaction texture and session context carry more weight.

How to use it

  • Design for intervention. The customer is a victim in the session, so a block alone isn't enough. The best response is often a pause and a direct message ("Is someone asking you to do this?"), a hold, or an outbound call. See Payee Confirmation and Payment Friction, Customer Education and Scam Warnings and Playbook - Scam Intervention Members.
  • Raise the stakes for high-risk actions. Remote-access indicators plus new payee, limit increase, crypto purchase, wire, ACATS or liquidation is the strongest combination.
  • Correlate with contact. A recent inbound "fraud alert" call the bank never made, or support contacts asking to raise limits, strengthen the case (Customer Contact Signals).
  • Don't hand the decision back to the controller. If remote control is active, an in-session confirmation can be answered by the scammer. Use out-of-band channels.

Strengths and limitations

Strengths: one of the few signals that sees scam and device-takeover fraud on otherwise-trusted sessions; high precision when environment state is available.

Limitations:

  • Coverage depends on the OS and on what each platform exposes, and both change frequently. Web and desktop coverage are weak.
  • Scammers adapt, for example by coaching victims to act themselves rather than taking control. Detection of remote control doesn't catch a coached victim. Pair with Scam Victim Indicators.
  • Some indicators can be degraded by malware with elevated privileges; layer with server-side context.

False positives and fairness

  • Legitimate remote help: adult children helping parents, IT support at work, accessibility helpers.
  • Assistive technology that uses accessibility services by design. Distinguish assistive apps from unknown apps holding the same permission rather than treating the permission itself as bad.
  • Screen sharing for unrelated reasons (a video call open in the background).
  • Older customers will be over-represented in alerts because they are over-represented among victims. Design interventions to be respectful and protective in tone, and make sure trusted-contact paths exist (Trusted Contact and Senior Investor Holds).

Privacy and compliance considerations

  • Inspecting other apps or system state on a customer's device is sensitive. Keep it to what the OS exposes for security purposes, disclose it, and avoid collecting app inventories beyond what detection needs. See Privacy and Data Use in Fraud Prevention.
  • Platform policies restrict querying installed apps and using accessibility APIs. Align with platform rules as well as privacy law.
  • Remote-access findings are strong evidence in scam claims and SARs. Preserve them in case records (Case Documentation Standards, BSA-AML and SAR Filing).

Mechanisms it helps detect

Impersonation Scams · Authorized Push Payment (APP) Scams · Elder Financial Exploitation · Investment Scams (Pig Butchering) · Account Takeover (ATO) · Session Hijacking and Infostealers · Real-Time Payment Rail Fraud · Gift Card Fraud

Sources and further reading