Session takeover is the unauthorized control of an active, authenticated session. Instead of stealing a password and logging in later, the attacker acts while the victim is already signed in, such as inside a banking app, email account, or admin console. Because the session is valid, the attacker may bypass normal login checks, one-time passwords, or other friction that protects first-time access.
In mobile banking attacks, session takeover often relies on malware, overlays, accessibility abuse, or remote screen control to observe the screen and steer the user’s actions in real time. This makes the fraud harder to detect than simple credential theft, because the malicious activity happens inside a trusted app session. Defenders reduce the risk with device-risk scoring, anti-overlay controls, strong session binding, step-up verification for sensitive actions, and anomaly detection for unusual taps, navigation, or screen behavior.