PIN harvesting is the capture of a personal identification number while the user is entering or approving it. In mobile banking and wallet attacks, malware may display a fake screen, overlay the real app, read accessibility events, or record the device screen to collect the PIN at the moment it is used. The goal is not always to crack a code offline, but to steal an active unlock or transaction-approval secret in real time.
This matters because a PIN often protects sensitive actions such as session access, payment approval, or crypto transfers. If an attacker harvests it on the device, they may bypass backend defenses that only see a valid user action. Defenses include anti-overlay controls, secure input widgets, device-integrity checks, runtime monitoring for suspicious accessibility abuse, and transaction signing or biometrics that make the PIN alone insufficient.