Lock-screen phishing is a deceptive screen shown while a phone or tablet is locked, designed to look like a legitimate unlock prompt, security warning, or account page. The goal is to make the user enter a PIN, password, or one-time code into attacker-controlled UI. Unlike classic phishing in a browser, this tactic abuses the device’s own trust boundary: users often assume anything shown on a locked device is part of the operating system.
This matters because it can capture secrets without breaking encryption or bypassing the lock screen directly. In real attacks, malware may overlay a fake prompt, delay the real lock screen, or reuse system-like visuals to harvest credentials and approvals. Defenders look for suspicious overlays, unusual accessibility or display permissions, and unexpected screen activity on locked devices. Mobile security tools and device management policies can help detect or block apps that try to imitate lock-screen behavior.