CoachGuard: On-Device, Explainable Detection of Coached Payment Scams on Android

In authorized push payment (APP) scams, a fraudster talks the victim through sending money, often over a phone or VoIP call and sometimes with screen sharing or a remote-access app. Because the legitimate user authenticates the payment on their own device, passwords, one-time codes and device binding do not stop it. We present CoachGuard, an open-source Android library that looks for signs of coaching at the moment a user confirms a payment and returns an explainable risk assessment. CoachGuard combines device signals collected without runtime permissions (active calls, screen capture, remote-access tools, untrusted accessibility services, taps through overlays), a per-user behavioral baseline learned on the device, and a noisy-OR score in which every point is traced to a reason. An optional module classifies links, for example from payment QR codes, with a host-only, 8-bit quantized logistic regression. While building it, we found that a widely used phishing URL dataset can be classified with 99.75% accuracy from URL formatting alone. On a budget phone, a complete assessment takes 1.9 ms (median). CoachGuard is available on Maven Central under the Apache 2.0 license.