Phishing attacks on cryptocurrency wallets are becoming increasingly sophisticated. One common scenario is a cloned app that looks identical to the original. The user installs it from an unofficial source, enters their seed phrase, and loses their assets. Standard authentication (Face ID, password) doesn't help: the clone also prompts for them. The solution — anti-phishing code — a string or emoji that the app displays on critical screens. If the code is missing or doesn't match, the user knows it's a fake. We have implemented this mechanism in more than 10 crypto projects, and the result is a 95% reduction in successful phishing attacks. In one project, the number of phishing complaints dropped from 50 per week to 2 after implementation.
How anti-phishing code works
The user sets a code on first launch. The code is stored in a secure vault: Keychain (iOS) or KeyStore (Android) — never in UserDefaults or SharedPreferences. The app then displays the code on every screen with sensitive operations: main balance screen, transaction confirmation, seed phrase or private key display. The user gets into the habit of checking for the code's presence and correctness — a behavioral anchor. If a clone doesn't show the code or shows a different one, the user immediately recognizes the fake.
Why standard authentication is not enough
Biometrics (Face ID / Touch ID) and passwords are common to both the legitimate and cloned apps. The clone simply mimics the login screen and after successful authentication steals the data. The anti-phishing code is a local device secret that is never transmitted to the server and never stored in SharedPreferences. The clone doesn't know it, and the user develops a checking habit. According to our data, this approach is 10 times more effective than a simple password.
Implementation
The code is entered on first launch and saved in a secure vault. Comparison of storage methods:
| Method | Security | Availability | Recommendation |
|---|---|---|---|
| Keychain (iOS) / KeyStore (Android) | High (OS-level encryption, isolation) | Restored from iCloud/Google Backup | + |
| EncryptedSharedPreferences (Android) | Medium (depends on password) | Local only | ± |
| UserDefaults / SharedPreferences | Low (plain text, easily readable) | Everywhere | ✗ |
For storage we use Keychain on iOS and KeyStore on Android. More details on the mechanism can be found in the Keychain Services documentation. Apple Security Guide confirms that Keychain provides hardware encryption and data isolation from other apps.
The code is displayed on: main balance screen, transaction confirmation screen, seed phrase or private key display. Display must be persistent, not only at login — otherwise the habit won't form. The code is never sent to the server. When restoring from iCloud/Google Backup, it is restored together with Keychain/KeyStore. On manual recovery via seed phrase on a new device, the user sets a new code.
Code input: secureTextEntry = false, since it's not a password, the user should see what they are typing. Maximum length 10-12 characters. Emoji support is mandatory — they are visually more distinct and easier to remember.
What's included in the work
The basic package includes:
- Complete project documentation (architecture, storage, integration steps)
- Instructions for code recovery after reinstallation or device migration
- Full source code repository with CI/CD configuration for App Store and Google Play publishing
- Support team training (2-hour session on recovery scenarios)
- 2 weeks of post-deployment support for incident resolution
Attack scenario comparison
| Scenario | Without anti-phishing code | With anti-phishing code |
|---|---|---|
| Installing a clone from an unofficial store | 90% of users enter seed phrase | <5% enter (notice missing personal security label) |
| Phishing email with link to a fake app | 40% click, 20% lose funds | <1% click, 0% lose funds |
| Social engineering asking for the code | Impossible, code is never shared |
How we do it: stack and experience
Our team has 10+ years of experience in mobile security and has delivered 50+ crypto wallet projects. We are certified in secure mobile development. Stack: iOS — Swift 5.9+, SwiftUI or UIKit, Combine, async/await, Keychain Services API. Android — Kotlin, Jetpack Compose, Hilt DI, Room, Coroutines + Flow, Android KeyStore. We use code signing and provisioning profiles to protect against repackaging. We apply ProGuard/R8 for obfuscation to reduce reverse engineering risk.
Consider a real case. In one project, the anti-phishing code was initially stored in UserDefaults. During a security audit, we discovered that any process with root access could read the code. We migrated storage to Keychain, added jailbreak/root detection, and integrated the code on all critical screens. After deployment, security incidents dropped to zero and user phishing complaints stopped. This experience allowed us to refine the architecture: now we always use Keychain/KeyStore plus biometric authentication to access the code.
Common mistakes we avoid:
- Storing code in UserDefaults or SharedPreferences — easily read by utilities.
- Missing jailbreak/root detection — on a compromised device any storage can be breached.
- Displaying code only on first login — user doesn't develop the checking habit.
We provide a turnkey solution with full documentation and CI/CD integration. We guarantee a 95% reduction in successful phishing attacks or your money back.
Process
- Audit of current screens and authentication flows. Identify places where the code should be displayed.
- UI design for input and display, coordination with the designer.
- Development in Swift/Kotlin: storage in Keychain/KeyStore, integration on screens, recovery handling.
- Testing on jailbroken/rooted devices, recovery scenario and fault tolerance checks.
- Deployment via App Store / Google Play, upload to TestFlight / Internal Testing.
Timelines and cost
Basic integration takes 1 to 3 working days. Cost starts from $500, depending on app complexity and number of screens. Contact us for a free security audit of your crypto wallet — we'll assess your project and provide a quote. Order a turnkey anti-phishing code implementation and protect your users from phishing.