CoachGuard 1.0.0

First public release of CoachGuard: on-device detection of coached payments (authorized push payment scams) for Android banking and fintech apps.

dependencies {
    implementation("io.github.linklow:coachguard:1.0.0")
    implementation("io.github.linklow:coachguard-links:1.0.0") // optional: phishing link check
}

Artifacts on Maven Central are signed with the key E018 4B53 8FA6 BBCF D2E6 13CF 56BA 598C 6809 FAF3.

Highlights

• Device signals without runtime permissions: cellular and VoIP calls, screen capture (Android 15+), remote-access apps and their accessibility services, untrusted accessibility services, taps through overlays, USB debugging.
• Per-user behavioral model on the device: flags payment sessions that depart from the user's own habits, such as leaving the app mid-payment and long pauses. It is learned only from low-risk sessions.
• Explainable risk score: every point of the score comes with a reason code and evidence.
• Screen protection: an optional FLAG_SECURE session mode that blacks out the payment screen in recordings, screen sharing and remote-access viewers on every Android version.
• Phishing link check (coachguard-links): an on-device, explainable classifier for links from QR codes and messages. On registered domains it has never seen, it detects 53.5% of phishing hosts at 0.66% false alarms (high level), and 76.4% of fresh OpenPhish hosts.

See the README for usage, and the model report for how the link model was trained and evaluated.

Assets

File	Description
coachguard-1.0.0.aar	Core SDK (Android 7.0+)
coachguard-links-1.0.0.aar	Optional phishing link classifier
coachguard-demo-1.0.0.apk	Demo app, for evaluation only (signed with a development key)
SHA256SUMS.txt	SHA-256 checksums of the files above