Comment by IshKebab

7 hours ago

How does Android know if an apk that nobody has ever seen before is a payment or banking app?

You could probably restrict "risky" APIs like draw-over-other-apps, but tbh I think that would be a worse solution than just making people wait 24 hours once.