Closing the "Shoulder-Surfing" loophole by enforcing Class 3 biometrics and Keystore invalidation in modern Android architecture. In  Part 6 , we mastered the networking lifecycle to ensure our sessions are resilient. But there is a final, physical threat that keeps security architects awake at night:  The “Shoulder-Surfing” or Stolen Phone Scenario. If an attacker learns a user’s PIN and then snatches the device while it’s unlocked, they have  full user-level control of the device . In this state, a standard “is device guarded” check is no longer enough for high-stakes operations. Today, we implement the final frontier of mobile defense:  The Identity Check Pattern. The Mental Model:  Session Authentication $\neq$ Intent Authentication. Being “logged in” is not the same as “authorizing this specific ₹5,00,000 transfer.” ⚡  TL;DR The Problem:  An unlocked device is a compromised device once the PIN is leaked — a common real-world  fraud vec...