Insights · Kipkirui Tanui
The Call and the Code
A working paper on withholding one-time passcodes during unverified voice calls. Subiri is the on-phone interruption we can ship today. The durable fix belongs in the operating system.
What we are asking platforms to do
SMS one-time codes still fail the same way: a caller impersonating a bank, sacco, or telco coaches the customer to read a genuine code aloud. The cryptography holds. The person on the phone does not.
The moment is observable on the device: a voice call is active, and an OTP has just arrived. We propose that the operating system withhold the digits from the notification, lock screen, and inbox for that overlap; keep same-device autofill so a legitimate login on that phone still works; ask one factual question — Did you call them, or did they call you? — then offer a verified callback.
We do not claim this works. We state a design, falsifiable hypotheses, and an evaluation protocol, and we invite collaboration.
Download the working paper (PDF) — The Call and the Code, Keshio Research, November 2026, draft for comment.
Why an app cannot finish this
Keshio already ships Subiri on Android: a free, opt-in interruption when a listed verification SMS arrives during a call. It never shows the digits. It cannot hide or delay the SMS. The stock inbox still has them. A coached caller can say “open your messages.”
That limit is structural. Keshio is not the default SMS app. Since Android 15, untrusted notification listeners also cannot read unredacted OTP content — a protection against malicious apps that also blocks a third-party hold. The SMS broadcast Keshio already uses for the ledger can still classify a code and discard the body. It cannot take the digits off the lock screen.
So Subiri is an interruption, not a hold. Results from it should be read as a lower bound on what a first-party, call-aware treatment could do.
What the paper specifies
- Trigger. Active call (cellular or VoIP in communication audio mode) with an unverified counterpart, plus an arriving OTP. No call audio is captured.
- Hold. Digits are not rendered. Autofill on the same device continues.
- Release. A provenance question, a short delay, and an exemption for an outgoing call to a verified institutional number.
- Redirect. After the call, a card keyed to the OTP sender ID, with numbers only from a signed catalog — never from the SMS or the caller.
The paper reviews nearby platform work (Android in-call protections, OTP redaction, iOS AutoFill and Call Screening), states the gap we found in a bounded search, lists adversary adaptations, and describes a randomised simulated-vishing study plus field telemetry.
Who we need
Keshio is a small team without a research budget. We contribute the hypothesis, the design, Subiri as a path to on-device counts, and a catalog of partner institutions. We are looking for:
- An academic principal investigator to lead the study and obtain ethics approval.
- A research funder. Platform-vendor scam-research awards and consumer-protection programmes are a natural fit.
- A platform sponsor to test the hold on a device or in a first-party build.
- An institutional partner to supply sender-level fraud-report data for the same period, and to reorder the OTP SMS they already send.
Results should be published whether or not they favour the mechanism.
Write to [email protected] with the subject Call and the Code.