You log into your bank. the SMS code arrives. you copy it. you switch to the banking app. you paste it. done. in the time between you copying that code and pasting it, every app that comes to the foreground can read your clipboard. not apps running in the background. apps that become active including ones you swipe past, or that pop up a notification you tap. That's how clipboards work. they're a shared resource across every app on the device. One-time codes are the obvious ones at risk, you copy an OTP, switch apps once, the code is gone from your mind but still sitting in the clipboard. any app that opens in that window reads it. Not just OTPs. addresses, card numbers, recovery codes, passwords you copied from a password manager before pasting all of it lives in the clipboard until you copy something else or clear it. For iPhone recent iOS versions show a banner notification when an app reads your clipboard without you tapping paste. If TikTok, a game, or a shopping app triggers that banner after you copied something sensitive that app just read whatever was there. Apple added this specifically because apps were doing it silently at scale. Android is more fragmented and exposed. There are two specific permissions worth auditing: Notification access, apps with this permission can read the full text of your notifications, including OTP codes that arrive as SMS or push notifications. Go to settings → apps → special app access → notification access. Anything in there that shouldn't be reading your messages is a problem. "draw over other apps" (display over other apps): this permission lets an app place a visible layer on top of whatever you're doing. it's used legitimately by things like screen recorders and assistant apps. it's also a known path for overlay attacks: a fake UI drawn over your real banking app, capturing your password and taps before they reach the real screen.