The trust failure I examined in Android toll-fraud reporting is the confirmation step: an OTP does not protect a purchase if malicious software on the same device can intercept or submit it. Microsoft documented Android toll-fraud workflows in which malware tried to subscribe victim
