  Mobile payments have increased significantly in the recent years and
one-to-one money transfers are offered by a wide variety of smartphone
applications. These applications usually support scan-and-pay -- a technique
that allows a payer to easily scan the destination address of the payment
directly from the payee's smartphone screen. This technique is pervasive
because it does not require any particular hardware, only the camera, which is
present on all modern smartphones. However, in this work we show that a
malicious application can exploit the overlay feature on Android to compromise
the integrity of transactions that make use of the scan-and-pay technique. We
implement Malview, a proof-of-concept malicious application that runs in the
background on the payee's smartphone and show that it succeeds in redirecting
payments to a malicious wallet. We analyze the weaknesses of the current
defense mechanisms and discuss possible countermeasures against the attack.
