How Android Failed-Unlock Detection &
Intruder Photo Capture Works

The Android Lockscreen Security Model

Android encapsulates lockscreen authentication within the core OS security subsystem (Keyguard and LockSettingsService). Third-party apps cannot simply hook into the lockscreen UI or read raw keyboard entries for security and privacy reasons.

To reliably detect when an unauthorized user enters an incorrect PIN, password, or pattern without running continuous battery-draining screen scanners, security applications utilize the official Android Device Administration (DevicePolicyManager) API.

How DeviceAdminReceiver Intercepts Failed Attempts

When you grant Device Administrator permission to IntrudEye, the app registers a specialized DeviceAdminReceiver component. Whenever the user or an intruder submits an incorrect unlock attempt on the lockscreen:

1. The Android OS Security Manager fires the ACTION_PASSWORD_FAILED broadcast intent.
2. IntrudEye's background receiver intercepts this event instantaneously, incrementing the session failure counter.
3. If the configured attempt threshold (e.g. 1, 2, or 3 attempts) is reached, IntrudEye initiates its defensive pipeline.

Silent Dual-Camera Evidence Pipeline

Once triggered, IntrudEye activates camera capture services in the background:

• Front-Facing Camera: Snaps a clear photo focused on the intruder's face looking at the screen.
• Rear-Facing Camera (Supported Devices): Captures an environmental snapshot showing the room, outdoor landscape, or surrounding objects to assist location identification.
• Zero Visual or Audible Clues: The capture pipeline operates silently without triggering screen flash or shutter audio, keeping the intruder unaware that their face has been documented.

Telemetry and Encrypted Vaulting

In parallel with photo capture, IntrudEye queries the device GPS hardware to obtain high-precision latitude/longitude coordinates and notes the exact system timestamp.

All collected evidence is encapsulated into an encrypted file record and stored inside the on-device vault. If data connectivity is active, IntrudEye dispatches the photo and coordinate bundle to your configured Telegram bot and personal Email inbox.