We are facing an issue with a malicious user who has details about how our website works. Using the developer tools in the browser, the login and subsequent APIs are studied and a mobile app is built which internally hits our APIs.

Genuine users use this mobile app, since it acts as an aggregator platform accepting user request and transforming them and hitting the genuine back end applications.

This is a risk as this mobile app has access to our data.

We have implemented certain controls in our web page to identify whether the API request is genuinely originating from our button clicks (hidden values and random numbers generated from client which will be validated by server) – but then its not fully effective.
All the client side code is visible ( even though its obfuscated ) and hence this can be mimicked by any other client interface ( Web UI / mobile app )

I believed this is a common problem and would have been addressed by applying specific controls/patterns, especially in banking/finance domain.

Kindly revert with your views to effectively address this concern

We have few controls in place to address this problem – but would like to know industry best practices around this concern, which might be already adopted by financial institutions