Assume that my company is PCI DSS complaint. I want to provide a custom view (in SDK library for Android) for payment processing to merchants who sell products via their Android mobile application.
The main goal is to make payment without giving access to merchant on payment details: card number or CVV.
My view will have inputs for the card number, expire date and CVV, but mobile payments SDK should make the card data unreadable for merchant APP. All this is explained here.
If I create a custom view for this task in the SDK library, how can I make sure, that a dishonest merchant won't unwrap my library, rewrite it and catch my payment calls to web service and log security data in his database.
How can I make sure, that calls to my payment web service are really made from my custom view?