The present disclosure relates to verifying transactions using user devices. A client device used to complete a transaction with a server computer. The client device communicates with a user device such as a smart phone, laptop computer, or other computing device. The user device communicates with the client device and a verification server via the out-of-band communication channel. The verification server receives two or more copies of session data associated with the transaction occurring between the client device and the server computer. One copy of the session data is received from the server computer and another copy of the session data is provided by the user device. The two copies of the session data are compared by the verification server or by the user device, and mismatches are reported as suspected malicious software attacks.