APK scam: what to do right now

What just happened to your phone

A message, a courier notice, or a “government” link led you to install a package (an APK file) outside the usual app store. It may have asked for permissions that looked routine, like access to notifications or the screen.

Those permissions are the real target. Once granted, the app can read what appears on your screen, including one-time passwords sent by your bank.

If your banking app now behaves strangely, shows unfamiliar transactions, or you cannot log in, treat the phone as compromised right away.

Why one installed app can take over so much

Mobile banking relies on the phone being under your control: your fingerprint, your one-time passwords, your notifications. A malicious app that can watch the screen breaks that assumption from the inside.

This is different from phishing, where a fake page tricks you into typing details. Here, the app itself is watching, which is why acting on the device matters as much as changing a password.

The goal from this point is to remove the app’s ability to watch and act, then separately recover control of each account.

The first ten minutes matter most

Switch the phone to flight mode or turn off mobile data and Wi-Fi immediately, which cuts the app off from sending or receiving anything further. Do this before you try to uninstall or investigate.

Call your bank’s fraud line from another phone to freeze your account or card, even before you are certain money has moved. Ask them to watch for unauthorised transactions while you work through the rest.

Call the National Scam Response Centre on 997 if a transfer has already gone out, since speed affects whether a receiving bank can act on it.

Getting your accounts back under your control

Once the phone is offline, uninstall the suspicious app if you can do so safely, and note its name and where you got it. From a separate, clean device, change the passwords for your banking, email, and any account that shared a password with them.

If a transaction already went through, read how a bank recall works to understand what your bank can try to reverse. A formal police report also helps if you need to dispute charges or support a bank’s investigation.

Only reconnect the affected phone to the internet after it has been factory reset or checked by someone who can confirm the app is gone.

What to do next

Watch your accounts closely for the next few weeks, since some access can be used quietly before a larger attempt is made. Report anything unfamiliar to your bank immediately rather than waiting to see if it happens again.

If you are not sure whether the phone is fully clean or which accounts were affected, account takeover walks through what to check and in what order.

Acting quickly here matters more than acting perfectly, so start with the phone offline and work outward from there.