Isolate your phone after an APK scam

Why isolating the phone comes before anything else

An APK scam works by installing an app that can watch your screen, including notifications and one-time passwords. As long as the phone stays connected to the internet, that app can keep sending out what it sees.

Isolating the phone means cutting that connection immediately, before you try to clean it up or work out how much damage was done. This single action stops the situation from getting worse while you handle the rest.

Speed matters more than order here. Do this before calling anyone or checking any account.

Cut the connection first

Switch the phone to flight mode, or manually turn off mobile data and Wi-Fi, so the app can no longer send or receive anything. Do this before you try to uninstall the app or investigate what it did.

Avoid using the phone’s banking apps, email, or any account login while it is still connected. If you need to check something urgently, use a different, trusted device instead.

Do not simply lock the screen and assume it is safe. A malicious app with the right permissions can keep working in the background even while the phone is locked.

Do not use the phone for banking until it is checked

Once the phone is offline, resist the urge to use it for anything sensitive, even briefly. Treat every account you have opened on that device as potentially exposed until it is confirmed clean.

From a separate, clean device, change the passwords for your banking, email, and any account that shared a password with them. Read what to do if the wider account has been taken over for the fuller checklist.

If a transaction has already gone through, read how a bank recall works to understand what your bank can still try.

Reconnect only after a reset or a check

Uninstall the suspicious app once you can do so safely, though uninstalling alone does not guarantee everything it accessed is undone. A factory reset is the more reliable option if you are not certain the device is fully clean.

Only reconnect the phone to the internet, and only log back into banking or email on it, after it has been reset or properly checked. This protects the accounts you have just secured from being exposed again.

What to do next

Watch your accounts closely for the next few weeks, since some access can be used quietly before a larger attempt is made. Report anything unfamiliar to your bank immediately.

For the fuller picture of how this scam works and what else to check, read the APK scam overview.