Avoid Android Fraud: Suspicious Apps & APKs

• To gain access to the victim’s phone the hacker will need to create a social engineering method to get the victim to install and launch the malicious APK. Fraudsters may trick victims to install APK file in pretext of resolving payment query, etc.
• The generated APK file does not look legitimate and may be only a few KBs in size.  
• Once the APK is installed it requests a lot of permissions e.g., cameras, microphone, location, contacts, SMS, etc. This is a big red flag and if the user has installed any such application, it must be uninstalled right away.
• Such APK files are easily classified as dangerous if any antivirus is installed on the victim’s phone.
• User must pay attention to the warnings from Google Play Store that installing application from unknown and unverified sources may harm the device.
• Reboot the phone regularly and clear all the running apps in the background, so that the hacker loses connection.

Do’s

• Ensure “Install from Unknown Sources” is disabled in phone settings.
• Download trusted applications only from Google Play Store.
• Install an effective mobile anti-malware/anti-virus software on your smartphone and keep it updated.
• Always verify app permissions and grant only those permissions which have relevant context for the app’s purpose. If they seem too much, be on your guard (e.g., a flashlight app asking for access to your contacts, SMS, microphone, etc.).
• Enable automatic OS updates or download updated OS security patches regularly.
• Log out from online mobile banking or financial application as soon as you have completed your transactions. Also make sure you close the app window.

Don’ts

• Never Download third-party apps on call request from unknown person even if caller claims to be a Bank representative/customer support representative.
• Do not save Credit/Debit card image, PIN, Passwords, and other banking details on your mobile device.
• Don't allow a stranger to guide you to install a mobile app through App Store / Play store or instruct you to change the setting of your mobile.
• Do not use "jailbroken" or "rooted" devices for online banking. Jailbreaking or rooting a device (the process of breaking into the phone's built-in operating system to control it outside the vendor's original intention) exposes the device to additional malware and gains administrative or privileged access of OS.
• Do not enable autofill or save user IDs or passwords for mobile banking online.
• Avoid using unsecured Wi-Fi, public or shared networks. There may be rogue Wi-Fi access points at public places used for distributing malicious applications