Quick answer. Put the phone on airplane mode in the next 60 seconds. Then boot into Safe Mode, uninstall the suspicious app (and any “AnyDesk”, “TeamViewer”, “QuickSupport” or unknown installer that came with it), revoke its accessibility service if it resists, and call your bank's 24×7 fraud line to freeze cards and UPI. Dial 1930 to lodge a cyber complaint. Change your bank app password from a clean device, not the infected phone. Do not factory-reset until the bank has confirmed the freeze.
You probably found this page because a banking SMS just landed that you did not expect, or because a relative phoned to say “I installed an app and now the app store says my phone is compromised”. This guide is written for that exact 30-minute window. The order of steps matters more than any single step. Work through it from the top.
A phishing SMS asks you to type a password, you can refuse. A fake app, once installed and granted the wrong permissions, can read your screen, type into your banking app, accept OTPs from notifications, and hide its own icon. RBI, CERT-In and the I4C cybercrime unit have flagged this pattern repeatedly through 2024-2026. The NCRP portal has logged tens of thousands of “remote access” fraud complaints in the last 18 months alone.
The five families of fake apps you will encounter:
The damage path is the same in each case: the app obtains accessibility service access, SMS read access, or screen-overlay permission. Once it has any one of those, it can quietly drain a bank account inside ten minutes. This is why we treat every minute as urgent.
Before you read another word, do these three things on the affected phone:
Airplane mode is the single most powerful defensive move you have. A fake app cannot exfiltrate, cannot accept push OTPs, cannot talk to its command server, and cannot relay anything to the attacker while the radios are off. Keep airplane mode on until step 6.
Read the whole plan once, then start at step 1. Do not skip steps even if you think a step does not apply.
Open Settings → Apps (Android) or Settings → General → iPhone Storage (iOS) and scroll the full list. You are looking for:
Take a screenshot of each suspicious entry. You will need the package name later for the cyber complaint.
Some fake apps refuse to uninstall by trapping the back-button using their accessibility service. You have to disarm them first.
Safe Mode disables every third-party app at boot. Even an app that has hidden its icon and intercepted button taps will be inert in Safe Mode. The exact key combination differs by phone:
In Safe Mode, the screen will show a “Safe mode” watermark at the bottom. Open Settings → Apps → All apps, find each suspicious entry, tap Uninstall. If “Uninstall” is greyed out, the app still has device-admin rights, go back to step 2 and disable them. If a system-style fake app says “App installed by your administrator”, remove the admin policy first in Settings → Security → Device admin apps.
Reboot normally only after every flagged app is gone.
Use a second device (a spouse's phone, a parent's phone, a laptop), not the infected one. From the clean device, call your bank's 24×7 fraud number. Headline numbers as of 2026: SBI 1800 1111 09 / 1800 425 3800, HDFC 1800 258 6161, ICICI 1800 1080, Axis 1860 419 5555, PNB 1800 180 2222, Bank of Baroda 1800 5700, Kotak 1860 266 2666, Union Bank 1800 22 22 44.
Tell the operator: “I have unknowingly installed a fake app on my phone. Please freeze all debit and credit cards, disable UPI, disable net-banking and block my registered mobile number for OTP delivery pending verification. I will visit the branch in person to re-enable.” Note the service request number. Email the same instruction to the bank's grievance address as a paper trail (template at the end of this article).
If the bank refuses to freeze without an FIR, push back. The Reserve Bank of India's Customer Protection Circular DBR.No.Leg.BC.78/09.07.005/2017-18, reinforced by the Master Direction on Digital Payment Security Controls 2021, requires banks to act on a reported compromise immediately and apply the zero-liability test where the breach was not the customer's fault.
If any money has already moved or if the attacker had remote-access time on your phone (even without a confirmed debit yet), dial 1930 from the clean device. This is the National Cyber Crime Helpline run by I4C. The operator can request a temporary lien on the beneficiary account if your money was already routed. Keep your bank account number, the time of installation, and a one-line description ready.
After the call, file the written complaint at https://cybercrime.gov.in/. Choose category “Online Financial Fraud” if money moved, or “Other Cyber Crime → Suspicious App / Spyware” if no money moved yet. Upload the screenshots from step 1. Keep the NCRP acknowledgement number.
For a full minute-by-minute helpline script, jump to the 1930 helpline script. For the legal mechanics of the bank freeze, see how a bank freezes a cyber-fraud beneficiary account.
Now the bank is locked down and the cyber complaint is in. You can come off airplane mode on the affected phone, but cautiously:
If money was lost, plan for a factory reset after the bank investigation closes (not before, because the forensic team or the cyber cell may need the evidence on the device). When you do reset, do not restore from the cloud backup until the cyber cell has confirmed it is clean. A poisoned backup will simply reinstall the fake app.
If the attacker had any window of access, assume they harvested your contacts, OTPs and SIM details. Visit a service-provider store within 24 hours and ask for an SIM lock with a personal unlock key (PUK). Optional: trigger a SIM swap with KYC re-verification so any cloned SIM the attacker may have provisioned is killed. The full process is at recover a stopped or swapped SIM.
The phone IS the evidence. Preserve these before any reset:
Email these to yourself as a single captioned PDF before any reset. Many victims lose their case at this step.
The Indian system is multi-channel by design. File on the relevant channels in this order:
The legal handles:
You should always file the NCRP complaint. You additionally need an FIR at a police station or cyber-crime cell when any of these is true:
Go to the cyber-crime station nearest you, not the one nearest the fraudster, jurisdiction is now decided by the victim's location for cyber offences. Carry every item from the evidence checklist. Ask for a certified copy of the FIR under §173(2) BNSS, you will need it for bank, insurance and any RTI follow-ups.
If the cyber cell refuses to register the FIR, file an RTI on the police station seeking the General Diary entry and the station-house officer's reasons in writing. The complete playbook is at the citizen RTI playbook. RTI is not for fishing, it is for accountability after a refusal.
Copy this template into your email, fill the bracketed fields, send to the bank's grievance address (printed inside the bank app under “Help” and on the bank's official website). Always email even after a phone call, the phone call leaves no paper trail.
To: grievance@[yourbank].co.in Cc: nodalofficer@[yourbank].co.in Subject: URGENT: Fraud-suspect app installed on registered mobile - freeze all channels - account ending [last 4 digits] Sir/Madam, I am the registered account holder of savings/current account ending [last 4 digits] linked to mobile [10-digit number]. At approximately [HH:MM IST] on [DD MMM 2026] I unknowingly installed a suspicious app on my phone (package name [com.example.fakeapp], install source [Play / sideload / WhatsApp link]). Based on the indicators described below, I believe my UPI, debit card, credit card and net-banking channels are at imminent risk. I have placed the device on airplane mode and uninstalled the app via Safe Mode. I have not yet performed a factory reset, as I am preserving the device as evidence. I request the bank, under the Master Direction on Digital Payment Security Controls 2021 and the customer-protection circular DBR.No.Leg.BC.78/09.07.005/2017-18, to: 1. Immediately freeze all debit and credit cards on the account 2. Disable UPI on all VPAs linked to this account 3. Disable internet banking and mobile banking access pending in-branch verification 4. Block OTP delivery on the registered mobile number for the next 72 hours 5. Apply a hold on any pending high-value transactions in the last 24 hours 6. Acknowledge this email within 24 hours with a complaint reference number The relevant cybercrime complaint number is [NCRP ack number] and the 1930 call reference is [1930 reference]. I have also filed the suspicious-communication report on Sanchar Saathi / Chakshu (reference [Chakshu ref]). If money has been debited, I am invoking the zero-liability framework. The breach falls within "third-party breach where the deficiency lies neither with the bank nor with the customer" (RBI definition) and I am notifying you within the maximum window prescribed. Please confirm in writing the actions taken and the timeline. Yours faithfully, [Full name] [Account holder] [Date] [Place]
Send a copy to your own personal email and save the read-receipt. If the bank does not respond within 24 hours, forward the same email to the bank's Principal Nodal Officer (address is on the bank website under “Customer Grievance Redressal”), copying the RBI CMS portal address from https://cms.rbi.org.in/.
For the full bank-freeze legal mechanics, see the bank-freeze process and the golden-hour zero-liability rule. If a lien has already been placed on your account because you were the receiving end of a separate fraud, the page how to get a bank lien removed explains the unfreeze route. The acknowledgement-decoding helper sits at NCRP acknowledgement and bank-lien decoder.
Case study: Pune homemaker, March 2026. A 54-year-old in Pune received a WhatsApp APK titled “Maharashtra Light Bill Helper”. She installed it. Within 12 minutes the app requested accessibility permission, granted as habit. Within 40 minutes ₹1,87,400 left her savings account in three UPI transfers. She noticed the debit SMS and called her son. He walked her through airplane mode, Safe Mode uninstall, then dialled 1930 from his own phone with her account details. 1930 placed a beneficiary lien at minute 56. The receiving bank reversed ₹1,42,000 within 9 days under zero-liability. The remaining ₹45,400 had been ATM-withdrawn before the lien and remains under FIR investigation. Total recovery: 76%. Time from install to bank freeze: 1 hour 4 minutes. The household kept the phone unwiped for three weeks so the cyber cell could extract the APK. Family details are kept private at their request.
The two takeaways: speed in the first hour, and refusal to factory-reset before evidence capture.
If an app asks for any two of these on first launch, treat it as malicious until proven otherwise: accessibility service, display over other apps, SMS read and send, notification access, device admin, install unknown apps, contacts and call logs, all-files storage access, or run in background / ignore battery optimisation. A legitimate bank app asks for exactly one (SMS, for OTP autofill) and says so upfront. Government apps like DigiLocker, mParivahan or IRCTC will not ask for accessibility or display-over-other-apps. The deep dive on each permission is at app permissions: camera, contacts, SMS, location explained.
If you tapped “Sign in with Google” or “Sign in with Apple” inside the fake app, revoke the OAuth permission at https://myaccount.google.com/permissions or via Apple ID → Sign in with Apple, sign out of all sessions, and inspect Gmail forwarding rules (attackers often plant a silent forward to siphon OTPs from email). Full recovery routes are at recover a locked Google, Apple, Meta or Microsoft account.
Probably not. Many fake apps install a second-stage payload that survives the visible app's uninstall, especially on rooted Android or on phones with install unknown apps turned on. Run Play Protect and confirm with a Safe Mode reboot that no unfamiliar app remains. If money moved at any point, still file the NCRP complaint, the digital trail does not vanish when the icon vanishes.
Yes. Many fake apps run a background service the moment they are installed, especially those with accept install permissions flagged. They will exfiltrate contacts, SMS history and stored photos without ever showing a UI. Airplane mode is the only one-tap kill switch you have.
Not until the bank acknowledges your freeze in writing and either the cyber cell has copied the evidence off the device or has formally said they do not need it. The phone is your single best piece of evidence. Reset destroys it. After clearance, do reset, and choose “Set up as new” not “Restore from backup”.
Yes. No bank, anywhere, ever asks you to install AnyDesk, TeamViewer, QuickSupport or any remote-control app to verify anything. This is one of the single most common modus operandi flagged by RBI's “BE(A)WARE” booklet and reissued in CERT-In advisories every quarter. Treat it as confirmed fraud: airplane mode, uninstall, call bank, dial 1930. The fact that the caller knew your name or last four digits is not proof they are the bank, that data is leaked routinely.
This is the fake-loan-app blackmail pattern, covered by BNS §308 (extortion), §351 (criminal intimidation) and IT Act §66E (privacy). Do not pay, payment escalates demands. Keep message screenshots, file an FIR at the cyber cell, report the calling number on Sanchar Saathi, block the number, and proactively message your contacts about what they may receive. MHA's 2024 advisory confirms the police are equipped to handle the disclosure side.
Not automatically. The Reserve Bank's zero-liability framework requires the customer to notify the bank within three working days of the unauthorised transaction. If you do, and the breach is found to be a third-party breach where neither bank nor customer was negligent, the customer's liability is zero. If you notify between four and seven working days, your liability is capped at ₹10,000-₹25,000 depending on the account type. After seven working days, the bank's internal policy decides. Speed is everything. The mechanics are explained at the golden-hour zero-liability rule.
You need to worry about fake configuration profiles, fake “Sign in with Apple” prompts inside web pages, fake App Store listings (Apple has removed thousands of fake bank apps but a few slip in), and fake TestFlight builds shared by link. iOS does not allow sideloading APKs the way Android does, but a malicious Safari profile or a phished Apple ID gives the attacker enough leverage. Steps 0, 2, 4, 5 of the plan apply identically. The iOS-specific cleanup is in step 2 (remove unknown configuration profile under Settings → General → VPN & Device Management).
Sort the app list by install date (Settings → Apps → Sort → “First installed”) and check the install source for each app from the last week. Run Play Protect. If still inconclusive, boot into Safe Mode, if the weird behaviour stops, a third-party app is the cause and you are looking at the right list. As a last resort, take the phone to a registered service centre and ask for a logcat extract under formal complaint.
The bank will argue that reading out an OTP is a customer-side breach, which moves you from zero-liability to limited-liability. The counter-argument: you were deceived by an attacker impersonating the bank using cheating by personation (BNS §319 + IT Act §66D). Banks and the RBI Ombudsman have repeatedly held that social-engineered OTP disclosure under impersonation is a third-party breach where the customer's negligence is mitigated by the deception. File the NCRP and the bank complaint, and if the bank denies the refund, file with the Banking Ombudsman under the Integrated Ombudsman Scheme 2021. Many ombudsman orders have gone in the customer's favour since 2023.
Five permanent settings on the affected phone, applied once, hold for years: turn off Install unknown apps for every source under Settings → Security; keep Play Protect enabled and scheduled; review Accessibility services monthly and leave only the apps that genuinely need it (TalkBack, password managers); review Notification access every quarter; and inside your bank app, enable per-day and per-beneficiary transaction limits so any single fraud is capped. Tell every family member about steps 0 through 7. The single biggest predictor of “Will this person get caught” is whether they have read a guide like this one before the call.
The site's auto-schema layer (`/static/js/schema-auto.js`) reads the `==== Q ====` H4 headings and emits a valid `FAQPage` JSON-LD into the rendered head. Do not paste inline JSON-LD, it renders as visible code.
Editorial illustration, 1200x630, flat vector style, muted indigo and saffron palette. A smartphone in the centre, screen showing a generic banking app icon with a thin warning ring around it. Behind the phone, a faint silhouette of a hooded figure receding into a grid pattern of permission toggles (accessibility, SMS, overlay). Top-right corner: an airplane-mode icon glowing softly. Bottom-left: a small lock icon over a generic bank card silhouette. No real bank logos. No real person likenesses. No text on the image. Style: calm, instructional, public-information-poster feel, not horror. Slight grain for a print-poster quality.
This guide is published by the RTI Wiki editorial team for general public education. It is not legal advice. For your specific situation, consult a qualified lawyer or a registered cyber-crime cell.