The most important phone security settings are a strong screen lock, automatic system updates, installing apps only from the official store, and refusing special permissions such as accessibility, screen sharing or device administrator to apps you do not fully trust. On Android, keep installation from unknown sources turned off, because fake apps sent as APK files through chat messages are a common way scammers take control of phones and banking apps.
If you have already installed a suspicious app and granted it permissions, act quickly: disconnect the phone from the internet, call your bank from another phone using the official number, and get help to remove the app or reset the device before using banking again.
Why the phone is now the main target
For many people in Vietnam, the phone holds almost everything: banking apps, e-wallets, chat history, photos of ID documents, email, social accounts and the SIM that receives verification codes. Whoever controls the phone often controls the money.
Attackers know that breaking the security of a modern phone directly is hard. So most attacks aim at the person instead: convincing them to install something, grant a permission or share their screen. Once that happens, the phone's own security works for the attacker, because the actions look like they come from the owner.
A common pattern is a message or call claiming to be from an official body, a utility company or a delivery service, followed by a link to "install the app to complete your procedure". The link downloads an APK file, the installation format for Android apps, outside the official store. The fake app then asks for powerful permissions.
The good news is that a few settings and habits block most of these attacks, even when the person is tricked into clicking a link. This article focuses on those technical defences.
Settings every phone should have
A strong screen lock. A six-digit or longer PIN, or a password, plus fingerprint or face unlock for convenience. Avoid birthdays, repeated digits and simple patterns.
Automatic system and app updates. Updates close security holes that attackers already know about. Replace phones that no longer receive security updates.
Official app stores only. On Android, keep "install unknown apps" switched off for browsers and chat apps. On iPhone, avoid installing profiles or certificates sent by strangers.
Built-in malware scanning on. Android phones include store-based app scanning; leave it on and pay attention to its warnings.
Hide sensitive content on the lock screen. Set notifications to hide message content when locked, so verification codes are not readable by anyone holding the phone.
SIM PIN. A PIN on the SIM card prevents a thief from moving it to another phone to receive your codes. Keep the PUK code from your operator safe.
Find and erase your device. Turn on the platform's find-my-device feature so you can lock or erase a lost phone remotely.
Encrypted backups and account recovery. Make sure your platform account has two-factor authentication and current recovery details.
Permissions that should make you stop and think
Most apps need ordinary permissions such as camera or location. A few permissions give near-total control and are the ones scam apps ask for.
| Permission | What it allows | Legitimate uses | Red flag when |
|---|---|---|---|
| Accessibility service | Read everything on screen and tap buttons on your behalf | Screen readers and tools for people with disabilities | Any app installed from a link asks for it |
| Screen sharing or remote control | Someone else sees or controls your screen live | Support from a known technician or family member | A stranger on the phone asks you to install or open it |
| Device administrator | Hard-to-remove app with power to lock or wipe | Company device management | An unknown app requests it on a personal phone |
| Read SMS | See text messages including verification codes | Default messaging app | A non-messaging app asks for it |
| Display over other apps | Draw windows on top of other apps | Chat bubbles, screen filters | Combined with accessibility in an unknown app |
| Install other apps | Download and install further apps | App stores, file managers you chose | A browser or chat app asks after you tapped a link |
Some banking apps now warn or refuse to work when risky permissions or remote control apps are active. Take those warnings seriously rather than finding ways around them.
What to do if you installed a suspicious app
Speed matters most when banking apps are on the phone. Do not wait to be sure.
- Turn on airplane mode or switch off mobile data and Wi-Fi. This cuts the attacker's connection to the phone.
- Call your bank from another phone. Use the number on your card or the bank's official website, ask them to lock online banking and check for transactions.
- Report to the police. Especially if money has moved. Keep screenshots of messages, links and phone numbers if you can do so safely.
- Remove the app and its special permissions. Check accessibility settings and device administrator settings first, then uninstall. If it will not uninstall, get help.
- Consider a factory reset. If you are unsure what the app did, a full reset after backing up photos and contacts is the safest option. Do not restore apps you do not recognise.
- Change important passwords from a clean device. Email, platform account and social accounts, then check recovery details.
If you help an older relative through this, stay calm and avoid blame. Scams are designed by professionals, and people who feel ashamed tend to hide the next incident.
Protecting older relatives without taking over their phone
Older parents and grandparents are frequent targets because they may be less familiar with how apps are normally installed. But taking their phone away or locking everything down often backfires; they simply ask someone else for help, sometimes a stranger.
A better approach is to set up the protective settings with them: screen lock, updates, unknown sources off, notifications hidden on the lock screen. Explain one simple rule rather than a long list: real organisations do not ask you to install apps from a link or to share your screen.
Agree on a family habit. Before installing anything someone asked them to, they call a named family member. Make that call easy and never mocked. A five-minute call costs nothing compared with an emptied account.
Check their phone together every few months, looking at installed apps and accessibility settings. Treat it as routine maintenance, like checking the motorbike tyres, not as an inspection.
Frequently asked questions
What is an APK file?
An APK is the installation file format for Android apps. Apps from the official store are installed safely in the background; APK files sent through links or chat bypass those checks and are a common way to spread fake apps.
Are iPhones safe from fake apps?
iPhones make installing apps outside the official store harder, but scammers may still ask you to install profiles, use screen sharing or enter passwords on fake websites. The same rule applies: do not follow installation instructions from strangers.
Why do scam apps want accessibility permission?
Because it lets them read the screen and press buttons as if they were you, including inside banking apps. Legitimate apps that need it are rare and usually designed for people with disabilities.
Do I need antivirus on my phone?
For most people, keeping the built-in protection on, updating and installing only from official stores is enough. Be wary of "cleaner" or "booster" apps, which are often unnecessary and sometimes harmful.
Can someone control my phone through a phone call alone?
A call alone cannot take control. The danger comes when the caller convinces you to install an app, share your screen or read out a code. Hang up and call the organisation back using its official number.
