What to Do If You Installed a Suspicious App

Someone sent you an “APK” to claim a refund, a “bank KYC” app arrived by WhatsApp, or you installed a free tool from a site that turned out to be wrong. A malicious app can read messages, capture one-time codes, overlay fake screens on banking apps and watch what you type. Time matters, but so does doing things in the right order.

Is the App Actually Malicious?

Not every odd app is malware, but treat it as suspect if any of the following is true:

• You installed it from a link, chat message or website instead of the official app store, or you enabled “install unknown apps” for it
• It asked for Accessibility, Device admin, SMS, notification access, or the ability to “display over other apps” without a clear reason
• It hides its icon, has a generic name (“Update,” “Service,” “KYC”) or can’t be uninstalled
• It appeared after a call or message urging you to install something for a refund, a bank check, a prize or a delivery
• The phone now shows pop-ups, drains battery, runs hot, sends texts you didn’t write, or banking apps behave oddly

Step-by-Step on Android

1. Go offline. Turn on airplane mode, or turn off Wi-Fi and mobile data. This can limit further data leaving the phone. Don’t open the app again.
2. Use another device to protect money and accounts. From a trusted phone or computer, change your email password first, then banking, wallet and social accounts, and sign out other sessions. If you opened a banking or UPI app on the infected phone, call your bank using an official number, tell it your phone may be compromised, and ask about blocking cards, online access or UPI. If you shared a code, read what to do after sharing an OTP.
3. Check special permissions. In Settings, review Accessibility, Device admin apps, Notification access and Display over other apps. Turn off anything you don’t recognise. An app with Device admin rights must have it removed before it can be uninstalled.
4. Uninstall the app. Settings > Apps, find it, then Uninstall. If the button is greyed out or the app reinstalls, restart in Safe mode (usually by holding the power button, then pressing and holding Power off) and uninstall from there. Steps vary by manufacturer.
5. Run a scan. Open the Google Play Store, tap your profile icon, choose Play Protect and run a scan. You can also use a reputable security app from the official store.
6. Review other recent installs and permissions. Remove apps you didn’t install knowingly. Revoke SMS, contacts, camera and microphone access from apps that don’t need them. Check which apps can install other apps.
7. Turn off installing from unknown sources. Disable the “install unknown apps” permission for browsers, chat apps and file managers.
8. Reset if in doubt. If symptoms continue or the app returns, back up only photos and documents (not apps or settings), do a factory reset from Settings, and set the phone up as new rather than restoring everything. Change passwords again afterwards.

Doing a reset removes most Android malware, but it won’t reverse anything already done with your accounts or money, so the account and bank steps above matter first.

On iPhone

iPhones normally install apps only from the App Store, so malicious “apps” are rarer, but scams still use configuration profiles, fake VPNs, calendar-invite spam and fake login pages. If you installed something suspicious: delete the app, open Settings > General > VPN & Device Management and remove any profile you don’t recognise, change your Apple Account and email passwords from another device, review Subscriptions and connected apps, and update iOS. If problems continue, back up essentials and restore the iPhone through Apple’s official process.

If You Followed Instructions From a Caller

If a person told you to install the app, assume they can see or control the phone. Disconnect, then follow our guide on what to do after giving a stranger remote access. Fake support numbers are a common starting point; see Fake Customer Care Numbers.

Report and Document

Save screenshots of the message and the app’s name before you remove it, and write down what permissions you granted. Report to your national cybercrime service (cybercrime.gov.in and 1930 in India, reportfraud.ftc.gov and ic3.gov in the United States) and to the messaging platform. Our guide to preserving evidence and the first-hour checklist explain the rest.

How to Avoid It Next Time

• Install apps only from the official store and check the developer, reviews and permissions.
• Never install a file because a caller or chat message tells you to, even if it claims to be your bank or a courier.
• Keep Play Protect and system updates on.
• Be suspicious of any app that asks for Accessibility or Device admin without an obvious reason.
• Use the 10-second rule before you tap a link or file.

ScamSense can help you assess a suspicious message or link before you act, but it is an extra check and not a replacement for removing an app that is already installed.

Key Takeaways

• Go offline, protect accounts and money from another device, then clean the phone.
• Remove special permissions and uninstall via Safe mode if necessary.
• Use Play Protect, review permissions and factory reset if doubt remains.
• Report and keep a record of what was installed and what you shared.

Frequently Asked Questions

Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.