It starts with a simple call, a message, a popup — but it ends with a potentially life-changing loss. It has now become a dangerous enough threat that Google has updated Android to prevent its users becoming victims. There are many warnings about the apps you should not install onto your smartphone, tablet or laptop, and man times there are nuances around how to tell for sue if an app is safe or not. This is much simpler — in this instance, you should never install these apps.
The FBI has dubbed this threat “the Phantom Hacker,” and it has made the news again this week, with the bureau warning that “it’s growing rapidly” and that “scammers do not discriminate against anyone — they want money from anyone they can take it from.” As I reported some weeks ago, it is also an international threat and is proving frighteningly compelling for scammers to redouble their efforts to target more people, as the cash keeps rolling in.
The concept of operations is simple, as the FBI explains. “Scammers impersonate bank representatives to convince victims that hackers have infiltrated their financial account. Victims are urged to move their money fast to protect their assets. In reality, there was never a hacker, and the money that was wired is now fully controlled by the scammer.”
There are variations on this theme, as you’d expect. We see attacks from scammers claiming to be technical support reps come up regularly. But the most effective attack is the banking attack. You will likely end up speaking to a convincing albeit fake bank rep who helps you move your cash from the “hacked” account to a safe new account, to stop fraudulent transactions being completed to steal your money. You are told that this is urgent and is happening in real time, giving you no time to think. In reality, you are moving your money to an account controlled by the scammer.
While these attacks might just require you to approve a transaction within your banking app, many of the calls “direct the victim to download a software program allowing the scammer remote access to the victim’s computer.” You’re told this is to stop the hacker in their tracks — the hacker that does not exist of course. “The scammer requests the victim open their financial accounts to determine whether there have been any unauthorized charges – a tactic to allow the scammer to determine which financial account is most lucrative for targeting. The scammer informs the victim they will receive a call from that financial institution’s fraud department with further instructions.”
The rules to staying safe are stupidly simple.
- Never install an app when a supposed technical support or banking individual who has reached out to you sends a link or points you to a website.
- Your bank or credit card company will never call and ask for security credentials. If one does, you always have the right to call them back via the usual channels to ensure they work for the institution they claim.
- Never ever move money anywhere on the say-so of someone who has reached out to you by phone. This is never going to be a real solution. If they work for the bank as they say, they can stop the transaction—think it through.
Google has added scam call protection into its latest Android OS that can protect you in multiple ways. It can deploy on-device AI to listen in to calls and flag when it seems too be a scam — for example, the supposed banking rep asking you to make a transaction. And from app perspective, as Android Authority explains, it will “prevent users from disabling Google Play Protect during voice calls to prevent malefactors from tricking users into installing malicious apps on their devices.”
Absent those updates, you must never, ever install an app on your phone, table or laptop if you’ve been asked to do so by a tech support or banking rep. The only exception is when you have reached out to tech or product support using the publicly advertised channels and they ask you to use an app to send photos or run a live video link or diagnose a system fault. But you must ensure you have reached out to them and this is not from any kind of incoming contact.
The FBI’s full advice to keep Phantom Hackers at bay is as below; if you think you have been a victim of any such crime you can report this to the FBI’s Internet Crime Complaint Center (IC3) which you can find at www.ic3.gov.
- Do not download software at the request of an unknown individual who contacted you.
- Do not click on unsolicited pop-ups, links sent via text messages, email links, or attachments.
- Do not contact the telephone number provided in a pop-up, text, or email.
- Do not allow an unknown individual who contacted you to have control of your computer.
