You will be able to recognise the app permission requests that give away control of your phone.
You've just installed an app to order groceries. Before it opens, a pop-up appears: "To give you the best experience, please turn on accessibility access." There's a big button that takes you straight to the right page in Settings. Most people tap it, because apps ask for things all the time, and the request is phrased like a favour to you.
That tap is often the moment a phone stops belonging to its owner. In lesson 6.1, How a sideloaded app takes over your phone, you saw what malware does once it's inside. This lesson is about the doors it asks you to open, so you know which requests should stop you cold.
Most permissions are ordinary. A map app wants your location, a camera app wants the camera. Three are different. Between them they let an app see your screen, fake your screen and read your codes, which is all a scammer needs to empty an account.
Accessibility access exists for good reasons. It lets screen readers read text aloud for people who are blind or have low vision, and it lets other assistive tools control the phone for people who can't easily tap a screen. To do that, an app with accessibility access can read everything shown on your screen and perform taps and swipes on your behalf.
That's exactly what a scammer wants. With accessibility access, malware can read your banking app as you use it, see one-time passwords as they appear, and later press the buttons itself to make transfers. It can also stop you from removing it, by tapping "cancel" whenever you try to uninstall.
The rule is simple. Refuse accessibility access to anything that isn't a known accessibility tool. A grocery app, a food deal app, a cleaning company's booking app or a game has no reason to need it, however the request is worded. If an app won't work without it, the app isn't worth having.
The second permission lets an app draw on top of whatever else is on your screen. On Android it's often called display over other apps or appear on top. Legitimate uses exist, such as chat bubbles or a floating video player.
In malware, this permission is used for overlays. When you open your banking app, the malware places its own fake login screen over it, pixel for pixel. You think you're typing your password into your bank's app. You're typing it into the scammer's. Overlays can also put up a black or "updating, please wait" screen while the malware works on the real app underneath, so you don't see the transfers happening.
Very few everyday apps need this. Treat it as a warning sign unless you know exactly why the app wants it.
The third door is your messages. An app with permission to read SMS can see every one-time password your bank sends. Banks use those codes as a second check that it's really you, and malware that reads them defeats the check completely.
A close cousin is notification access, which lets an app read the notifications that pop up on your phone, and those often show message previews and codes. It can also dismiss them, which means you might not see the alert your bank sends when a new payee is added.
Your messaging app needs to read SMS. Almost nothing else does.
The pattern to watch for is a mismatch. Each of these permissions has a narrow, sensible use. The danger is when an app that has nothing to do with that use asks for it.
A shopping, food or delivery app asking for accessibility access. A booking or deal app asking to display over other apps. Any app that isn't your messaging app asking to read SMS or all notifications. An app that keeps sending you back to Settings until you agree.
Any one of those is a red flag. Two together is very close to proof. Stop, don't grant the permission, and uninstall the app.
Here is an illustration. Marcus, 29, installs an app from a link to claim a discounted seafood bundle. It immediately asks for accessibility access "to auto-fill your delivery address". He remembers that address auto-fill doesn't need to see and tap his entire screen, so he refuses, uninstalls the app and reports the ad. The app never got the access it needed, and his banking app stayed his.
Scammers sometimes call or message to talk you through granting these permissions, and they usually claim to be tech support or the shop's customer service. Nobody genuine needs to walk you through turning on accessibility access for a delivery app. The stop-and-check rule from lesson 1.3 applies the moment an app or a person asks for one of these.
You don't have to remember every app you've ever installed. Android keeps a list of which apps hold each of these permissions, usually under accessibility in Settings and under special app access for display over other apps. The exact names vary between phone brands, so if you can't find a menu, use the search bar at the top of Settings.
Some of the apps on those lists will have a good reason to be there, and some may surprise you. You'll know which is which once you've written them down.
Open your phone's settings and list every app that has accessibility access or can display over other apps.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).