You will be able to explain how scammers reach iPhone users and why remote access requests are dangerous on any device.
If you use an iPhone, you might have read the last two lessons with some relief. Your phone won't install an APK file, and Apple reviews the apps in its App Store. That relief is partly earned. It's also exactly what scammers count on, because they don't need malware to get into an iPhone. They need you to open the door for them.
This lesson covers how scams reach iPhone users, why a request to install a screen sharing or remote access app is dangerous on any phone or computer, and one habit that closes holes you can't see.
In Singapore, iPhones only install apps from Apple's App Store. There's no setting to allow APK-style installs from a link, so the attack in lesson 6.1, How a sideloaded app takes over your phone, mostly doesn't work. Apple also limits what one app can see of another, so an app can't quietly read your banking app's screen the way Android malware with accessibility access can.
So scammers go after the person instead of the phone. The two most common routes are ones you've met already in this course.
The first is phishing. A message with a link to a fake login page, like the ones in lesson 2.2, Fake bank messages, phishing links and spoofed numbers, works just as well on an iPhone as on any other phone. If you type your password and one-time password into a fake page, the scammer has them.
The second is persuasion. The scammer talks you into doing the dangerous part yourself. A fake bank officer walks you through "securing" your account by adding a new device. A fake police officer tells you to move your money to a "safe account". A romance contact asks you to download a trading app they recommend. In each case, the iPhone is working exactly as designed. It's following instructions from its owner, who has been fooled.
There's a third route that works on iPhones, Android phones and computers alike: getting you to let a stranger see or control your screen.
Remote access apps are legitimate tools. IT support teams use them to fix a colleague's laptop from across the office, and you'll find several well-known ones in every app store. Once installed and connected, they let someone else see your screen and, on many devices, move the cursor, type and click. Screen sharing is the lighter version, built into many video call apps. It lets the other person watch everything on your screen in real time, even if they can't control it.
In a scam, the script usually runs like this. You get a call from someone claiming to be your bank, your telco or a well-known tech company. They say there's a problem: a virus on your phone, a hacked account, a suspicious transaction. To help, they need you to install an app from the App Store or Play Store and read out a code, or to start a video call and share your screen.
Once they can see your screen, they can watch you open your banking app and type your password. They can see one-time passwords as they arrive. On a computer with remote control, they can make the transfers themselves while talking you through what you think is a security check.
Because the app came from an official store, it doesn't feel risky. That's why this scam works on people who would never tap an APK link.
Here is an illustration. Rachel, 36, gets a call from someone who says he's from her bank's fraud team. He says her account is being accessed from overseas and he needs to "trace the hacker". He asks her to install a screen sharing app from the App Store and read him the code it shows. She does. He then asks her to log in to her banking app "so he can see the suspicious transfers". Fifteen minutes later, while he's still on the line reassuring her, three transfers leave her account.
The rule that protects you here is short. No genuine bank, government agency or police officer needs to see your screen to help you. They don't ask you to install apps during a call, they don't ask you to share your screen, and they don't need you to log in while they watch.
If anyone asks for any of these, hang up. Then use the call-back habit from lesson 2.3, Verify by calling back on a number you found yourself: call the number on the back of your card or on the official website. If there really is a problem, the real bank will tell you.
The same goes for tech support. Large tech companies don't call people out of the blue to fix viruses. If you didn't ask for help, nobody should be offering to take control of your device.
One last defence costs you nothing but a few minutes. Phones and apps have flaws that attackers find and exploit, sometimes without you tapping anything at all. When a company finds one, it fixes it in an update.
Keeping your phone's operating system and your apps updated means those holes are closed soon after they're found. Turn on automatic updates for both, and when your phone asks to restart for an update, let it, ideally that same day. An old phone that no longer gets updates is a risk worth thinking about, especially for banking.
Many people have a remote access or screen sharing app sitting on their phone from a support call years ago, long forgotten. In the activity, you'll go looking for yours.
Search your phone for any remote access or screen sharing apps and remove the ones you do not use.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).