Explain how scammers reach iPhone users and why a request for remote access is dangerous on any phone.
You'll often hear that phone scams start with a dodgy file or a fake app. If you own an iPhone, it's easy to decide that most of that warning is meant for someone else. The two lessons before this one were about APK files and app installs. An iPhone won't install an APK file at all, and Apple reviews every app in its App Store. You may have felt relieved reading those lessons, and some of that relief is fair. But scammers count on it. They don't need malicious software to get into an iPhone if they can get the person who owns it to let them in.
In Singapore, an iPhone only installs apps from Apple's App Store. There is no setting that lets you install an APK-style file from a link, so the attack described in Lesson 6.1, "How a sideloaded app takes over your phone", mostly fails on an iPhone. Apple also uses sandboxing, which is designed to stop one app from gathering or changing information stored by other apps, or from making changes to the device. Apple explains how this works in its official Platform Security guide.
Because the device is harder to break into, scammers go after the person using it. You've already met the two common ways they do this in earlier lessons in the course.
Phishing, as the term is used here, is a message with a link that leads to a fake login page. Lesson 2.2, "Fake bank messages, phishing links and spoofed numbers", shows what these messages look like. They work on an iPhone exactly as they do on any other phone. If you type your password and your one-time password (OTP) into the fake page, the scammer receives both of them.
Persuasion is when the scammer gets you to do the risky part yourself. Someone posing as a bank officer might talk you through "securing" your account, and the method turns out to be adding a new device. Someone posing as a police officer might tell you to move your money into a "safe account". A romance contact might ask you to download a trading app they recommend. The iPhone is working as designed in all of these cases: it follows instructions from its owner, and the owner has been fooled.
A third route works the same way on iPhones, Android phones and computers. The scammer gets you to let a stranger see your screen or control it.
Remote access apps are legitimate tools. An IT support team might use one to fix a colleague's laptop from across the office, and several well-known ones are available in every app store. Once one is installed and connected, someone else can see your screen, and on many devices they can also move the cursor, type and click. Screen sharing is the lighter version and is built into many video call apps. It lets the other person watch everything on your screen in real time, even though they can't control anything.
The scam call usually follows the same script. The caller says they're from your bank, your telco or a well-known tech company. They report a problem, such as a virus on your phone, a hacked account or a suspicious transaction. They then ask you either to install an app from the App Store or Play Store and read out the code it shows, or to start a video call and share your screen.
Once the scammer can see your screen, they can watch you open your banking app and type your password, and they can see OTPs as they arrive. On a computer with remote control, they can make transfers themselves while talking you through what you believe is a security check. Because the app came from an official store, installing it doesn't feel risky, so this scam works on people who would never tap an APK link.
Take Rachel, 36 (an invented example). A man calls her and says he is from her bank's fraud team. He tells her that her account is being accessed from overseas and that he needs to "trace the hacker". He asks her to install a screen sharing app from the App Store and read him the code it shows, and she does. Next he asks her to log in to her banking app "so he can see the suspicious transfers". Fifteen minutes later, while he is still on the line reassuring her, three transfers leave her account.
No genuine bank, government agency or police officer needs to see your screen to help you. Real organisations don't ask you to install apps during a call, don't ask you to share your screen, and don't need you to log in while they watch.
If a caller asks for any of these, hang up. Then call the number on the back of your card or on the official website, a number you found yourself. This is the call-back habit from Lesson 2.3, "Verify by calling back on a number you found yourself". If there really is a problem with your account, the real bank will tell you when you reach them.
Tech support calls follow the same rule. Large tech companies don't call people out of the blue to fix viruses, and if you didn't ask for help, nobody should be offering to take control of your device.
Phones and apps have flaws that attackers find and exploit, sometimes without the user tapping anything at all. When a company finds a flaw, it fixes it in an update. Keeping your operating system and apps updated closes those holes soon after they're found, and it costs nothing but a few minutes.
Turn on automatic updates for the phone's operating system, and turn them on for your apps as well. When the phone asks to restart for an update, let it, ideally the same day. If your phone is old enough that it no longer gets updates, think about that risk, especially if you use it for banking.
Many people still have a remote access or screen sharing app on their phone from a support call years ago and have forgotten it is there. In the activity, you'll go looking for yours.
Search your phone for remote access or screen sharing apps and delete any you do not use.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).