My mum visited some suspicious websites on her Samsung phone and clicked on alarming pop-ups claiming that the phone was hacked or running out of storage. She installed several apps advertised as antivirus tools and entered her bank details into one of them. Fortunately, no money was taken, and the affected bank account has since been closed and replaced.
Would a full factory reset remove the malicious apps and any related software, or should I take additional steps? Is replacing the phone necessary?
4 Answers
The bank details should be treated as compromised even though no money was taken. Changing the online-banking password, contacting the bank’s fraud department, monitoring statements, and changing any other password reused on the phone would be sensible. Also make sure two-factor authentication is enabled where possible.
A reset is only useful if it is done from the phone’s recovery settings and the device is set up as new afterward. Restoring a complete backup or reinstalling every previous app could bring the problem back. Photos and contacts are generally fine to restore, but apps should be downloaded again individually from trusted sources.
Before handing the phone back, disable website notification permissions in the browser and review which apps are allowed to install from unknown sources. Those fake warnings are often caused by browser notifications or deceptive apps rather than a deeply embedded infection. If the phone behaves strangely even after a reset and update, consider having it checked or replacing it.
On a reasonably modern Android phone, a factory reset should remove ordinary malicious apps and adware. After resetting, install every available system update, enable the built-in app security checks, and reinstall only trusted apps from the official app store. A replacement phone usually isn’t necessary unless the device is no longer receiving security updates or the malware survives the reset.
That makes sense. I’ll avoid restoring the old app set, update the phone first, and configure the browser so suspicious sites can’t send notifications.