If someone asks you to install an app or share your screen, stop, cut the network, report from another device to 112 and your bank, then clean up accounts on a clean device.
If a stranger tells you to install an app or share your screen, the first right answer is to stop and not comply. Scammers who pose as investigators, banks, couriers, or customer service to get a remote-control app onto your phone can hand over your device and accounts within minutes, so it pays to know what to do first before the moment of pressure arrives.
People get stuck on three questions: whether deleting the app is enough, whether it is safe to change passwords on a device that might be infected, and who to contact first. This list answers them with eight steps in chronological order, from stopping before you install to checking the phone lines registered in your name. If you have not installed anything yet, start at No. 1; if you already installed something or shared your screen, start at No. 2 and keep going in order.
How we chose
- Steps are ordered by how much they slow the spread of damage.
- Only actions handled through official channels are included: 112, KISA 118, the FSS FINE portal, and Msafer.
- We checked that anyone can do each step right away without special tools.
Procedures and contact details can change, so confirm the latest official guidance before you act. (Checked August 2026.)
Stop Before You Install
End Screen Sharing and Remote Control
Cut the Suspect Device's Network
Report from a Different Device
Request a Temporary Transaction Block
Get Removal Guidance from 118
Change Passwords on a Clean Device
Check Your Phone Line Status
How to use this list
If you have not installed the app, No. 1 is the strongest defense: stop on the spot and end the conversation. If you are already sharing your screen, cut the session at No. 2; if you notice symptoms, block the network at No. 3, then use No. 4 to alert 112 and your financial company from a different device.
If a certificate or password may have been exposed, continue to the temporary block request at No. 5. If you are unsure how to remove the app, get KISA 118 guidance at No. 6, then tidy up accounts and phone lines at Nos. 7 and 8. Do not skip steps, and get guidance before you factory-reset anything.
The information here reflects the time of research and may change, so confirm the latest details through official channels before you act.
Frequently asked questions
I already shared my screen. Is it too late?
It is not too late. End the session now, cut the network, and report from a different trusted device. What you do from here matters more than blaming yourself.
Does deleting the malicious app finish the job?
No. Besides removing the app, you also need to change passwords, request a temporary block on financial transactions, and check your phone lines. KISA's 118 hotline can walk you through the order.
Can I change my passwords on the device I suspect is infected?
We do not recommend it. If the device's status is unclear, what you type could be exposed again, so change passwords from a separate, clean device.
Who should I call to report damage from a malicious app?
Call 112 to report to the police, and KISA 118 for help removing the app and responding. If money may be at risk, also contact your financial company. Get the number from your card, passbook, or official website, not from a search ad.
How do I check whether phone lines were opened in my name?
Verify your identity on Msafer and look up the lines registered under your name. If your ID or verification details were exposed, consider setting a subscription block as well.
Will a factory reset make my phone safe?
A reset may help, but doing it before you get guidance can erase records needed for a report. Consult KISA 118 first, note the install time and app name, then decide.
Get new lists before anyone else
Once a week — only the new lists worth your time.
No spam · unsubscribe in one click
You may also like
Already Reported It? What Comes Next After a Voice Phishing Scam
After reporting voice phishing, keep preserving evidence, securing accounts, and rechecking your bank accounts and phone lines to prevent a second round of loss.
Was Something Opened in Your Name? An 8-Step Identity Theft Check
If an unfamiliar account, loan, or phone alert shows up, work through accounts, credit records, and phone lines in order, then freeze or report if there's real damage.
The First Minute After a Transfer Matters: A Payment-Freeze Action Order
Right after a fraudulent transfer, reporting, freezing payment, and preserving evidence need to happen almost simultaneously to limit the loss.