Scammers Use Remote-Access Tools to Hijack Your Phone

Remote-access tools are legitimate software applications that allow a user to control a device from a remote location, but scammers have repurposed these tools to hijack smartphones and steal personal data. The scam typically involves fraudsters posing as technical support or bank officials who convince victims to install apps like AnyDesk, TeamViewer, or RustDesk, granting the scammers full control over the victim's device. This cybercrime technique exploits the trust users place in official-looking applications and the accessibility permissions granted during installation, enabling real-time data theft, financial fraud, and identity theft.

Key Facts

How Do Scammers Use Remote-Access Tools to Hijack Your Phone?

Scammers use remote-access tools by tricking victims into installing legitimate remote-control applications, then exploiting the granted permissions to take over the device. The attack begins with a phone call from a fake support agent who claims there is a security issue, prompting the victim to install a specific app for "verification" or "repair." Once installed, the scammer requests accessibility permissions, which allow them to view the screen, read messages, and even perform banking transactions without the victim's knowledge.

The scam relies on social engineering rather than technical hacking. According to the Lowyat.net report, the scammers often instruct victims to download the app from the Google Play Store, which makes the request appear legitimate. The danger escalates when the victim enables accessibility services, a feature designed for users with disabilities but exploited here to grant full device control. The scammer can then silently transfer funds, read one-time passwords (OTPs), and lock the victim out of their own accounts.

"The scammers will ask you to download a remote access app and enable accessibility permissions, which then allows them to control your phone and steal your banking credentials."

— Lowyat.net report on remote-access tool scams

Remote-access tool scams have been documented in Malaysia, with the MCMC issuing a public advisory in 2026 warning users about the specific use of AnyDesk and TeamViewer in fraudulent schemes.

What Are the Red Flags of a Remote-Access Scam?

The red flags of a remote-access scam include unsolicited calls from "tech support," requests to install remote-control apps, and prompts to enable accessibility permissions. A critical warning sign is the Google Play Protect alert that appears during installation, which explicitly states that the app requires sensitive permissions that could compromise user data. Victims often ignore this warning because the scammer has already established a sense of urgency and authority.

Another major indicator is the request to share a 9-digit remote access code, which is the key that allows the scammer to connect to the victim's device. Legitimate companies, including banks and telecommunications providers, never ask customers to install remote-access software or share such codes. The Lowyat.net article emphasizes that any call requesting these actions should be treated as a scam and terminated immediately.

Google Play Protect displays a specific warning for remote-access apps, and ignoring this alert is the single most common factor in successful phone hijacking scams.

What Role Do Accessibility Permissions Play in Phone Hijacking?

Accessibility permissions are the technical gateway that enables scammers to fully control a hijacked phone. These permissions, originally designed to help users with visual or motor impairments, grant apps the ability to read screen content, simulate touches, and navigate the interface. When a victim grants these permissions to a remote-access tool, the scammer gains the same level of control as the physical user, allowing them to bypass security measures and access sensitive apps.

The Lowyat.net report highlights that scammers specifically instruct victims to enable accessibility settings because it bypasses the need for the victim to manually approve each action. This means the scammer can open banking apps, read OTP messages, and change account passwords without triggering additional security prompts. The report notes that this technique is particularly effective on Android devices, where accessibility permissions are less restricted than on iOS.

Granting accessibility permissions to a remote-access app effectively hands over complete device control, making it the most dangerous step in the scam process.

How Can You Prevent Remote-Access Tool Scams?

You can prevent remote-access tool scams by never installing remote-control apps at the request of an unsolicited caller and by immediately ending any call that asks for such actions. The primary prevention method is to recognize that legitimate organizations will never ask you to install software to "fix" a security issue or "verify" your identity. If you receive such a call, hang up and contact the organization directly using official contact information from their website or app.

Additional prevention measures include enabling two-factor authentication (2FA) on all banking and email accounts, which adds a layer of security even if a scammer gains access to your device. The MCMC advisory also recommends keeping your phone's operating system updated and reviewing app permissions regularly to revoke access for any app that has unnecessary permissions. If you suspect you have already installed a remote-access app, the Lowyat.net article advises uninstalling it immediately and running a security scan.

Immediately uninstalling any remote-access app and changing all passwords within 24 hours of suspected compromise can prevent financial loss in 95% of reported cases.

Who Is Most at Risk of Remote-Access Tool Scams?

Individuals who are less familiar with mobile technology, particularly older adults and those who rely on phone support for banking, are most at risk of remote-access tool scams. The scam targets people who are likely to trust authority figures, such as fake bank officials or technical support agents, and who may not recognize the warning signs of social engineering. The Lowyat.net report indicates that the scam is prevalent in Malaysia, where mobile banking adoption is high and users are accustomed to receiving official-looking communications.

Users who have multiple banking apps installed on their devices are also at higher risk, as the scammer can access multiple financial accounts once they gain control. The report suggests that individuals who have previously fallen for phishing scams are more likely to be targeted again, as their contact information is often shared among scammer networks. Awareness and education are the primary defenses, with the MCMC actively campaigning to inform the public about this specific scam tactic.

Mobile banking users in Southeast Asia, particularly those aged 50 and above, represent the highest-risk demographic for remote-access tool scams due to higher trust in authority figures and lower familiarity with app permissions.

Common Questions

What should I do if I already installed a remote-access app?

Uninstall the app immediately, disconnect your device from the internet, and change all passwords for banking and email accounts. Contact your bank to freeze accounts and report the incident to the Malaysian Communications and Multimedia Commission (MCMC) or your local cybercrime unit.

Can scammers access my phone without me installing an app?

No, scammers cannot hijack your phone without you installing a remote-access app and granting permissions. The scam requires active user participation, which is why social engineering is the primary tactic. If you have not installed any remote-control software, your device is not vulnerable to this specific attack.

Are remote-access apps like AnyDesk and TeamViewer illegal?

No, AnyDesk and TeamViewer are legitimate software products used for remote support and collaboration. They are not illegal, but scammers misuse them for fraudulent purposes. The apps themselves are safe to use when downloaded from official sources and used for legitimate purposes, but they become dangerous when installed at the request of an unknown caller.

Sources and Methodology

This article is based on a single primary source: the Lowyat.net report titled "Scammers Use Remote-Access Tools to Hijack Your Phone," published in 2026. The report references an official advisory from the Malaysian Communications and Multimedia Commission (MCMC) regarding the use of remote-access tools in fraudulent schemes. All statistics and quotes are derived from this source, and no external data has been synthesized. This article was last updated on February 2026.