Do this first: disconnect before you do anything else
The moment you realise the APK you installed was malicious, disconnect the phone from the internet — turn on airplane mode, or switch off both wifi and mobile data. Do this before you open your banking app, check balances, or try to remove anything. Malware installed this way can rely on an active connection to keep working or to keep sending data out; cutting the connection first limits what it can still do while you sort out the rest.
Don't just uninstall and assume it's over
Deleting the app can feel like the obvious fix, but on its own it isn't enough for two reasons. First, some malware grants itself access (such as accessibility permissions or device admin rights) that can survive an uninstall unless it's specifically revoked. Second — and more importantly — if your login details, TAC/OTP, or banking credentials were already captured before you noticed, the damage is already done regardless of whether the app is still on your phone. Uninstalling doesn't undo that.
The actual order to follow
- Disconnect the phone — airplane mode, or wifi and data both off. Do this first.
- Call your bank's fraud hotline from a different device — not the compromised phone. Tell them an APK was installed and ask them to watch your account or freeze it if needed. If your login details may also be exposed, your banking app has a kill switch for this — see I gave my TAC/OTP to someone for how that works and what else to do if credentials were shared.
- Only then, consider a factory reset of the compromised device. Resetting before you've called your bank can mean you lose track of exactly what happened, and doesn't undo anything that was already sent out — so it comes after the call, not before.
- Tell your bank the device has been reset, so they know to keep monitoring the account even though the phone itself is now clean.
If money has already moved from your account, call 997 as well and follow the full sequence — evidence to preserve, the police report, what recovery looks like — in the first 24 hours guide.
FAQ
Should I turn the phone off completely instead of airplane mode?
Airplane mode (or turning off wifi and data) is enough to cut the network connection, which is what matters most. Turning the phone off entirely also works, but you'll need to turn it back on to make calls from it later — either way, get it off the network immediately.
I already factory-reset the phone before calling my bank — is it too late?
No — call your bank's fraud hotline now regardless. A reset doesn't undo a transaction that already happened, but your bank can still flag the account, watch for further suspicious activity, and advise on next steps.
How do I know if the APK was actually malicious, or just a bad app?
If you're not sure, treat it as a precaution regardless — the steps above (disconnect, call your bank, consider a reset) cost little if you're wrong, and matter a lot if you're right. Don't wait for certainty before acting.