Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If an Android banking trojan may have captured your PIN or bank login, stop using that phone for banking and contact your bank’s fraud department immediately from a trusted device or phone number. Secure the account first; then change exposed passwords from a separate device and clean or reset the Android phone. Do not assume the phone is infected until confirmed, and do not wait to report suspicious activity.

1. Contact your bank using a trusted route

Call the number on your bank card or statement, or use the bank’s official app or website on a device you believe is clean. Ask for the fraud department. Tell them a banking trojan may have captured your PIN or login, and report any transactions or account changes you do not recognize.

  • Ask the bank to secure online access and payment methods, block or review suspicious transfers, and explain how to restore access safely.
  • Do not use a phone number or link from an unexpected call, text, email, or pop-up. The FTC advises using a trusted number, such as one on a statement or in the bank’s app: FTC guidance on phishing scams.
  • Never tell anyone a one-time verification code. The FTC states: “Anyone who asks you for your account verification code is a scammer.”

If you are in the United States and the stolen information includes a debit PIN or security code, the CFPB says to notify the bank or credit union within two business days of discovering the theft. For the described covered transactions, reporting within that period protects consumers from paying more than $50. These are US-specific protections, not a guarantee for every transaction or situation. Read the CFPB’s debit-card scam guidance and ask your institution how the rules apply to your case.

2. Change exposed passwords from a different device

Do not sign in to banking, email, or other sensitive accounts on the suspected phone while you are resolving the issue. Use a separate device you believe is clean to change the bank password and any password reused elsewhere. Start with email if it can be used to reset your bank account.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Set a unique password for each affected account.
  2. Use the service’s security settings to sign out other active sessions, if that option is available.
  3. Enable two-factor authentication and check that recovery email addresses and phone numbers are yours and correct.
  4. If you cannot sign in, use the bank’s official account-recovery process and tell the bank the phone may have been infected.

Do not give a verification code to someone who calls or messages claiming to be the bank, a device maker, or support staff. Contact the institution yourself using its official number or app.

3. Check for unauthorized activity and keep a record

Review recent transactions, payees, contact details, and password-reset notices. Small unfamiliar debits can matter too. Report suspicious transfers promptly, even while the bank is securing access. Keep a record of when you contacted the bank, whom you spoke with, any reference numbers, and the instructions you received.

For US consumers, the CFPB says a bank generally has ten business days to investigate an unauthorized electronic fund transfer, or 20 business days if the account has been open for less than 30 days. After determining that an error occurred, the bank must correct it within one business day and report its findings within three business days. For an unauthorized withdrawal listed on a statement when the consumer did not lose a card or PIN, the CFPB says to notify the bank right away and no later than 60 days after the statement was sent. The applicable rules depend on the transaction and facts; see the CFPB guidance and follow your bank’s instructions.

4. Remove or contain the suspected Android malware

Keep the suspect app off the phone and do not enter banking credentials there. Google’s Android malware-removal guidance recommends enabling Google Play Protect, checking for Android, security, and Google Play system updates, uninstalling untrusted or unintentionally installed apps, and reviewing Google Account security settings.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Open the Play Store and turn on Play Protect in its security settings, then run a scan.
  2. Install available Android, security, and Google Play system updates. Menu names vary by Android version and manufacturer; look in Settings for System or Security and updates.
  3. Uninstall apps you do not trust or do not remember installing. Do not reinstall the suspected banking app or related app while investigating.
  4. Review Google Account security settings, including recent security activity and recovery details.

A clean scan does not prove that every compromise is gone. If signs of malware continue, Google says a factory reset may be necessary or you may need help from the device manufacturer. Back up only what you need, avoid restoring the suspect app, and follow your manufacturer’s reset guidance. If you cannot confidently remove the malware, contact manufacturer support or a trusted technician—not an unsolicited “virus support” number or advertisement. The FTC also advises stopping sensitive logins on a suspected infected device, updating security software, scanning, and changing passwords with two-factor authentication enabled: FTC malware guidance.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

5. Take identity-theft steps if more than banking credentials were exposed

If the incident involved personal information beyond the bank login or PIN, such as information that could be used to open accounts in your name, the CFPB recommends contacting affected financial institutions’ fraud departments, closing affected accounts, and reporting the identity theft at IdentityTheft.gov for a recovery plan. Consider a fraud alert or credit freeze if your identity information may be misused. You can report scams to the FTC at ReportFraud.ftc.gov.

The deadlines and liability protections above are US-specific. Outside the United States, contact your financial institution promptly and use your country’s official fraud-reporting agency or consumer-protection authority.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.