A few weeks ago my younger daughter came to me with a screenshot. A “support executive” had messaged her about a refund for a school-trip payment that had genuinely bounced back a week earlier — so the pretext was real, which is the unsettling part. The instruction was to install an app from a link so they could “guide her through the refund screen.”
She didn’t install it. She came and asked, which is the only reason this is a short story and not an expensive one. But I keep thinking about how close it was — the refund was real, the timing was right, and the ask sounded like help.
This is the scam pattern I’d put at the top of the list for Indian families right now, not because it’s clever, but because it’s the one where the money that leaves is measured in lakhs rather than hundreds.
What screen-sharing scams actually do
First, a fairness point: apps like AnyDesk, TeamViewer, RustDesk and the various “QuickSupport” tools are legitimate remote-support software, used every day by IT teams fixing machines they can’t physically reach. There’s nothing wrong with the tools. The problem is that something built to let a trusted technician operate your device works exactly as well for someone who isn’t one.
Here’s the sequence, and it almost never varies.
A call or message arrives with a real-sounding reason. A refund that’s stuck. KYC that’s expiring. An order that needs cancelling. A “wrong” payment the caller says they sent you by mistake. The pretext is tailored, and increasingly it’s tailored using something true — a payment that actually did fail, an order you actually did place.
You’re asked to install an app “so we can help you.” Sometimes it’s framed as the bank’s own tool; sometimes you’re walked to the Play Store. The app itself is genuine, which is why no security warning fires and why “only download from the official store” isn’t sufficient advice here.
You’re asked to read out a code. Nine digits, usually, displayed in the app. That code is the connection request. Reading it out is the moment the scam succeeds — everything before it is setup, everything after it is cleanup.
On Android, you’re then asked to grant a permission the caller calls routine. It’s the Accessibility permission, and it’s the difference between someone watching your screen and someone operating it. Granted, it lets the other side see what you type and tap on your behalf.
And then there’s nothing left to steal, because they don’t need to steal it. They can see the OTP arrive. They can watch a UPI PIN being entered. They can open the banking app, read balances, initiate transfers, and approve them with codes appearing on the same screen they’re already looking at — often while the victim is still on the call being reassured.
The reason this does so much more damage than a QR swap or a fake giveaway is that there’s no cap on it. A QR scam takes the amount you were about to pay. This one reaches whatever the device can reach.
Teenagers are targeted less often than adults here, but they get a specific version of it: game-account “support,” a marketplace buyer whose payment “didn’t go through,” a part-time-job “onboarding” that needs remote setup. And there’s a second route that catches families constantly — the teenager is the household’s designated tech person, so when a grandparent gets one of these calls, it’s the fifteen-year-old who gets handed the phone. They’re not the target. They’re the installer.
Get the Junio app. Your child spends from a balance you load, with limits you set and every transaction pinging your phone as it happens. Set up Junio.
The one rule
You can’t teach a child — or a parent, or a grandparent — to assess every caller’s legitimacy in real time. Under pressure, nobody performs that assessment well. What works is a rule that requires no judgement at all:
Nobody in this house installs an app because a phone call or a message told them to. Ever. For any reason. Including me.
State it in exactly those terms, because the strength of the rule is that it has no exceptions to argue about. There is no legitimate situation in which a bank, a payment app, a delivery company, a government office or a support desk needs you to install remote-access software to resolve something. Every instance of that request is the scam, one hundred per cent of the time. That’s rare in online safety — usually we’re teaching judgement. Here the test is binary, and a ten-year-old can apply it as reliably as an adult.
Two things make it stick in practice.
Include yourself in the rule, out loud. If your children see you hang up and call the number on the back of your card instead, it reads as how the household operates rather than a restriction placed on them. And say plainly that hanging up on someone genuine costs you four minutes — that’s the entire downside, and it’s worth paying every time.
Give them the script. “I don’t install apps during calls. If this is genuine, I’ll call the official number myself.” Then hang up. Teenagers don’t fail this because they’re gullible; they fail because they’re being polite to an adult who sounds official, and they have no sanctioned way to end the conversation. Handing them a sentence that makes hanging up acceptable is most of the work.
And add the corollary for the grandparent scenario, because it’s the one that actually catches kids: if someone hands you their phone and says a support person is guiding them through an installation, the answer is to stop and call a parent. Being asked to help is not an exception to the rule.
If it’s already happened
Speed matters more than anything else here. Turn off Wi-Fi and mobile data immediately — that alone severs the session. Uninstall the remote-access app. Restart the phone. From a different device, change your banking and UPI passwords, and call your bank’s official number to freeze or flag the account. Report it on the national cybercrime portal or the 1930 helpline the same day; the earliest hours are when a transfer can still realistically be reversed.
Then, whatever the damage, respond to your child the way you’d want to be responded to. The households that lose the most are the ones where the child knew something was wrong at 9pm and said nothing until the next evening.
Skip this if…
If the phone in question has no banking app, no saved cards and no payment app signed in — a younger child’s device, say — the financial version of this scam has very little to reach. Still worth teaching as a habit, but not urgent this month.
For every other phone in the house, treat it as the highest-value lesson in the whole online-safety syllabus. One rule, no exceptions, applied by everyone including the adults. It costs nothing, and it closes off the single most expensive pattern going.
Have a scam pattern you’d like us to break down? Email [email protected].