Barry (not his real name) walked in with his Oppo phone already in airplane mode. That was his own doing, and it was the smartest thing he could have done.

The phone had been throwing ads every few seconds. Not occasionally. Every few seconds, over the top of whatever he was trying to do. Then the calls started. People ringing to “confirm” he wanted his phone number updated to an address in Frankfurt. By the time he reached us his bank had locked his account.

He had not been hacked in the way people picture it. Nobody cracked a password. He installed a free phone cleaner.

What Judah found

Several of them, actually. A “Storage Cleanup Tool”, a PDF converter Barry had used once, and a couple of other cleaners picked up along the way. All free, all from the app store, all asking for one permission that sounds harmless: Display over Other Apps.

That permission lets an app draw on top of everything else on your screen. It is how a chat bubble floats over your apps. It is also how an app shows you a fake screen while you believe you are looking at a real one. Add picture in picture and the phone stops being trustworthy. You tap what you think is a button. You are tapping something else.

The ads were the symptom. The account takeover was the point.

What we did

Judah stripped Display over Other Apps and picture in picture from every app that had it, then removed the PDF converter, the Storage Cleanup Tool and the rest of the cleaners. He also checked the app lock, which had a privacy password set to something different from the phone PIN. Worth knowing before you need it rather than after.

The ads stopped. $95.

What to take from it

Your phone does not need a cleaner. Android and iOS both manage their own storage. Every cleaner app on the store is solving a problem your phone does not have, and asking for deep permissions to do it.

To check your own phone, look for Special app access in your settings, then Display over other apps. The exact path moves around depending on your phone brand. Anything in that list that is not a messaging app or something you set up on purpose should be off.

And if your phone starts behaving like Barry’s, airplane mode first. Barry, still not his real name, cut his phone off the network before anyone could finish what they had started. That one move probably saved him a great deal more than $95.