What is the Flubot scam?

The Flubot scam is a text and picture message scam that infects Android phones, across all networks. A message, pretending to be from a number of services (including couriers, voicemail, messaging and video apps - amongst others), asks you to click an attached link and install an app. If you click on the link, it will actually install a piece of software designed to cause damage (malware). The malware could access your online banking and private details. It could also take over your device and send more infected texts and picture messages to lots of other mobile numbers without your knowledge, in the hope they’ll also install the malware.

If you think you’ve received a Flubot text message, please forward it to 7726. 

Picture messages (MMS) can’t be forwarded to 7726. Instead, copy the text from the MMS into a new text message and send it to 7726. 

You’ll then need to identify and remove the malware from your device.  

Flubot malware is disguised as a regular app (e.g. a courier app, voicemail, video, or voicemail app), so it can be difficult to spot. There are two ways you can tell if an app may be malware:

• If you tap an app, and it doesn’t open
• If you try to uninstall an app and are instead shown an error message

Once you’ve found the app, you can remove it by either:

• Activating Android’s Safe Mode. Safe Mode temporarily blocks third-party apps from running and will let you identify and uninstall any Flubot apps. Find out how to activate Safe Mode
• If that doesn’t work, you can download and activate Google Play Protect and perform a complete device scan. This may allow you to delete the malware

If your device has been infected and you’ve been charged for text and picture messages outside your plan, we’ll refund you as soon as possible.