{"id":33286,"date":"2022-04-12T14:46:43","date_gmt":"2022-04-12T11:46:43","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=33286"},"modified":"2026-03-28T00:46:30","modified_gmt":"2026-03-27T21:46:30","slug":"hello-its-me-fakecalls-trojan-imitates-phone-conversations-with-bank-employees","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/hello-its-me-fakecalls-trojan-imitates-phone-conversations-with-bank-employees\/","title":{"rendered":"\u201cHello, it\u2019s me\u201d: Fakecalls\u2019 Trojan imitates phone conversations with bank employees"},"content":{"rendered":"\n

The banking Trojan dubbed Fakecalls masquerades as a banking app and mimics the telephone customer support of the most popular South Korean banks. Unlike regular banking Trojans, it can discreetly intercept calls to real banks using their own connection. Under the guise of bank employees, the cybercriminals try to coax payment data or other confidential information out of the victim.<\/strong><\/p>\n\n\n\n

Kaspersky researchers uncovered the Fakecalls\u2019 banking Trojan in January 2021. During their investigation they found that when a victim calls the bank\u2019s hotline the Trojan opens its own fake screen call in place of the bank\u2019s authentic one. There are two possible scenarios that unfold after the call is intercepted. In the first, Fakecalls connects the victim directly with cybercriminals who present themselves as the banks\u2019 customer support. In the alternative scenario, the Trojan plays prerecorded audio that imitates a standard greeting from the bank and mimics a standard conversation using an automated voicemail.<\/p>\n\n\n\n

From time to time, the Trojan inserts small audio snippets in Korean. For example, \u201cHello. Thank you for calling our bank. Our call center is currently receiving an unusually large volume of calls. A consultant will speak with you as soon as possible.\u201d This enables cybercriminals to gain the trust of their victims by making them believe that the call is real. The main objective of such calls is to coax as much vulnerable information, including bank account details, from their victims as possible.<\/p>\n\n\n\n

\"12-4-22_ssict_1200_1052\"<\/a><\/figure>\n\n\n\n

Fakecall screen that the Trojan opens after the victim tries to call the real bank<\/em><\/p>\n\n\n\n

However, cybercriminals using this Trojan have failed to consider that some of their potential victims may use different interface languages, for example, English instead of Korean. The Fakecall screen only has a Korean version, which means some of the users using the English interface language will smell a rat and uncover the threat.<\/p>\n\n\n\n

When downloaded, the Fakecall app, disguised as an authentic banking app, asks for a variety of permissions, such as access to contacts, microphone, camera, geolocation and call handling. These permissions allow the Trojan to drop incoming calls and delete them from the device\u2019s history, for instance, when the real bank is trying to reach its client. The Fakecalls\u2019 Trojan is not only able to control incoming calls but is also able to spoof outgoing calls. If cybercriminals want to contact the victim, the Trojan displays its own call screen over the system\u2019s one. As a result, the user does not see the real number used by the cybercriminals but the phone number of the bank\u2019s support service shown by the Trojan.<\/p>\n\n\n\n

As fraudsters are trying to convince the victim that the app is real, Fakecalls completely mimic the mobile apps of well-known South Korean banks. They insert the real bank logos and display the real support numbers of the banks as displayed on the main page of their official websites.<\/p>\n\n\n\n

The Trojan imitates the apps of the most popular Korean banks<\/em><\/p>\n\n\n\n

\u201cBanking clients are constantly told to be aware of calls from scammers. However, when they are directly trying to reach bank customer support themselves, they do not expect any danger. Generally speaking, we trust bank employees \u2013 we call them for help and, therefore, we may tell them, or their impersonators, any requested information. The cybercriminals who created Fakecalls have combined two dangerous technologies: banking Trojans and social engineering, so their victims are more likely to lose money and personal data. When downloading a new mobile banking app, take into consideration what permissions it asks for. If it\u2019s trying to get suspiciously excessive access to device controls, including call handling access, then it is most likely that the app is a banking Trojan<\/em>,\u201d<\/em> comments Igor Golovin, security researcher at Kaspersky.<\/p>\n\n\n\n

Read the full report about Fakecalls Trojan on Kaspersky Daily.<\/a><\/p>\n\n\n\n

To prevent your money or personal data from falling into fraudsters\u2019 hands, Kaspersky recommends:<\/strong><\/p>\n\n\n\n