The 'Congratulations, You Won' Malware Scam Has Crossed Over To Android And Wants Your Details

Normally, a congratulations would mean good news for you. Unfortunately, that’s exactly what scammers are counting on in order to swindle you.

The phrase “Congratulations, you won” has been pretty common among phishing scams in the past but now, according to a recent report by cyber security research firm Symantec, it’s also made its way to Android.

These scams are just crossing over to the Android platform right now, but they have a history of tried and tested methods, as well as specific new malware now to help them out. One malware named ‘Android.Fakeyouwon’ discovered on some users' devices identified the location of the smartphone using the device IP. Once that’s done, the scammers can use it to customise scam campaigns accordingly.

For example, scammers in India could theoretically make a Flipkart page, complete with the company’s logo and UI, and offer supposed discounts on an expensive smartphone, or vouchers for other products. That way, it can collect your personal details as you enter them to retrieve your gift, and transfer them back to a server.

Scammers use a variety of methods to trick people. They bait you with freebies or discounts, spoof web pages, and even create fake user accounts to leave testimonials. That last one is why, even if an app on the Play Store has a pretty high rating and a few user testimonials saying it’s good, you probably can’t be wholly sure of its safety.

One of the most basic things you can do is keep all your software up to date, whether smartphone or PC. Aside from malware scanners, manufacturing companies often release security updates, as do OS developers, so staying updated is key. Another thing is to never download an app from an unfamiliar website or generally untrusted source. Even on the Play Store, if it seems an app could be shady, always check what the lowest-rating comments says. Last of all, whenever you install a new app on your Android, pay close attention to what permissions it requests on startup. If it wants to access your contacts or personal files when it shouldn’t, don’t let it.