Ransomware & Mobile Phones

<  Back to Fact Sheets

Ransomware targeting mobile phones is an emerging trend internationally that is presently targeting the Android phone market, but likely to transition to other operating systems. Ransomware may infect a phone by following a spam link that downloads an application without your knowledge or by installing legitimate applications such as games that may have the program embedded within them. 

Visiting certain websites, such as pornography or streaming services, may also trigger its installation. Once installed, the ransomware hijacks your device and locks it. At this point, it will demand payment to restore the device, often masquerading as national law enforcement to scare you. 

Within Australia the virus may present itself as the AFP, State Police, or your state transport department, claiming you owe unpaid fines that you must pay to unlock your device. It may also accuse you of storing and viewing banned pornographic material that you must pay to have removed from your device. This form of the virus is known as the Police Virus, but it is important to note that authorities will never use screen lockers to collect fines from you. 

Detecting mobile phone ransomware 

It can be difficult to detect this form of ransomware since it is usually installed without your knowledge. It is not until the app locks the phone and demands a ransom that you may even be aware that there is a virus on your phone. 

The answer is to detect suspicious URLs and apps prior to executing the malware. This can be achieved by ensuring your settings are set to ‘verify apps’ with the user prior to installation, and to avoid any suspicious links whose origins you aren’t sure of. 

Preventing mobile phone ransomware 

There are a few steps you can take to make sure that your phone stays virus free 

  • ‍Install reputable antivirus and malware programs on your phones and run scans regularly. 
  • Avoid sites with questionable reputations and be aware of what you are purchasing/installing on the app stores. 
  • Read app reviews where available before you download the app and take note of complaints. 
  • Backup your phone data to a cloud service or another device so recovery may be possible. 
  • Regularly update your mobile phone’s software. 
  • Check your phone’s security settings are set to disallow third party application installations from unknown sources. 

Responding to mobile phone ransomware 

If you have been infected with this virus, you can do the following to unlock your Android phone and minimise damage: 

  • ‍Boot your phone in Safe Mode by holding down the power button, then long-pressing the ‘Power Off’ option. (This varies with devices so check your phone manual if you are unsure). 
  • When the device reboots, you should see a ‘Safe Mode’ watermark. Go to your device settings menu and access your apps manager, and uninstall the rogue app. This should remove it from your system, and you can reboot your phone out of safe mode. N.B.: This may not work for all instances of infection. 
  • For iOS (Apple) users contact your local Apple service provider. 
  • If you have concerns about your personal information contact IDCARE

For additional support or information, contact IDCARE by submitting a Get Help Form or call 1800 595 160 (Aus) or 0800 121 068 (NZ).


Identity Care Australia & New Zealand Ltd (IDCARE) provides identity and cyber security incident response services (the Services) in accordance with the following disclaimer of service:

  • IDCARE is Australia and New Zealand’s national identity and cyber incident community support service. IDCARE is a not-for-profit and registered Australian charity.
  • The Services provided do not constitute legal advice. IDCARE recommends that you consult your own legal counsel in relation to your legal rights and obligations, including but not limited to your legal rights or obligations under Australian and international privacy and data protection laws.
  • While every effort has been made to ensure the accuracy of the content provided, to the maximum extent permitted by law all conditions, terms, representations, and warranties (in each case, whether express or implied) in connection with the provision of the Services which might otherwise be binding upon IDCARE are excluded.
  • IDCARE’S liability for any loss or damage suffered by any person or organisation (including, without limitation, any direct, indirect or consequential loss or damage) arising out of or in connection with the Services (including without limited liability for any negligent act or omission, or statement, representation or misrepresentation of any officers, employees, agents, contractors or consultants of IDCARE) shall be limited to the fees paid by you to IDCARE in respect of the Services. For the avoidance of doubt, this limitation of liability extends to any liability arising from any actions performed or not performed as a result of any recommendations made in the course of providing the Services.
  • If you would like to provide feedback please use our Feedback Form.


IDCARE is here to provide you with specialist support and guidance when faced with a cyber and identity related issue. Contact one of our Identity & Cyber Security Case Managers to learn more about our Support Services and how we can help you.   

Get help

Submit a web request

Call Centre Icon


1800 595 160

Mon - Fri: 8am - 5pm AEST

QLD: 07 3555 5900
ACT & NSW: 02 8999 3356
VIC: 03 7018 2366
NT, SA & WA08 7078 7741

Call Centre Icon

call our NEW ZEALAND

0800 121 068

Mon - Fri: 10am - 7pm NZST

AKL: 09 884 4440