What to do if scammers blocked your Android phone

The situation when the smartphone screen is suddenly covered with a ransom banner or the device stops responding to commands due to the actions of attackers causes panic. However, it is important to remain calm: in most cases screen lock it is software, not hardware, which means that you can restore the functionality of the gadget on your own. Fraudsters often exploit vulnerabilities in administrator rights or install malicious applications masquerading as system processes.

Before proceeding with active unlocking steps, you need to understand the nature of the problem. Most often, users encounter a so-called “banner lock” that blocks the interface, or a complete blocking of the device through services like Find My Device, if attackers have gained access to your Google account. In rare cases, the virus encrypts data, requiring a decryptor, but this is less common on modern versions of Android due to improved sandbox security.

Next steps depend on whether the touch screen is responsive and whether the physical power button works. If the device is completely frozen and does not respond to touches, you will need to perform the procedure Hard Reset or enter safe mode. Ignoring requests to transfer money is the first and most important rule, since payment does not guarantee the return of access, but will only confirm to attackers that the number is active and there is a solvent person behind it.

Diagnostics of the type of blocking and primary actions

The first stage of recovery is to accurately determine the type of threat. If a window with the logo of the Ministry of Internal Affairs, FSB or police hangs on the screen demanding payment of a fine, this is a classic ransomware virus. Such apps often block the Home button and minimizing applications. In the case where the phone simply reboots in a loop or shows a black screen with a cursor, the system boot record may be damaged or a critical system file has been deleted by malware.

Try pressing the key combination to open the task manager or switch between applications. On many devices Android this is done by swiping from the bottom edge or pressing the square navigation button. If you manage to see other open windows on top of the banner, try closing the malicious application through the settings. To do this, find the gear icon, go to the applications section and force stop the suspicious process.

⚠️ Attention: Never enter bank card information on pages that opened after blocking. Even if the site looks like an official payment system portal, the URL will most likely differ from the real domain.

If standard methods do not work, you need to check whether suspicious apps have administrator rights. Attackers often request these rights during installation so that the user cannot remove the virus in the usual way. Go to Settings → Security → Device Administrators. If you see an application there with a strange name or without an icon, uncheck it. This action will deprive the virus of privileges and allow you to remove it using standard means.

Entering safe mode to remove the virus

Safe mode is a special diagnostic profile of the operating system, in which only applications pre-installed by the manufacturer are launched. All third-party apps, including viruses and Trojans, are deactivated in this mode. This is an ideal way to remove malware if it is preventing you from using your phone as normal. The login method may differ depending on the model of your smartphone.

On most modern devices, you need to hold down the power button until the shutdown menu appears. Then press and hold your finger on the “Power off” or “Shut down” option on the screen. After a few seconds, the system will ask for confirmation to enter safe mode. After rebooting, you will see "Safe Mode" in the corner of the screen. Now you can safely go into settings and delete recently installed applications.

• 🔍 Press and hold the power button until the menu appears on the screen.
• 📱 Touch and hold the "Power off" icon on the touch screen.
• 🔄 Confirm entering safe mode in the pop-up window.
• 🗑️ Remove all suspicious applications installed before blocking.

For devices with a non-removable battery and volume control buttons, the algorithm may be different. Turn off your phone completely. Then hold down the power button and the volume down button (on some models, up) at the same time. Hold them until the manufacturer's logo appears. After loading it will display a message about safe mode. In this state, delete the browser cache and empty the downloads folder, since this is where blocker scripts are most often launched.

Resetting settings via Recovery Mode (Hard Reset)

If entering safe mode is impossible or the virus even blocks the loading screen, the only effective solution is a complete data reset via the recovery menu Recovery Mode. This procedure will return the phone to its factory state, erasing all user data, including contacts, photos and installed apps. However, this is a guaranteed way to get rid of any software blocking.

The procedure for entering recovery varies for different brands. For smartphones Samsung with a "Home" button, you need to turn off the device and hold down the center button, volume up and power. For newer models without physical buttons, you may need to connect the USB cable to your computer before pressing the buttons. Devices Xiaomi and Redmi usually use a combination of power and volume up. On clean Android (Pixel, Motorola) - power and volume down.

Volume Up + Power (for most models)
Volume Down + Power (for Pixel and some others)
Home + Volume Up + Power (for old Samsung)

After entering the Recovery menu, navigation is carried out using the volume buttons, and the selection is confirmed with the power button. You need to find the item Wipe data/factory reset. Select it and confirm the action by selecting Yes or Factory data reset. The formatting process may take several minutes. When finished, select Reboot system now. The phone will reboot and the lock should disappear.

Manufacturer	Button combination	Login features
Samsung (new)	Volume Up + Power	Requires a USB cable to be connected to a PC
Xiaomi / Redmi	Volume Up + Power	Menu in English or Chinese
Huawei / Honor	Volume Up + Power	Sometimes you need to hold it for a long time (up to 15 seconds)
Pure Android (Pixel)	Volume Down + Power	The Android logo appears first, then the menu

⚠️ Attention: After resetting the settings, FRP (Factory Reset Protection) protection may work on phones with Android version 5.1 and higher. You will definitely need to enter the login and password for the Google account that was synchronized on this device before the reset.

Remote blocking via Find My Device

Sometimes blocking occurs not because of a virus, but because attackers hacked your Google account and used the "Find Device" service to lock the screen with a message. In this case, the phone is working, but access to it is limited at the level of Google servers. The problem can only be solved by restoring access to your account.

Log into the site from a computer or other device google.com/android/find. If the device appears on the map as online, you can send a command to unlock it or, in extreme cases, to completely reset the data directly from the site interface. However, if your account password has been changed by hackers, you first need to restore access to the Google account itself through the password recovery procedure.

It is important to understand the difference between screen lock and bootloader lock. The Google service only blocks the password entry interface, but does not prohibit entry into Recovery Mode. Therefore, if you cannot restore your account quickly, the Hard Reset method described above will still work, but will require you to enter your account information after a reboot. Without this data, the phone will remain a “brick” from the point of view of an ordinary user.

What to do if you don’t remember your Google password?

You need to go through the account recovery procedure on the accounts.google.com page. You will need to provide a backup email or phone number. If there is no access to them, the process may take several days of security verification.

Prevention of re-infection and data protection

After successful unlocking, it is critical to analyze how exactly the malware got onto the device. Most often, users themselves grant permission to install applications from unknown sources. Check your security settings and make sure that the option Installation from unknown sources is disabled for all applications except official stores.

Install a reliable antivirus from a reputable manufacturer, for example Kaspersky, Dr.Web or ESET. Perform a full system check regularly. Don't ignore browser warnings that a site may be dangerous. Blockers often enter the system by clicking on a banner on a dubious resource with an offer to win a prize or viewing adult content.

• 🛡️ Update the operating system to the latest available version via Settings → About phone.
• 🚫 Disable installation of applications from the browser and instant messengers.
• 🔐 Enable two-factor authentication for all important accounts.
• 📲 Do not follow short links from SMS from unknown numbers.

Regularly backup important data to cloud storage or to your computer. This will not save you from being blocked, but will allow you to quickly restore information after a forced reset. Remember that no antivirus gives a 100% guarantee, so the user’s critical thinking remains the main barrier to scammers.

When specialist help is needed

There are situations where independent actions can lead to complete loss data or permanent failure of the device. If, after resetting the settings, the phone continues to boot with a banner, it is possible that the virus has registered itself in the system memory partition, which requires flashing the device via a computer using special software such as for Samsung or for MediaTek processors. Also contacting a service center is necessary if the blocking is accompanied by hardware symptoms: strong heating of the battery, spontaneous turning on of the screen when turned off, or rapid discharge. This may indicate that malware is using the phone's resources to mine cryptocurrencies, which physically wears out the device's components. Odin for Samsung or SP Flash Tool for MediaTek processors.

Also, contacting a service center is necessary if the blocking is accompanied by hardware symptoms: extreme heating of the battery, spontaneous turning on of the screen when it is off, or rapid discharge. This may indicate that malware is using the phone's resources to mine cryptocurrencies, which physically wears out the device's components.

⚠️ Attention: If your phone contains critical information that cannot be lost, do not try to do a Hard Reset yourself. Contact professionals who can try to save the data when removing the virus, although this is not always possible.

If you are not confident in your abilities or are afraid of permanently losing access to the device due to FRP protection, it is better to entrust the unlocking procedure to specialists. They have the necessary licensed utilities to bypass protections and can quickly determine whether the problem is a software error or the result of a complex virus attack.

Is it possible to remove a virus without losing data?

In some cases, an experienced technician can delete a specific virus file through ADB commands without erasing the entire data section. But this does not work with all types of blockers and requires high qualifications.

What to do if, after resetting, the phone asks for a password for your old Google account?

This is FRP (Factory Reset Protection) protection. You need to enter the exact email and password that were synchronized on your phone before the reset. If you don't remember them, you will have to restore access to your Google account through the site from your computer. It is impossible to bypass this protection without account data using legal methods.

Will removing the SIM card help you unlock the phone?

No, removing the SIM card will not affect the operation of the virus or the screen lock. Most modern blockers work via the Internet (Wi-Fi or mobile network), but the app itself is already in the phone’s memory. A SIM card is only needed to transmit data about the number, but not to control the system.

Is it safe to download unlocking apps from the Internet?

Extremely risky. Many apps that promise “universal unlocking” themselves contain viruses or are fraudulent software. The only safe tools are official utilities from smartphone manufacturers or time-tested tools like ADB.

Can a virus steal money from a bank card without access to the screen?

If the virus is already installed and has rights to read SMS or Accessibility, it can intercept verification codes and gain access to banking applications. Therefore, after unlocking, be sure to change your passwords for banking applications and check your transaction history.

Why didn’t the antivirus notice the blocker before installation?

Attackers are constantly changing virus signatures. New versions of malware may remain undetected by antivirus databases for several days or weeks before the databases are updated. In addition, if the user himself has given permission to install, the antivirus may consider this to be a user action and not block the process.