A 66-year-old Singapore man had his phone apparently taken over remotely after he was guided to download an app while signing up for an exercise class advertised on Facebook.
The incident came to light after the man received a message purportedly from DBS about a suspicious S$50,000 transaction.
While his daughter was contacting DBS using another phone, his device was suddenly locked and displayed a message saying: “I wont let you contact DBS and fraud team.”
Fortunately, the family later confirmed that no money had been taken from his bank accounts. The Singapore Police Force told Mothership that a police report had been lodged and the matter is being looked into.
Wife Saw Facebook Ad for Elderly Aerobics Class
According to the man’s daughter, Nicole, the incident happened on 22 September at around 7pm.
His 60-year-old wife had earlier come across a Facebook video advertisement promoting an aerobics class for elderly participants. She submitted her husband’s phone number through the advertisement.
The 66-year-old was subsequently contacted by a woman who purported to represent the exercise class.
She guided him through signing up and instructed him to download an application called “Water Fitness”. According to what the man later told his family, he obtained it through an Android app store.
The caller also instructed him to change certain settings on his phone.
His daughter told Mothership that the device subsequently began behaving strangely and became unusually hot. Images she shared indicated that the application had permissions including access to the camera and microphone.
It has not been publicly established whether the “Water Fitness” application itself was malicious or exactly how remote access to the phone was obtained.
Family Called DBS After S$50,000 Alert
Later that day, the man showed his daughter a message claiming to be from the DBS fraud department.
It referred to a suspicious transaction involving S$50,000.
His daughter used her own phone to contact DBS and check whether the transaction was real.
During the call, the man’s phone appeared to be remotely accessed. A green indicator appeared on the device before its screen was locked and the message about preventing him from contacting DBS appeared.
The family switched off the phone and contacted the relevant banks to check for unauthorised transactions.
They later visited DBS to secure the man’s account. According to his daughter, no money was lost.
His SIM card was replaced and the phone was wiped. The family also discovered additional applications which the man said he had not installed himself.
Police Previously Warned About Malware Scams Targeting Seniors
The circumstances bear similarities to a malware scam pattern that the police warned about in June 2026, although authorities have not said that the latest case is necessarily part of that scam variant.
In the earlier cases, senior citizens encountered Facebook or TikTok advertisements promoting activities for older people. Victims who expressed interest were subsequently contacted and instructed to install Android applications.
Police said malware could then allow scammers to interfere with victims’ devices or accounts. At least eight such cases had been reported from 1 April to 18 June 2026, with losses totalling at least S$69,000.
DBS says malware and remote-control applications can potentially allow scammers to access sensitive information or operate a compromised device. Its digibank security system can restrict access when remote-control activity or other malware-related threats are detected.
ScamShield advises anyone who suspects that a malicious app has been installed to disconnect the phone from the internet, check financial and government accounts from another safe device, and report any unauthorised transactions.
