The SMS Reached the Phone. It Never Reached His Eyes.

At 3:47 on a Tuesday, a phone buzzed on a conference table. The screen lit up: a bank notification. 50,000 yuan withdrawn from account ending 3807. The man glanced at it, swiped it away, and turned back to the meeting. He would check later.

When he checked later, the balance was zero.

The SMS went out on time. The phone received it. The man did not see it. That gap, between the phone and the person, is where the money went.

There is no single loophole. The chain is made of normal steps. Redeem a fund. Convert a fixed deposit. Take a credit-card cash advance. Each step is something the account holder has done before. The scammers do not rush one large transfer. They pool the money first.

A man in his fifties found an extra 100,000 yuan in foreign exchange sitting in his account. His first thought was that his card had been used for money laundering. He called the police. They told him local officers would contact him if that were true. He should wait.

He waited. Then he checked further. The money had not fallen from the sky. It had been scraped out of his own other cards. Credit cards and investment accounts were withdrawn to China Construction Bank, then used to buy foreign exchange and pool the funds. On the surface, he had an extra 100,000 in forex. In substance, his own money had changed position.

Digital RMB, foreign exchange purchases, cross-border settlement. These terms sound like internal bank processes. That is the point. The problem is not Digital RMB or forex settlement. The problem is a stranger on the phone, directing you to string normal financial functions into an abnormal chain. Personal forex purchases have use requirements and an annual facilitation quota. Abnormal cross-border activity gets stopped by bank risk controls. Do not follow a stranger's instructions to convert foreign exchange, exchange and remit, or settle cross-border.

Ms. Zhou's case was patient. No single large transfer. No dramatic alert. Multiple small remittances, one after another, until the balance ran out. People ask whether a bank sends a confirmation SMS when SMS alerts are cancelled. The normal process does. The problem is the same as the man at the conference table: the notification reached the phone, not the person's eyes.

She had installed an app. It asked for accessibility services, notification reading, SMS permissions, screen sharing. She granted them. The other side could read verification codes, simulate taps, delete notifications, hide icons. She thought she did not receive the notification. It had been intercepted. She thought only she could see the verification code. The other side of the screen share saw it too.

Accessibility services were built for assistive functions. Handing them to an untrusted app gives away the phone's controls. Screen sharing was built for meetings. Opening it over a banking app livestreams your verification codes, balance, and card number. The bank did send reminders. The device intercepted them. Anyone claiming to be customer service, police, or bank staff who asks you to turn on screen sharing, use remote control, install a meeting app, or read out a verification code: hang up. Official processes do not ask you to hand your phone to a stranger.

Another line of attack does not need an app. It needs one letter.

A fake Amazon page looks almost identical to the real one. The difference might be the Cyrillic letter а (U+0430) replacing the Latin a. Similar fakes have appeared for maybank2u.com and citibank.com. The a in the address bar is not the English a. The eye barely catches it.

People scan domain names. They do not verify them character by character. The practical defense is dull. Do not enter banks through links in SMS, chats, or emails. Use the official app or type the official domain manually. Long-press a link to see the real URL before tapping. If your password manager does not autofill on a domain, treat that as an alarm. Be wary when xn-- appears in the address bar. For banking, enter only through the official app. Never through a link sent by customer service.

A fake domain gets your password. A fake app gets your whole phone.

The guy who installed the adult-content app handed over permissions after the install. That was the problem. Sideloaded apps like these request accessibility, SMS, floating-window, screen-recording, and device-administrator permissions. Once installed, half the phone's control is gone.

The script guides you step by step. First it says you cannot use it unless you enable this. Then it says you cannot get a refund unless you enable that. Finally it says verification is impossible unless you enable something else. By the end, the phone is not yours.

The principle is simple. Do not install from unofficial stores. Give accessibility only to trusted assistive apps. When any app asks for SMS, notification, or screen-sharing permissions, ask why it deserves them. Do not touch adult-content apps, cracked apps, or so-called internal versions. If you do not casually open permissions on your phone, most remote-control chains cannot get started.

If you suspect your phone is compromised, disconnect from the network or turn on airplane mode. Use another device to contact the bank, freeze the account, change passwords, and check logged-in devices. Call the police. Preserve evidence. Reset the phone. Deleting only the app often leaves permissions and background processes in place.

Day to day: lower transfer limits. Enable balance-change alerts. Separate the banking app from daily apps by device or by space. Check the accessibility and device-administrator lists regularly. For abnormal incoming funds, contact official channels. Do not follow a stranger's instructions.

This scam uses a combination, not one technical loophole. Scripts build trust. Fake domains and fake apps lower vigilance. Screen sharing and accessibility grab permissions. Fund pooling and foreign exchange lengthen the path. The defenses are concrete: no screen sharing, no sideloading, no accessibility permissions, no entering banks through links, no giving verification codes to anyone, and official channels for abnormal incoming funds.

Lower your transfer limits. Clean out your accessibility list once. Reinstall your banking app from the official store.

After that, talk about luck.