Screen sharing while a payee is added
Customers on a call are being asked to share their screen while they add a payee and send money. Every factor is correct, so the pattern shows only in the session around the payee and the payment.
In this advisory
What is happening
A caller posing as the police, a bank or a courier keeps the customer on the line and asks them to share their screen, so he can watch each step while the customer adds the payee he dictates and sends the money. The customer signs in on their own phone and approves the payment themselves.
In June 2025 Singapore Police warned about impersonation scams that use WhatsApp’s screen-sharing function, citing at least 46 cases and losses of at least S$3 million1. Android now warns when a banking app is opened during screen sharing with an unknown caller2. In India, “digital arrest” scams, in which fake officials hold people on video calls, took ₹1,935 crore in 2024 across about 1.24 lakh reported incidents3.
Why it gets through
Every factor is correct. The phone is the bound phone, the face or fingerprint is the customer’s, and a one-time code reaches the customer’s own number. A check that runs only at login has already passed by the time the screen is shared.
Where it shows
In the session around the new payee and the payment: a screen being shared or a remote-access app running, an active call that started before the app was opened, account details typed a few characters at a time, and a payee that is new, young or linked to other accounts. Each alone is weak evidence. Read together, they are a pattern a bank can act on before the money leaves.
What to check
- Read screen sharing and remote access at the new payee and the payment
Not only at login: the screen is usually shared after the customer has signed in.
- Read an active call across the payment journey
A call that started before the app opened and runs through the payee and the payment is one of the clearest signals there is.
- Score the payee before it is saved
How old the account is, and whether it is linked to accounts already seen receiving from many unrelated senders.
- Match the action to the risk
Warn, cool off a new payee, or hold the payment and call the customer back on the registered number.
- Write the customer’s message for this pattern
Plain words that say the money has not left, that the police never ask anyone to move money, and that the bank will call back.
Sources
Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing here is legal advice.
- Singapore Police Force (opens in a new tab), Jun 2025Police advisory on impersonation scams involving the WhatsApp screen-sharing function
- Google (opens in a new tab), May 2025What’s new in Android security and privacy in 2025
- IndiaSpend (opens in a new tab), 2024 data, press reportHow India’s cyber crime incidence is rising, citing official data