How Fakecalls pretends to be a bank employee

Fakecalls is a sophisticated Korean Trojan malware targeting customers of Korean banks, specifically mimicking apps from Kookmin Bank and KakaoBank. The malware displays authentic bank support phone numbers harvested from official websites to appear legitimate.

The attack mechanism is elegant: when a user calls their bank's official hotline, Fakecalls detects the outgoing call, silently terminates the connection, and displays a fake call screen. The victim, unaware of the interception, is then routed to attackers posing as bank employees. The Trojan requests extensive permissions including access to contacts, microphone, camera, geolocation, and call control—typical for banking trojans but particularly dangerous in this context.

After intercepting a call, Fakecalls operates in two possible modes. It can directly connect the victim to human scammers disguised as bank support staff, or it can take control of the conversation itself using AI-generated voice responses. Currently, the voice imitation is limited to standard phrases in Korean typical of answering machines and call-center employees. The attackers exploit the false trust created by the victim initiating the contact, using social engineering to extract sensitive information such as payment data, login credentials, CVV codes, and verification codes.

A key vulnerability is the language mismatch: if the phone's interface is in English but suddenly displays a Korean call screen, users may detect the deception. However, for Korean-language users, this red flag disappears.

Kaspersky detects the threat as 'Trojan-Banker.AndroidOS.Fakecalls.' Recommended defenses include: download apps only from official app stores where security scanning occurs; carefully review and deny unnecessary permissions, especially for calls and messages; never disclose personal or financial information over the phone; verify suspicious calls by hanging up and contacting the bank directly via their official website; and install reputable cybersecurity solutions.