Browser Notification Spam: The 'Click Allow to Continue' Trap through an app

How it looks through an app, the red flags and what to do.

Scam apps pretend to be a bank, a loan service, a game, a government service or a "support tool", and they ask for access to SMS, contacts, the screen or accessibility. Browser Notification Spam: The 'Click Allow to Continue' Trap is one of the ways this shows up: A website says 'tap Allow to prove you are not a robot' and then floods your phone with scam alerts. Learn how to stop and remove them.

What browser notification spam: the 'click allow to continue' trap looks like through an app

• A loan app that asks for contacts and photos.
• A "KYC", "challan" or "bank rewards" app from a link.
• An .apk file sent on WhatsApp or by SMS.

The set-up is a web page that triggers the browser's permission prompt, usually after a fake captcha or a countdown. The text near the prompt is misleading, for example 'Click Allow to continue' or 'Confirm you are over 18'. Many people tap quickly because it seems part of normal page loading. The permission is stored by the browser, and the website can then send alerts at any time, using the browser's own notification system.

Red flags to check on the app

• A page asks you to press Allow to prove you are human or to continue.
• Notifications appear from the browser though you did not install an app.
• Alerts claim viruses, damage or prizes and use countdowns.
• Tapping an alert opens advertising or a download page.
• You were told to install it by a stranger or a caller.
• It has few or odd reviews, or a name with spelling changes.

What to do

1. Press and hold a spam notification, tap the settings icon and turn off notifications for that site.
2. Open your browser's site settings and remove notification permission for unknown sites.
3. Do not tap alerts that claim viruses, prizes or low battery.
4. Do not install it. If it is installed, uninstall it now (Settings, Apps).
5. Open Settings and check Accessibility, Device admin apps and Install unknown apps for anything you do not recognise.
6. Change the passwords of your bank and email from a clean device if the app had access.

Report the fake app to the store it came from and, if money moved, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. If you paid or shared card details, call 1930 and report at cybercrime.gov.in.
2. Call your bank on the number on your card and ask them to block the card if needed.
3. Check your mobile bill or subscriptions for unwanted charges and ask your operator through its official app to stop them.
4. Remove any app you installed after tapping a notification.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Link check in Safeavio Sentinel can test a link from a spam notification before you open it, and Scam check can explain why a prize or virus message looks risky. Phone scan reviews installed apps and permissions if you installed a cleaner after a warning. Safeavio does not manage browser notification settings for you, so use the browser's site settings to remove permission.

Full guide: Browser Notification Spam: The 'Click Allow to Continue' Trap: how it works, signs and what to do. Other channels: SMS, social media, WhatsApp.

Questions