An app with the wrong permission is a wiretap. Five minutes a quarter finds them.
Never needed by ordinary apps
SMS (reads your OTPs); Accessibility service (can see and tap anything on screen — the favourite of banking malware); Device admin (blocks uninstall); Contacts (for loan apps — harassment); Call logs; ‘Display over other apps’ (fake login overlays).
How to review
Android: Settings → Privacy → Permission manager, go through SMS, Accessibility (under Accessibility → Installed apps) and Device admin apps; revoke anything that is not your messaging app, a genuine accessibility tool or your company's MDM. iPhone: Settings → Privacy & Security, review Contacts, Photos, Local Network and Screen Recording.
What to uninstall
Any app installed from a link / APK; any loan or ‘cashback’ app you do not use; any app that asked for Accessibility without an obvious accessibility purpose.
Checklist
- ☐SMS permission only on the messaging app
- ☐No unknown Accessibility services
- ☐No unknown Device admin apps
- ☐Loan / cashback apps you don't use removed
- ☐‘Install unknown apps’ disabled for browsers and chat apps