Android police virus: the fake police lock screen and how to remove it
The Android police virus is a scam that covers your phone with a fake FBI or police notice, accuses you of a crime and demands a fine. Do not pay: a browser page closes with the tab, and a locker app comes off in Safe mode once its Device admin right is switched off.
Facts checked October 9, 2026. Steps checked against Apple's and Google's current documentation and the reports we cite. We have not run the app or the link on a phone ourselves.
Do it yourself · free Remove Android police virus yourself 7 steps, about 21 minutes, no software needed.
Start the steps
Android police virus: summary
| Name | Android police virus (police locker, Koler, fake FBI or Europol lock screen) |
|---|---|
| Type | Screen locker for Android, or a browser lock page; it does not encrypt files |
| Symptoms | A full-screen notice from the FBI or a police force accusing you of a crime, returning after Home, and demanding a fine |
| How to get rid of it | App: Safe mode, Device admin off, uninstall. Browser page: close the tab, block notifications, clear site data. Never pay |
| Our check | Desk check on 9 October 2026: Kaspersky, Bitdefender and Microsoft research, Google's help; no live sample run |
| First seen | April 2014 (Koler, Kaspersky); our report 7 February 2020 |
Show 12 more facts
| Encrypted file extension | None: the notice claims encryption, but Koler had no file access |
|---|---|
| Ransom note | Not a file: a full-screen page with a police badge, your IP, country and city |
| Decryptor | Not needed: nothing is encrypted |
| Contact | No e-mail address; payment details are shown on the lock page itself |
| Detection names | Microsoft (later relative): Ransom:AndroidOS/MalLocker.B (shown as AndroidOS/MalLocker.B); Kaspersky: Trojan.AndroidOS.Koler.a; Bitdefender: Android.Trojan.Koler.A |
| Distribution | Fake video player apps on adult websites; the browser version needs no install |
| Damage | A phone you cannot use until the app is removed; money or card details lost if you pay |
| Evidence | One write-up by a security site; details still limited |
| Lock screen claims to be | FBI or police |
| Free decryptor | No free decryptor is known (checked 9 October 2026) |
| Microsoft Defender name | AndroidOS/MalLocker.B |
| Facts checked | 9 October 2026 |
Desk check on 9 October 2026 against Kaspersky's and Bitdefender's Koler research, Microsoft's 2020 MalLocker.B analysis and Google's help pages. No live sample was run.
What the Android police virus is and how it takes over the screen
The Android police virus is a fake fine: an app, or sometimes just a web page, that covers the phone with a notice from the FBI or a national police force, accuses you of a crime and asks you to pay to unlock it. The police never send such a notice, and in the cases researchers took apart nothing on the phone was encrypted.
- 1
You land on a trap page
The best-known version, Koler, came from a network of at least 48 adult websites. Kaspersky found that they passed visitors through a traffic system that checked the country and the device before choosing what to show.
- 2
You are asked to install a "video player"
On a phone the page offered an app, named animalporn.apk in Kaspersky's sample, pretending to be the player you need for the videos. Android only installs it if you allow apps from outside Google Play and confirm the install yourself.
- 3
The app checks where you are
Bitdefender saw Koler send the phone's IMEI number to its server and look up your country from your IP address. That is how the notice comes out in your language, with your country's police badge and your city.
- 4
The notice covers everything
A full-screen page says the phone is blocked, your files are encrypted and audio and video were recorded. It comes back whenever you press Home or try to open another app, so the phone looks frozen.
- 5
It asks for a fine
Koler asked for 100 to 300 US dollars (Kaspersky). Bitdefender's US sample asked for 300 dollars. The money goes to criminals, and paying does not reliably free the phone.
- Kind of threat
- Screen locker (police ransomware) for Android; it blocks the screen and, in the samples studied, did not encrypt files
- Best-known family
- Koler: Trojan.AndroidOS.Koler.a (Kaspersky), Android.Trojan.Koler.A (Bitdefender)
- First seen
- April 2014 (Kaspersky); Bitdefender reported it on 7 May 2014
- Who it pretends to be
- The FBI and a made-up "U.S.A. Cyber Crime Center" in the US, the Metropolitan Police in the UK, other national police elsewhere
- Typical demand
- 100 to 300 US dollars, or the same in local money
Our 2020 guide called this threat ransomware and said it could encrypt files and record you. Ransomware is the right family name, because it extorts money, but the two claims came from the lock screen itself. Bitdefender checked the app and found it did not even have the permission it would need to touch your files. This page is about the police-themed lock. For every other kind of phone locker, including the ones that change your PIN, read our Android ransomware guide.
What we checked for this update
The Android police virus is an app family, not one website we can open, so there was no live site test. Here is what we checked and what we could not.
Android police virus · desk check · 9 October 2026
- Vendor researchKaspersky and Bitdefender describe Koler in detail: install from adult sites, Geo-IP police notice, $100 to $300, no file access.
- Later variantMicrosoft's 2020 analysis of MalLocker.B confirms fake police notices kept being used, with a new way to stay on screen.
- Google's helpPixel Help gives the current Safe mode steps; Chrome Help gives the site notification settings.
- Live sampleNot run. The screens on this page are from 2014 and 2020.
- Reader reportsOne question, from May 2016, about a CYBER.POLICE lock. None newer.
A bluff, usually removable The notice is fake and a plain police locker comes off in Safe mode. The risk that stays is a payment you cannot get back, and any other app that arrived from the same site.
App locker or browser lock page: which one is on your phone?
A police notice on Android is either a page open in your browser or an app that draws over the screen. Two minutes of checking tells you which fix you need.
| What you see | What it is | What to do |
|---|---|---|
| The address bar or the browser's tab button is still visible above or below the notice | Browser lock page | Close the tab and clear the site's data (see the browser section) |
| The notice covers the whole screen, with no address bar, and comes straight back after Home | App locker | Safe mode, then switch off its Device admin right and uninstall it |
| The notice is back after a restart, before you open any app | App locker that starts with the phone | Safe mode, as in the plan below |
| The phone asks for a PIN you never set | A PIN-changing locker, not the classic police app | See our Android ransomware guide; a factory reset may be needed |
How to get rid of the CYBER.POLICE virus on my Android?? My phone is locked by the CYBER.POLICE virus. I cannot access my files or do anything else with my phone. Rebooting does not help.
A reader's question. A plain restart does not help with an app locker because the app starts again; Safe mode does, as the plan below shows.
A browser page cannot lock Android. It can only fill the tab, try to go full screen, play a siren sound or reopen itself through pop-ups. Kaspersky saw exactly this in 2014: the browser version showed the same police template as the app, but nothing was installed. If you also allowed the site to send notifications, the police warnings can keep arriving as notifications after you close the tab.
How Android police virus behaves
What the notice says, and what is true
Every line of the notice is built to scare you into paying fast. Read it next to the facts below.
| The notice says | What is true |
|---|---|
| "Your phone has been blocked up for safety reasons" | An app you installed is drawing its own page over the screen. No police force locks phones remotely to collect a fine |
| "All your files are encrypted" | Not in Koler's case: Bitdefender found the app had no permission to change your files. Your photos are where they were |
| "Conducted audio and video" | No study of Koler shows it recording you. The line is there to make you feel watched |
| You broke "Article 161 of United States of America criminal law" | There is no such US criminal code. The article number is invented, and the same text appears with other countries' flags |
| Your IP address, country and city | Taken from a Geo-IP lookup of your connection (Bitdefender). Any website can see the same |
| Pay a fine to avoid prosecution | The police never collect fines through a lock screen. The money goes to criminals and cannot be recovered |
Our 2020 text also said some versions claim to come from GVU, a German group that fights copyright infringement, or from a "national security service". We could not find a sample of the GVU version in the sources we read, so treat it as a name the old report listed, not as a confirmed variant.
From Koler in 2014 to the police notices of 2026
April 2014
Koler appears
Kaspersky dates the campaign to April 2014. The same network sent PC users to browser pages showing an identical police notice, which closed with Alt and F4, and sent Internet Explorer users to the Angler exploit kit. The browser part targeted 30 countries.
May 2014
Researchers describe the Android locker
Bitdefender reported Koler on 7 May 2014, with a $300 demand, an FBI page for US phones and a Metropolitan Police page for British ones. It said the app could be removed in Safe mode.
The US version of the 2014 notice, as our 2020 guide showed it: the FBI banner and the claim that files are encrypted and audio and video were recorded. 23 July 2014
The mobile part is switched off
Kaspersky reports that from 23 July 2014 the criminals' server sent an uninstall command to infected phones, deleting the app. The PC parts of the campaign stayed online.
February 2020
Our first guide
We described the Android police virus as a scam active mainly in Europe, with the notice adjusted to each country. Our wording on encryption and recording repeated the notice and is corrected on this page.
October 2020
Microsoft finds a new trick
Microsoft described AndroidOS/MalLocker.B, the newest member of a long-running locker family. Its note was "typically fake police notice or explicit images supposedly found on the device". Google had closed the old overlay trick, so it used a call-type notification that brought the lock page back every time you pressed Home.
October 2026
This rewrite
We found no fresh, named Android police locker campaign in the vendor sources we read for this update. The police-themed lock page in the browser is the form you are now most likely to meet. Treat any screen like the ones above as a scam.
What the fake police notice can really cost you
The crime it accuses you of is invented. The real risks are the payment, your personal data, and whatever else you installed from the same page.
- High
Money you cannot get back
The fine goes straight to the criminals. Vouchers, gift card codes and crypto payments cannot be reversed, and paying does not guarantee the screen goes away.
- High
Card details handed over
If you typed a card number into the lock page, the criminals have it. Our 2020 guide warned of exactly this, and it remains the most expensive mistake.
- Medium
Other apps from the same site
A site that pushes a fake video player can push other apps too. Check the full app list after removal, not only the locker.
- Low
Your files
Koler did not encrypt files. If your photos really do have a new extension and will not open, you have a different, file-encrypting locker; read our Android ransomware guide.
The Android police virus ransom note
ATTENTION!
Your phone has been blocked up for safety reasons listed below.
All the actions performed on this phone are fixed.
All your files are encrypted.
CONDUCTED AUDIO AND VIDEO.
Can Android police virus files be decrypted?
Act today. A card payment can sometimes be disputed; a voucher or gift card code that is still unused can sometimes be frozen.
- 1
Call your bank or card issuer
Use the number on the back of your card, not one from the lock page. Tell them the payment was made under a fake police threat and ask them to block the card and dispute the charge.
- 2
Contact the voucher or gift card company
Give them the code and the time you sent it. If the criminals have not spent it yet, the company may be able to freeze it.
- 3
Change passwords from another device
Change your Google password first, then e-mail and banking. Do it from a computer or another phone, not the one that was locked.
- 4
Keep the evidence
Keep a photo of the lock screen, the amount, the payment method and the time. You will need them for the bank and the police report.
How to remove Android police virus
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove the police virus from an Android phone
Do not pay. If the notice is in your browser, skip to the browser section after this plan. If it is an app, Safe mode stops it from starting, and then you can remove it.
Paths are for Pixel and stock Android 14 and 15; Samsung One UI names are given where they differ.
Step 1: Photograph the notice and go offline
Take a picture of the lock screen with another phone, so you keep the police name, the amount and the payment method for a report.
If quick settings still open, turn on Airplane mode so the app cannot reach its server. Do not type anything into the payment box.
Step 2: Start in Safe mode
On a Pixel 6 or later, press and hold Power and Volume up, then touch and hold Power off and tap OK.
On a Pixel 5a or earlier, hold Power and touch and hold Power off. On a Samsung, press the Side key and Volume down, then touch and hold Power off and tap Safe mode.
If the menu will not open, switch the phone off, press Power, and hold Volume down while the start animation plays. You will see Safe mode at the bottom of the screen, and downloaded apps, the locker included, do not start.
Step 3: Remove its Device admin right
Open Settings > Security & privacy > More security & privacy > Device admin apps (Samsung: Settings > Security and privacy > Other security settings > Device admin apps). Find My Device belongs there. Switch off anything you do not recognise and tap Deactivate; without this, the Uninstall button can stay grey.
The Device admin apps list on Android 14. A police locker that took admin rights appears here as an extra entry; switch it off before you uninstall. Step 4: Uninstall the locker
Open Settings > Apps > See all apps (Samsung: Settings > Apps). Look for anything you installed just before the lock, especially a video player, codec or "update" with no Play Store page.
Tap it and tap Uninstall. Google advises removing recent apps one at a time and restarting after each.
Step 5: Restart and check with Play Protect
Restart the phone normally to leave Safe mode. Open the Play Store, tap your profile picture > Play Protect > Scan. If the notice comes back, go into Safe mode again and look for a second app.
Step 6: If nothing helps, reset
If the lock returns even in Safe mode, or the phone now asks for a PIN you never set, you have a stronger locker.
A factory reset erases everything not backed up; the steps and the checks before you do it are in our Android ransomware guide. You will need your Google account password during setup.
Step 7: Change your passwords
From a clean device, change your Google password, then e-mail and banking. Check your bank statement. Then report the notice, as shown below.
If it is a browser lock page
Nothing is installed, so you only need to close the page and stop the site from coming back.
- 1
Close the tab
Tap the tab switcher (the square with a number in Chrome), find the police page and tap its X. If the browser keeps jumping back, open Settings > Apps > See all apps > Chrome > Force stop, then open Chrome again and close the tab before it loads.
- 2
Block its notifications
In Chrome tap More (three dots) > Settings > Site settings > Notifications and look for the site's address under allowed sites. Tap it and choose Block. If a warning arrives in your notification shade, Chrome may also offer Unsubscribe there.
- 3
Clear the site's data
In Chrome go to Settings > Site settings > All sites, tap the site and tap Delete & reset (the button name can vary between Chrome versions). This removes what the page stored so it cannot restore itself.
- 4
Turn off pop-ups
In Chrome tap More > Settings > Permissions > Pop-ups and redirects and turn it off. On Samsung Internet, open the menu (three lines) > Settings > Sites and downloads and turn on Block pop-ups.
- 5
Leave the rest alone
Do not call any number on the page and do not install the "cleaner" or "security app" it may suggest. If notifications keep coming after these steps, an app is sending them, so follow the plan above.
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
How to know a real police message from this one
Real police do not lock your phone and do not ask for a fine through a pop-up. Kaspersky's advice is plain: you will never get an official ransom message from the police, so never pay one.
| Sign | Fake police notice | Real police contact |
|---|---|---|
| How it reaches you | A page over your screen or in your browser | A letter, a visit, or a call you can check through the force's official number |
| What it asks for | A fine paid now, by voucher, gift card, card number or crypto | Never a payment to unlock a device |
| Deadline | Hours, often with a countdown | Legal steps with time to get advice |
| Who it names | "FBI", "Department of Defense", "Cyber Crime Center" together, or your country's police with your IP and city | One named force or court, with contact details you can look up yourself |
How to prevent Android police virus and the next attack
Koler needed you to agree twice: once to allow apps from outside Google Play, and once to install the app. Saying no to both stops it.
Do
- Install apps only from Google Play or your phone maker's store
- Keep Scan apps with Play Protect on (Play Store > your profile picture > Play Protect > settings)
- Keep Android and Chrome updated
- Follow the 3-2-1 rule for backups: three copies of your photos and files, on two kinds of storage, one kept off the phone (Google Photos or a computer), so a reset never costs you anything
- Use a VPN on public Wi-Fi so the networks you join see less about you
Don't
- Allow Install unknown apps for Chrome or any other browser
- Install a "player", "codec" or "update" a website asks for to show a video
- Download cracked apps and games from forums or file-sharing sites
- Tap ads or pop-ups that say your phone is infected or under investigation
- Allow notifications from sites you do not know
To check the unknown-apps setting, open Settings > Apps > Special app access > Install unknown apps (Samsung: Settings > Apps > the three dots > Special access > Install unknown apps). Every browser and file manager there should be Not allowed unless you use it to install apps on purpose. For other phone threats, see how to remove malware from Android and how to check your phone for spyware.
Questions about Android police virus
Should I pay the ransom to unlock my phone?
No. Paying does not reliably unlock the phone, and the money cannot be recovered once it is sent. The fine is not real, so there is nothing to settle. Koler asked for 100 to 300 US dollars, and the people behind it had no reason to keep any promise.
If the app is still on the phone, it can simply ask again. The same lock comes off without paying: Safe mode stops it from starting, and then you can switch off its admin right and uninstall it. If you already paid, call your bank or the voucher company today.
How do I open my .jpg photos and other files after the police notice locked the phone?
Open them as usual once the lock is gone. Bitdefender found that Koler did not even have the Android permission it would need to change your files, so the line "All your files are encrypted" is part of the bluff. Your .jpg photos, videos, contacts and downloads keep their names and open normally.
You can check before you finish the cleanup: start in Safe mode and open a few photos in the gallery. If your files really do show a new extension and will not open, a different, file-encrypting locker is on the phone; our Android ransomware guide covers that case.
Is there a decryptor for the Android police virus?
You do not need one, because the police lockers researchers studied did not encrypt anything. What you need is removal: Safe mode, the Device admin switch and Uninstall, or closing the tab if it is a browser page.
Be careful with sites and apps that offer an "unlock code" or a "police virus decryptor" for a fee; they are selling a fix for a problem you do not have, and some are a second scam. If your files truly are encrypted, check No More Ransom (nomoreransom.org) for a free tool for that family before anything else.
Do paid unlock services or data recovery companies help?
Not with this lock. A police locker leaves your files readable, so a data recovery company has nothing to recover, and the removal steps are free. Ads that promise to unlock a police screen for money are often run by the same kind of people who made the lock.
A phone repair shop is a reasonable choice if you cannot reach Safe mode or want help with a factory reset: ask what they will do first, and keep your Google password to yourself. Never let a stranger who contacted you install a remote-control app on the phone.
Will Fortect remove the Android police virus?
No. Fortect is a program for Windows and Mac and does not run on Android phones, so it is not the tool for a locked phone. On the phone, use the plan above:
- Safe mode
- the Device admin switch
- Uninstall
- a Play Protect scan
The same criminals also showed police lock pages to computer users in 2014, and if your PC shows a police notice too, our police virus guide for Windows covers that. On a computer, Fortect can be part of the cleanup after the lock is gone, together with a full scan by your security program.
How did the police virus get on my phone?
In the Koler campaign, it came from adult websites that offered a fake video player app. Bitdefender noted that it could not install itself silently: you had to allow apps from outside Google Play and confirm the install.
Later lockers used the same trick with cracked games, video players and fake updates posted on forums, as Microsoft described in 2020. To stop it happening again, keep Install unknown apps set to Not allowed for every browser, keep Play Protect scanning on, and never install an app that a web page says you need to watch a video.
Did the police virus steal my data or record me?
There is no evidence that Koler recorded you; the line "CONDUCTED AUDIO AND VIDEO" is there to make you feel watched. What it did send, according to Bitdefender, was the phone's IMEI number, and it looked up your country from your IP address.
The real data risk is a card number typed into the lock page, and any other app installed from the same site. After removal, open Settings > Security & privacy > Privacy > Permission manager and check Camera, Microphone and SMS for apps you do not recognise. Change your Google password from another device to be safe.
Is the Android police virus different from the police virus on a PC?
Yes, in how it runs, though the notice looks the same. On Windows the police virus was a program, Reveton being the best-known family, that started with the PC. On Android it is an app you were tricked into installing, or just a page in Chrome.
An Android app cannot run on Windows, so the phone lock does not spread to your computer. A browser lock page is the mildest form: nothing is installed, and closing the tab plus clearing the site's data is enough. Our police virus guide for Windows covers the PC version.
Sources
- Kaspersky: Koler 'police' mobile ransomware (read October 9, 2026)
- Bitdefender HOTforSecurity: Koler Android malware demands $300 ransom from its victims (read October 9, 2026)
- Kaspersky: Koler, the 'Police' ransomware for Android (2014 paper) (read October 9, 2026)
- Microsoft Security Blog: Sophisticated new Android malware marks the latest evolution of mobile ransomware (read October 9, 2026)
- Pixel Phone Help: Find problem apps by rebooting to safe mode (no longer online) (read October 9, 2026)
- Google Chrome Help (Android): Use notifications to get alerts (no longer online) (read October 9, 2026)
- Google Play Help: Use Google Play Protect to help keep your apps safe (no longer online) (read October 8, 2026)
- FBI Internet Crime Complaint Center (read October 9, 2026)