Additional resource for the lesson “Unexpected Charges: When the Bill Is the Signal” — Online Security course
Unexpected phone charges are one of the few security signals that arrive by post. A bill higher than usual, data that ran out early, a subscription nobody remembers starting — each has an ordinary explanation, and occasionally a different one.
A. Why this matters
The companion resource covers a phone running slow. This one covers a different signal, and an unusually direct one: money.
Software installed without your understanding sometimes monetises directly — sending messages to premium numbers, subscribing you to services, or moving data continuously in the background. That produces a number on a bill, which is easier to notice than almost any other symptom.
The key idea: a charge you cannot explain is worth ten minutes of attention, not because it is probably malware, but because it is probably something — a forgotten subscription, a mistaken tariff, or occasionally this.
B. Key concepts
Six ideas about how a phone costs money quietly.
Premium rate messages
Text messages to short numbers that carry a charge, sometimes recurring.
Why it matters to you: Software can send these without any visible sign. They appear on the bill as small amounts that are easy to overlook, which is exactly the design.
Hidden subscriptions
Recurring charges started through an app, a website, or a message you replied to once.
Why it matters to you: Not all of these involve malware. Many are legitimate services with a design intended to make the subscription easy to start and hard to notice.
Smishing
Phishing by text message: a link that leads to a fake page or an app install.
Why it matters to you: Worth naming because it is the most common route in. A message about a delivery, a fine, or a bank alert, with a link — the same technique as email phishing, with less room on screen to spot it.
Background data
Software sending or receiving data continuously, using your allowance and, when abroad, incurring roaming charges.
Why it matters to you: This is the symptom shared with the resource on a slow phone. When it shows up as cost rather than performance, the data statistics are the same place to look.
Reading the bill
Most people never look at the itemised part of a mobile bill.
Why it matters to you: Ten minutes once a quarter is enough. You are looking for categories you do not recognise, not for individual amounts.
Your operator can help
Operators can block premium rate services entirely on a number, usually free of charge.
Why it matters to you: This is the practical measure almost nobody knows about, and it removes the whole category permanently.
C. A practical example: eleven euros a month
A bill is nine euros higher than usual. Not enough to trigger alarm — enough to notice on the second month.
- The itemised section shows a recurring charge for a service nobody recognises.
- Mobile data ran out ten days early, twice.
- Looking back, a text about an undelivered parcel arrived around the time it started, and the link in it was opened.
The message was smishing. The link led to an app install that has been sending premium messages and moving data ever since.
Resolving it, in order
- Contact the operator: cancel the service, dispute the charges, and ask them to block premium rate services on the number.
- Find and remove the app, using the installed list and the date the charges began.
- Run the phone’s built-in protection.
- Change the credentials used from the phone during that period, starting with email.
The operator step comes first because it stops the cost immediately, and because the block is permanent once applied.
D. Try it yourself: read one bill properly
Fifteen minutes, once. Then quarterly is enough.
Step 1 — Open the itemised bill
- In the operator’s app or web account, not the summary email.
- Look for categories rather than amounts: services, subscriptions, premium numbers.
Step 2 — List what you do not recognise
- Anything recurring that you cannot name.
- Some will turn out to be legitimate services you forgot. That is a useful finding too.
- Most operators can bar premium rate services on request, at no cost.
- This closes the category rather than dealing with instances.
Step 4 — Check data use per app
- Settings, Network or Mobile data, usage by app.
- An app you rarely open near the top of that list is the concrete lead.
Step 3 is the one worth doing regardless of whether you find anything. It takes a phone call and removes an entire class of charge.
E. Videos, articles and further resources
Independent and institutional sources in English.
FTC — Malware: how to protect against, detect and remove it
How unwanted software arrives and the sequence for removing it.
https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
NCSC (UK) — Phishing: spot and report scam messages
Recognising and reporting scam messages, including the text-message form that usually starts this.
https://www.ncsc.gov.uk/collection/phishing-scams
FTC — How to protect your phone from hackers
Protecting the phone, and what to do when charges appear that you did not authorise.
https://consumer.ftc.gov/articles/how-protect-your-phone-hackers
NCSC (UK) — What to do if your device is infected
A calm sequence of steps for when a device is behaving strangely.
https://www.ncsc.gov.uk/section/respond-recover/citizen-infected-devices
CISA — Recognize and report phishing
The signals that give a phishing message away, and what to do with it once you spot one.
https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
Google — Use Play Protect to keep your apps safe and your data private
How Android checks apps before and after installation, and how to review the permissions you have granted.
https://support.google.com/android/answer/2812853?hl=en
Links checked in August 2026. Your mobile operator’s own support pages will describe how to block premium rate services on your number, which varies by country and provider.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Awareness pillar at level FL2. The signal is financial, which makes it unusually concrete.
Skills
- Reading an itemised mobile bill and identifying recurring charges.
- Asking an operator to block premium rate services.
- Tracing a charge back to the app and the date it started.
For professionals and organizations
- Reviewing charges on company mobile accounts, where unexplained costs are easily absorbed.
Awareness
- Understanding that some unwanted software monetises directly rather than stealing data.
- Recognising smishing as the common route in.
- Knowing that the bill is a security signal, and one that arrives on its own.
For future instructors and ambassadors
- Mentioning that many hidden charges are legitimate services with awkward design. It keeps the advice honest.
Secure Behavior
- Checking the itemised bill quarterly.
- Not opening links in unexpected messages about deliveries, fines or bank alerts.
- Installing only from official stores.
For organizations
- Blocking premium rate services on company numbers as a default.
G. Questions to sit with
- When did you last look at the itemised part of your mobile bill?
- Are there recurring charges on it you could not name?
- Has your data allowance run out earlier than usual recently?
- Do you know whether your operator can block premium rate services on your number?
H. What to do now
The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply here.
Preventing it
- R17 — Do not open links or attachments in unexpected messages, including text messages.
- R6 — Keep the system and apps updated, with automatic updates on.
- MS12 — Check where your phone number appears publicly, and request removal where you can.
Minimum commitment: And, outside the framework: ask your operator to bar premium rate services. It is free and permanent.
After finding something
- R1 — Change the credentials used from that device, without reusing them.
- R4 — Turn on multi-factor authentication so a captured password is not enough.
- R8 — Check login alerts and recent access on the affected accounts.
In short
- This is the security signal that arrives with a number attached — the easiest to catch.
- Premium messages and hidden subscriptions are designed to be small enough to overlook.
- Smishing is the usual route in: a text about a parcel, a fine, or a bank alert.
- Ask your operator to block premium rate services. It is free, and it closes the category.
Related resources in this course
The other symptoms, and the subscriptions that are not malware at all:
- When Your Phone Runs Slow: Reading the Symptom Properly
- Adware on Your Phone: Reading the Unwanted Ads
- Avoiding Fleeceware Scams and Apps with Hidden Costs
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply