
Only SMS app need SMS permission, nothing else.

Most important is to check for SMS permissions. You can go to permissions list of the app and see all device administration apps. How can you identify these kinds of apps? “These are remote control apps and have device administration permissions. While number of such fraud cases are few, we urge consumers to be careful," noted NPCI. “Once access is granted by the victim, the fraudster cannot only initiate financial transactions but can also place online shopping orders using the apps available on the victim’s phone or even steal information stored on it. Similarly, in apps too you have this feature which can be used to access your mobile screen.

It usually happens in office when your IT department wants to work on your computer screen from a remote location. You must be aware of remote screen access for your computer or laptops.
