Scammers in India are sending fake .apk files on WhatsApp dressed up as bank updates, India Post parcel trackers, KYC apps, wedding invitations, and power bill apps. Once you tap install, the app quietly reads incoming SMS, forwards every OTP to the attacker, and drains your UPI wallet or bank account in minutes. Real bank apps live only on Google Play or the App Store. They are never sent on WhatsApp. If a stranger or even a known contact sends you an .apk file, do not install it. CERT-In, RBI, and state cyber cells have all issued advisories. If you already installed one, turn on aeroplane mode, call your bank, then call 1930.
Who this is for
Anyone in India who uses WhatsApp and a bank account on the same phone, which is almost every adult in the country. The most targeted profiles in 2026: senior citizens who receive forwarded messages from family groups, working professionals in their 30s and 40s, small business owners who run UPI collections, women receiving wedding invitations, and parents waiting on a delivery. The script does not need you to be technically naive. It needs you to be busy and trusting.
What is actually happening when you install an APK on WhatsApp
An APK is an Android Package, the install file format for any Android app. Apps you get from Google Play are also APKs, but they go through Play Protect scans, a developer verification process, and platform-level signing checks before they reach your phone. An APK sent on WhatsApp skips all of that.
When you tap an .apk attachment on WhatsApp, Android asks you to allow installation from unknown sources. If you tap yes, the app installs. Once installed, the malicious version typically asks for:
- SMS read and receive permission (so it can intercept OTPs)
- Contacts permission (so it can spread to your address book later)
- Notifications access (so it can read bank alerts and OTPs that appear as notifications)
- Accessibility services (so it can read text on the screen including OTPs typed by you)
- Default SMS app permission (so OTPs route to the attacker, not your real SMS app)
Once those permissions are granted, the attacker has effectively root-level visibility into your communications without ever touching the phone. Every OTP your bank sends you is forwarded to a server controlled by the attacker, often within seconds. A few UPI transactions later, your account is empty.
This is the dominant Android banking fraud vector in India for 2024 and 2025. CERT-In’s advisory on banking trojans covers this exact pattern. The Reserve Bank of India has warned customers about fake app installs repeatedly. State cyber cells across Telangana, Karnataka, Maharashtra, and Delhi have run public awareness campaigns through 2025 and 2026.
The seven disguises we keep seeing
Every variant uses the same install mechanism. The wrapper changes to match what the victim is likely expecting.
- Bank app update. ‘Your HDFC / SBI / ICICI / Axis app needs an urgent KYC update. Install the attached file before 6 PM today or your account will be frozen.’ The icon mimics the real bank logo.
- India Post or courier tracking app. ‘Your parcel is held at customs. Install the tracking app to clear it.’ Sometimes branded as FedEx, DTDC, Blue Dart, or Delhivery.
- KYC verification app. ‘Government KYC drive. Install attached app to verify your Aadhaar / PAN linkage.’ Often impersonates UIDAI or NPCI.
- Wedding invitation. ‘Click the attached invite to RSVP.’ Often comes from a name you half-remember or a number that looks Indian. This variant exploded in late 2024 and continues through 2026.
- Electricity, water, or gas bill app. ‘Your power will be disconnected in 2 hours. Install attached app to pay.’ Mimics BESCOM, BSES, MSEB, or local utility branding.
- PM Kisan, scholarship, or subsidy app. ‘Apply for your subsidy.’ Targets rural and senior recipients of government schemes.
- Tax refund or e-filing app. ‘Income tax refund pending. Install app to receive credit.’ Spikes around July to September each year.
The visual polish has improved. The icons are professional. The app name in the install dialog often matches the brand exactly. The first screen after install looks like a real login page. The deception is engineered to survive a quick glance.
A few publicly reported Indian cases
These were carried in mainstream Indian press in the last 18 months. We are citing them to show that the loss numbers are real, the demographics span widely, and the response window is narrow.
Telangana, 2024 to 2025. Telangana State Cyber Bureau flagged the APK fraud pattern as one of the top three banking fraud vectors in the state, with thousands of complaints traced to wedding invitation and India Post APKs (Telangana Today coverage of cyber bureau advisories).
Bengaluru, 2025. A retired bank employee lost more than INR 18 lakh after installing what he thought was an updated SBI app forwarded on a family WhatsApp group. The APK had been sent originally by a compromised contact (Deccan Herald cybercrime reporting).
Mumbai, 2025. Maharashtra cyber cell reported a sharp rise in wedding-invitation APK fraud, with a 76-year-old woman losing more than INR 1.4 crore over a sequence of UPI transfers initiated by the attacker after a single install (Hindustan Times coverage of Mumbai cyber cases).
Chennai and other Tamil Nadu cities, 2024 to 2025. Tamil Nadu cyber crime wing publicly warned about fake India Post and Blue Dart APK files circulating on WhatsApp ahead of festival season delivery surges (The Hindu coverage of Tamil Nadu cyber advisories).
Northeast India, 2025. Assam police flagged a sustained campaign targeting government scheme beneficiaries with fake PM Kisan and farmer subsidy APKs (Indian Express coverage of regional cyber cases).
What these cases share: the install happened in seconds, the OTP theft happened silently, the bank only contacted the victim after the funds had moved, and the average response window between install and account drainage was under 30 minutes. By the time the victim realised, the money had already been layered through mule accounts.
How to spot a fake app before you install
Even when the disguise is good, the install request itself carries tells. Any one of these is enough to delete the file and not install it.
1. The file is an .apk attachment on WhatsApp, SMS, or email
Real banks, real government departments, and real utilities do not distribute apps as APK attachments. They list their app on Google Play and the App Store and send you a Play Store or App Store link if anything. An .apk attachment is the strongest single signal.
2. Android shows ‘Install from unknown sources’ warning
The warning exists for a reason. Even if you have allowed unknown sources for one app in the past, every fresh install of this kind triggers the prompt. Read it. It is Google telling you the publisher is not verified.
3. The icon looks right but the developer name is wrong
After install, long-press the app icon and check the app info. Real bank apps will show the bank’s verified publisher name (HDFC Bank Ltd., State Bank of India, ICICI Bank Limited). Fake APKs often show random alphanumeric strings, individual personal names, or names that mimic the real one with small spelling changes.
4. The app demands SMS, accessibility, and notification permissions at first launch
A bill payment app does not need to read your SMS. A wedding invite app does not need accessibility access. A courier tracking app does not need to be your default SMS app. If the permission requests do not match what the app claims to do, the app is malicious.
5. The message creates artificial urgency
‘Account will be frozen by 6 PM,’ ‘parcel will be returned today,’ ‘subsidy expires tonight.’ Real banks and government departments do not give 2-hour windows over WhatsApp. Urgency is the lever the scammer is pulling. When you feel pressured, slow down. That is the moment to stop.
6. The sender is unknown, or known but acting out of pattern
A spouse, sibling, or colleague forwarding a sudden bank app install is often a compromised account themselves. The malicious APK self-propagates by sending itself to the victim’s contacts. If a known contact sends you an APK, call them on a separate channel before installing anything.
What to do if you already installed one
If you tapped install, granted permissions, and now suspect you have been hit, the response is time-critical. Money typically moves within minutes.
- Switch to aeroplane mode immediately. This stops further SMS and OTP forwarding to the attacker and breaks any active session the app has open. Do this first, before anything else.
- Call your bank’s emergency line from a different phone if possible. Tell them you have installed malware, ask for a card block, UPI freeze, mobile banking lock, and net banking lock. Most major Indian banks have a 24x7 fraud reporting number. Save these in your phone now, not later.
- Do not factory reset the phone yet. Reset will wipe evidence the police and bank will need. First take screenshots from another phone or device of the malicious app icon, the WhatsApp message that delivered the APK, the sender number, and the install date in the app info screen.
- Call 1930. This is the national cybercrime helpline operated 24x7 by I4C under MHA (I4C). The earlier the call, the better the chance of mule-account freeze.
- File a formal complaint at cybercrime.gov.in within 24 hours. Provide bank statement, the recipient account or UPI ID where money moved, the malicious APK file name, the sender WhatsApp number, screenshots, and timestamps.
- Notify your bank’s fraud team in writing. The phone call is the first step. A written email or branch visit creates a paper trail that helps with the eventual chargeback or compensation claim under RBI’s limited customer liability framework.
- Now factory reset the phone. Settings, system, reset, erase all data. After the reset, do not restore from a recent backup that may contain the malware. Restore only from a backup made before the install date, or set up the phone fresh.
- Change every password from a clean device. Email, bank, UPI PIN, social media, work accounts. Assume the attacker captured everything that passed through the phone during the window the malware was active.
- Warn your contacts. The malware likely sent itself to your address book. A short message saying ‘my number was used to send a fake app, do not install anything from me’ helps stop the chain.
Why Google Play and the App Store actually matter
For everyday users, the difference between a Play Store install and a WhatsApp APK install is the difference between a verified vendor with auditable accountability and a stranger handing you a pill in a paper bag.
Google Play runs Play Protect, which scans every app on install and periodically thereafter. Apple’s App Store runs human and automated review on every app submission. Both maintain publisher verification and a take-down mechanism that gets weaponised against fraud campaigns. Neither system is perfect, but the failure rate is orders of magnitude lower than ad-hoc APK installs.
If you want the real bank app, open Google Play, search for the bank by name, check the developer name matches the official one on the bank’s website, check the install count is in millions, and install from there. If you want to verify a government app exists, the official government department’s website will link to the Play Store listing. If neither path produces the app, the app does not exist and the WhatsApp version is a fake.
Got an .apk file or a suspicious install request? Send it to us, we verify free
If you received an APK on WhatsApp, an SMS install link, or any unsolicited app request and you want a sanity check before installing, send it to us privately.
WhatsApp / Call: +91 99644 43350
Forward the WhatsApp message, the file, the sender number, or screenshots. We tell you whether the install is safe or a known scam, in plain language, free.
What we do:
- Cross-check the file hash and sender number against known malicious campaigns
- Check whether the app is actually listed on Google Play under the claimed publisher
- Verify whether the urgency claim (KYC deadline, parcel hold, subsidy expiry) matches anything real from the actual institution
- Walk you through safe response steps if you already installed something
What we do not do:
- Charge you for the verification
- Ask for your bank details, OTPs, or UPI PIN
- Pretend to be a bank, government department, or law enforcement agency
Verification is free. You only pay if you want deeper engagement: investigation support, recovery assistance, or ongoing security guidance for your family. We also publish related guides on WhatsApp GhostPairing account takeovers, SMS scam clusters, and fake loan apps.
Need help beyond verification?
If you need hands-on help with execution (beyond the free verification and knowledge sharing above), that can be scoped as a paid engagement. Each situation is different (money already moved, business account compromised, multiple family members hit, ongoing protection needed for senior parents), so we don’t pre-package what’s in scope: we’ll talk through what you’re dealing with and tell you honestly whether we can help and what it would look like.
WhatsApp +91 99644 43350 or contact Cybersecify to discuss.
Save this number now
If you ever receive an .apk file, a fake bank update, or any suspicious app install request: WhatsApp +91 99644 43350. Save it now. During an active scam, you will not have time to search.
We also publish a Karnataka citizen safety guide and a traffic challan SMS scam explainer for the same broad Indian audience this scam targets.
Frequently asked questions
What is the malicious WhatsApp APK scam?
A scammer sends an .apk file on WhatsApp pretending to be a bank update, an India Post or courier tracking app, a KYC verification app, a wedding invitation, or a power bill app. When you tap and install it, the app asks for SMS, contacts, accessibility, and notification permissions. It then quietly reads incoming OTPs, forwards them to the attacker, and is used to drain UPI wallets and bank accounts. CERT-In has issued multiple advisories on this category. Real bank apps are never sent on WhatsApp. They live only on Google Play and the official App Store.
How is this different from the WhatsApp GhostPairing scam?
Different attack. GhostPairing tricks you into linking the scammer’s browser to your WhatsApp account using the Linked Devices feature, so they read your chats and messages. The malicious APK scam installs a separate Android app on your phone that reads SMS, contacts, and bank OTPs. GhostPairing targets your WhatsApp identity. The APK scam targets your money. Both can run on the same victim at the same time.
Is it safe to install any APK file outside Google Play?
For everyday users, no. Sideloading an APK bypasses Google Play Protect scanning, the Play Store review process, and the publisher verification chain. The only safe install paths are Google Play, the Apple App Store, or a known-good enterprise MDM portal at work. If someone sends you an .apk file on WhatsApp, Telegram, SMS, or email, treat it as malware until proven otherwise.
What do I do if I already installed a fake APK?
Five steps. One, turn on aeroplane mode immediately to stop SMS and OTP forwarding. Two, call your bank’s emergency line, freeze cards, and lock UPI. Three, do not factory reset yet, because evidence will be wiped. Take screenshots of the app icon, the WhatsApp message that sent it, and the install date. Four, call 1930 and file at cybercrime.gov.in within 24 hours. Five, factory reset the phone after the FIR is filed, then restore only from a verified backup.
Can iPhone users get hit by this scam?
The APK-install version of the scam does not work on iPhone, because iOS does not run .apk files and sideloading is heavily restricted. iPhone users still face other versions: fake TestFlight invites, configuration profile installs, phishing links that ask for Apple ID credentials, and the same OTP-theft outcome via SIM swap. Do not assume iPhone makes you safe. The attack pattern adapts. Treat any unsolicited app install request as a scam regardless of device.
Foundational reads. The anchors behind every guide on this site.
- The First Hour After Cyber Fraud in India. What to do in the first 60 minutes after you realise you have been scammed.
- Pause, Verify, Then Act. The universal three-rule defence against every scam type.
- Your Digital Footprint Is the Scam’s Raw Material. Why scammers already know your name, employer, and bank.