APK file scams: a “challan” or “wedding card” that installs malware
Files and links ending in .apk install an Android app from outside the Play Store. Scammers send them as an RTO e-challan, PM Kisan update, bank reward points or a wedding invitation, often from a hacked friend’s WhatsApp. Once installed, the app can read your SMS and OTPs, forward messages and drain your bank account. Never install an .
apk from a chat or link. If you did, turn on airplane mode, uninstall it and call your bank.
Last updated: Reviewed by IndiaDigital editorsSources
How does this scam work?
- A message with an urgent reason: unpaid challan, reward points expiring, an invitation.
- A file named like mParivahan.apk, SBI_Rewards.apk or Wedding_Card.apk.
- Installing it asks for SMS, notification and accessibility access.
- The app reads OTPs and sends them to the scammer, who takes your money.
Real-style examples
Numbers and links are changed. The red flags are marked by the same engine that runs in the Scam Checker.
RTO Traffic Challan of Rs 500 issued for your vehicle. Download the e-Challan app to pay: mParivahan.apk
- .apk app file
- Asks you to install an app from a link
Red flags: how to spot it
- A file or link ending in .apk
- “Download this app from this link”
- Requests for SMS or accessibility permissions
How to check if it is real
- Check challans only on echallan.parivahan.gov.in.
- Install apps only from the Play Store, from the real developer.
What to do if you get one
- Turn on airplane mode, uninstall the app.
- Call your bank to block cards and UPI; change passwords from another device.
- Lost money? Call 1930.
Remember: An .apk file installs an app from outside the Play Store and can read your SMS and OTPs. Never install one sent in a chat.
Lost money? What to do in the first hour
- Call 1930 now. The National Cyber Crime Helpline. The first hour matters most: a quick report lets banks try to hold the money before it moves on.
- File the complaint on cybercrime.gov.in. Add the transaction ID or UTR, amount, time, the UPI ID or account the money went to, and screenshots. Note your complaint number.
- Tell your bank and freeze cards and UPI. Call the number on your card or in the bank app. Reporting within 3 working days can limit your liability under RBI rules.
- Keep the evidence, beware “recovery agents”. Don’t delete chats. Anyone who charges a fee to get your money back is running a second scam.
Frequently asked questions
I only downloaded the APK, did not open it. Am I safe?
Downloading alone usually does not install it. Delete the file. If you opened and installed it, follow the steps above at once.
Related scams
Sources
National Cyber Crime Reporting Portal (1930) · Sanchar Saathi: Chakshu, report suspected fraud communication · RBI: limiting customer liability in unauthorised electronic banking transactions