APK File Scams: Never Install Apps from Unknown Links

You receive a WhatsApp message from what looks like Delhivery, Amazon, or DTDC: "Your parcel is held at our facility. Download our app to reschedule delivery." There is a file attached ending in .apk. You install it. Within hours, your bank account is drained.

APK scams are one of the most dangerous forms of mobile fraud in India because the malicious app works silently — reading your OTPs, monitoring your banking apps, and sending your credentials to scammers in real time. By the time you notice, the money is gone.

What Is an APK File?

An APK (Android Package Kit) is the raw installation file for an Android app — the equivalent of an .exe file on Windows. Google Play Store apps are also APKs, but they go through Google's security checks before reaching your phone.

When you install an APK from outside the Play Store (called "sideloading"), you bypass all of Google's safety checks. The app can ask for any permission it wants — and many users tap "Allow" without reading what they are agreeing to.

The Most Common APK Scam Types in India

1. Fake Courier Tracking Apps

The most widespread APK scam. You receive a WhatsApp message claiming your Delhivery, Blue Dart, DTDC, or Amazon parcel is stuck. The message includes a link or file: "Download our tracking app to reschedule." The app looks real, asks for SMS access to "verify your address," and immediately begins forwarding all your OTPs to the scammer.

2. Fake Video Call or Screen Share Apps

Scammers posing as bank customer care or technical support ask you to install a "remote assistance" app — often a repackaged version of AnyDesk, TeamViewer, or a fake app entirely. Once installed, they can see your screen, including your banking app, UPI PIN entry, and OTPs.

3. Fake Bank or UPI Update Apps

A message arrives claiming your SBI YONO, HDFC, or Google Pay app is outdated and needs an urgent security update. The link goes to a fake website that serves a malicious APK designed to look identical to the real app. When you log in, your credentials are captured.

4. Fake Government Scheme Apps

During subsidy season, scammers circulate APKs claiming to be from PM-KISAN, Ayushman Bharat, or ration card portals. These typically harvest Aadhaar numbers and bank account details entered during "registration."

7 Red Flags That Expose a Fake APK

What the App Does After Installation

Once a malicious APK is installed and granted permissions, it typically:

• Reads every SMS you receive — including bank OTPs — and forwards them to the scammer in real time
• Monitors your screen when banking or UPI apps are open (screen overlay or accessibility service abuse)
• Logs your keystrokes when you type passwords or PINs
• Accesses your contact list and forwards scam messages to your family and friends
• Runs silently in the background — no visible icon, no battery spike on older phones

I Already Installed a Suspicious APK — What Now?

1. 1 Turn on Airplane Mode immediately. This cuts the app's internet connection and stops it from sending your data to the scammer while you act.
2. 2 Uninstall the app. Go to Settings → Apps, find the suspicious app, and uninstall it. If it has Device Administrator access (some malicious apps grant themselves this), go to Settings → Security → Device Admins and revoke it first.
3. 3 Change all banking PINs and passwords from a different device. Use a laptop or a trusted friend's phone. Do not change passwords on the compromised phone until it is clean.
4. 4 Call your bank's fraud helpline immediately. Ask them to freeze your account temporarily until you are sure no unauthorised access has occurred. Most banks can do this within minutes.
5. 5 File a complaint at cybercrime.gov.in or call 1930. Provide the phone number the message came from, the APK filename, and any transaction details if money was moved.
6. 6 Consider a factory reset. If you are not certain the app is fully removed, a factory reset is the safest option. Back up only photos and contacts (not apps) before resetting.