APK Scams in India: Wedding Invites, E-Challans and Bill Updates That Take Over Your Phone

An APK is an Android app installation file. If a fraudster can get you to install one, they may not need you to read out a single OTP. The app can do that part for them.

The message rarely looks like a request to install an app. It says your friend is getting married, or you have a traffic fine, or your electricity or gas bill has not been updated. The attachment or link that comes with it is the app.

What the app can do once it is installed

In July 2026, PIB Fact Check warned that fake traffic challan messages sent by SMS and WhatsApp carry malicious links or APK files. Once installed, such an app can read your SMS and OTPs and make bank or UPI transfers. In other words, the codes your bank sends to protect you can be read by the fraudster too.

Four cases from the last few weeks

A wedding invitation in Vadodara

The Times of India reported on 18 September 2026 that a 78-year-old man opened an APK file sent to him as a WhatsApp wedding invitation. About a week later, OTPs and messages about loans and KYC began arriving. On a single day, ₹10.61 lakh was moved out in several transactions. Deleting the file afterwards did not stop it.

An electricity bill in Kolkata

On 23 September 2026, the Times of India reported that a caller posing as CESC told a senior citizen that a ₹560 bill had not been updated. He was sent an APK on WhatsApp, installed it on his own phone and on his daughter's phone, and gave the caller remote access. Both phones froze for about 20 minutes, and more than ₹1.7 lakh left in 10 minutes.

A tractor fine in Chittoor

The Hindu reported on 3 September 2026 that a man in Chittoor, Andhra Pradesh, received an SMS saying "A fine of ₹1,000 has been imposed on your tractor". The link installed a fake "mParivahan" app, and minutes later ₹2,22,054 was charged to his credit card. He called his bank and 1930 immediately. The cyber cell stopped the transactions, and the full amount was returned within two days.

A gas bill in Lucknow

The Times of India reported on 26 September 2026 that a retired state civil-service officer was contacted by someone posing as a Green Gas employee about an "outstanding bill" and a "billing update", and was led to install an APK. ₹13.14 lakh was withdrawn and a ₹10 lakh fixed deposit was cashed, a total of ₹23.14 lakh. He reported it promptly, and police froze and returned ₹5.15 lakh.

What these cases have in common

• A familiar name. A wedding, a transport app, an electricity or gas company. Nothing about the message looks unusual.
• A small, believable reason to act. A ₹560 bill. A ₹1,000 fine. An invitation you would not want to ignore.
• An install step. This is the moment control is handed over. After it, PIB Fact Check warns, the app itself can read OTPs and make transfers.
• Speed. In Kolkata, more than ₹1.7 lakh left in 10 minutes. In Vadodara, the money moved a week after the file was opened, so a quiet week does not mean you are safe.

What police and PIB Fact Check advise

• Wedding invitations come as images or PDFs. Himachal Pradesh Police said in November 2025 that real wedding invites come as JPG or PDF files, never as APKs. They also warned that this kind of malware steals data and forwards itself to your contacts, so the next "invite" may come from someone you know.
• Check challans only on the official portal. PIB Fact Check advises checking traffic challans only on the official Parivahan e-Challan portal, and never through a link in a message.
• Install apps only from official app stores. Both PIB Fact Check and Hyderabad Cybercrime Police have said this. Hyderabad police specifically advised against downloading APKs received on messaging apps or social media.
• Report it. Use 1930 or cybercrime.gov.in.

Simple rules for you and your family

1. If a file ends in .apk, do not open it, whoever sent it. A real invitation, bill or fine does not need you to install anything.
2. Check bills and fines yourself. Open the official app or website on your own, rather than tapping the link in the message.
3. Never give a caller remote access to your phone, whatever reason they give.
4. Talk to older relatives. Several of the people in these cases were senior citizens. A two-minute conversation about "never open .apk files" is worth having.

If you think you have already installed one

Call your bank and 1930 straight away, or file a complaint at cybercrime.gov.in. Do not rely on deleting the file. In Vadodara, deleting it afterwards did not stop the fraud.

The Chittoor and Lucknow cases show why speed matters: one person called immediately and got the full amount back within two days, and the other reported promptly and part of his money was frozen and returned. These are individual outcomes, not a promise of what will happen in every case, but in both, quick reporting helped.

The bottom line: a wedding card, a traffic fine or a bill update should never ask you to install anything. If it does, it is not what it claims to be. If a message makes you unsure, you can paste it into the free Scam Checker, and our guide to common UPI and phone scams covers the other tricks to watch for.