Fake APK Scam on WhatsApp: How to Stay Safe and Report It

Mumbai Police arrested a 36-year-old software developer from Madhya Pradesh on 5 October 2026 for allegedly making 2,805 fake Android apps, called APKs, and selling them to fraud gangs. Police link the apps to 9,673 victims and over Rs 15.75 crore. Victims of financial fraud should call 1930 immediately.

What happened in the Mumbai APK fraud case?

The Mumbai Crime Branch announced the arrest on 5 October, ThePrint reported. The case began with a 72-year-old Mumbai resident who lost Rs 5.62 lakh on 13 August. A caller posing as a senior bank official told the victim to install a file for issuing a card for senior citizens.

The file reached the victim on WhatsApp. It was named “Senior Citizen Card Verification.apk”. The victim installed it and entered personal and debit card details.

Also readApple Rolls Out Security Updates For iOS 18, iPadOS 18 & macOS Sequoia

Police say the accused sold the apps to cybercrime groups across states. They link 1,074 cases on the 1930 helpline to the apps, including 143 in Maharashtra. So far 88 FIRs have been registered across India. The accused has been arrested, and the allegations are yet to be tested in court.

How does a fake APK scam work?

An APK is the installation file for an Android app. Apps from Google Play are checked by Google. A file sent over WhatsApp, SMS or email skips that process, so a scammer can put anything inside it.

Fraud gangs usually pose as a bank, a government office, a utility company or a courier. They send a file with a believable name and ask you to install it to verify an account, update a card or claim a benefit. The Quick Heal mid-year 2026 fraud report lists APK and smishing malware among the top fraud types in India, describing sideloaded apps that capture OTPs and SMS.

Another case reported by The420.in, citing Lucknow Police, involved a woman arrested for allegedly posing as Green Gas staff and pushing victims to install an APK. Police linked it to 34 cases.

Why are senior citizens and office staff targeted?

Scammers pick a story that fits the target. In the Mumbai case, the file was presented as a verification step for a senior citizen card, which sounds routine to someone who is not used to app installs. The caller also posed as a bank official, which added pressure.

Office staff face a related trick. A Cavalier report said the I4C issued an advisory in June 2026 about malware disguised as a “Statement of Account”, MCA or RBI file. It reportedly spreads over WhatsApp, SMS and email, takes over a senior executive’s WhatsApp account and then asks finance staff to transfer money to mule accounts. The advice is to verify any payment request on a second channel, such as a call to a known number.

How big is cyber fraud in India in 2026?

The Indian Express reported, via Anantam IAS, that India recorded more than 12.71 lakh financial cyber fraud complaints between 1 January and 30 June 2026, with reported losses above Rs 10,178.97 crore. Banks placed holds on about Rs 2,968.85 crore of that amount, roughly 29 percent.

How to protect yourself from fake APK scams

• Do not install any APK sent to you. A bank, courier or government office does not need you to install a file from WhatsApp or SMS. Install apps only from Google Play or the app store of your phone maker.
• Keep unknown app installs off. In Android settings, check which apps are allowed to install unknown apps, and turn the permission off. Keep Google Play Protect switched on.
• Hang up on pressure calls. Callers who claim to be bank or police officials and rush you are a warning sign. Call the bank on the number printed on your card or on its official website.
• Never share an OTP, card PIN or CVV with anyone, including someone who says they are from your bank.
• Watch app permissions. An app that asks for SMS access, accessibility access or screen sharing for a simple verification is suspect.
• Tell elderly family members. The Mumbai case started with a senior citizen, and the fake file was built around that group.

What to do if you installed a suspicious APK

1. Call 1930 at once. The National Cyber Crime Reporting Portal says any victim of financial cyber fraud can dial this helpline.
2. Call your bank, block the debit and credit cards, and ask it to stop pending transactions.
3. Uninstall the app, or switch off mobile data and Wi-Fi first if you cannot do it quickly.
4. Change your banking, UPI, email and WhatsApp passwords from a different, clean device.
5. File a complaint at cybercrime.gov.in and keep screenshots, the file name, the number of the caller and transaction details.

Speed matters. The I4C, the cybercrime coordination centre under the Ministry of Home Affairs, has described the first hours after a fraud as the best window to freeze a transfer, according to a Cavalier report on its boss-scam advisory.

Which official portals can you use to report fraud?

The Ministry of Home Affairs runs the National Cyber Crime Reporting Portal at cybercrime.gov.in, which also lists the 1930 helpline for financial cyber fraud. The Department of Telecommunications runs Sanchar Saathi at sancharsaathi.gov.in.

On Sanchar Saathi, the Chakshu service lets you report suspected fraud communication, and another tool shows mobile connections registered in your name. The site also carries awareness pages on UPI fraud, fake loan apps, investment scams and fake traffic challans.

October is Cyber Security Awareness Month. The Data Security Council of India launched a “Be Cyber Street Smart” campaign in Mumbai, with CERT-In, I4C and MeitY among its supporters, The420.in reported. It targets malicious APKs, AI voice cloning, deepfakes and digital arrest scams.

Related reading on TechInformer: how to stay protected from AI-driven Gmail scams, Vodafone Idea’s AI spam SMS filter and WhatsApp’s account bans in India.

Sources: ThePrint; National Cyber Crime Reporting Portal; Sanchar Saathi; The420.in cyber briefing, 6 October 2026.