TL;DR: An APK is an Android app file. Scammers send them on WhatsApp disguised as wedding invitations, RTO e-challans, bank KYC updates or government schemes. Installing one can let criminals read your SMS (including OTPs), take over WhatsApp and message your contacts. No government office or bank sends APK files. If you installed one, go offline, uninstall it and call your bank.
What these messages look like
- Wedding invitations. A message like “Shaadi mein zaroor aayein” with an attachment named “Wedding Invitation Card.apk”. Himachal Pradesh police warned about these APK invites, and Rajasthan police issued a wedding-season advisory too, and Outlook Money reported a government employee in Maharashtra’s Hingoli district losing about ₹1.9 lakh after opening one.
- Traffic challans. Files named “RTO Challan.apk” or “mParivahan.apk”. BOOM found these can steal data, hijack WhatsApp and forward themselves to your contacts. We covered the SMS version in fake Parivahan challan texts.
- Bank and scheme updates. “Update KYC”, “claim reward points”, or schemes like the 8th Pay Commission APK.
The Jammu and Kashmir Crime Branch put it plainly: the RTO, traffic police and government departments never send APK files.
What the app does once installed
These apps ask for permissions that sound harmless (“to show your invitation”) and then:
- Read your SMS, including bank OTPs, and forward them to the scammer.
- Take over WhatsApp and send the same file to everyone in your contacts, which is why it often arrives from a friend’s number.
- Use accessibility permissions to see your screen and tap on your behalf.
Combined with your phone number and bank details from a leak, that’s enough to empty an account. In one case we covered, six Indore victims were refunded after Indore Crime Branch traced the money.
How to stay safe
- Never open a file ending in .apk from WhatsApp, SMS or email, even from someone you know. Call them to check.
- Keep “Install unknown apps” switched off for WhatsApp, your browser and file manager (Android settings, Apps, Special app access).
- Install apps only from the Play Store, and keep Google Play Protect on.
- Check challans only on the official Parivahan site.
If you already installed one
- Turn on airplane mode to cut the app off from the internet.
- Uninstall it. If it won’t uninstall, check Settings, Accessibility and Device admin apps, remove its access, then try again. Our Android spyware removal guide helps.
- Call your bank to block cards and UPI, then change banking passwords from a different device.
- Re-secure WhatsApp and turn on two-step verification.
- Report on 1930 or cybercrime.gov.in.
Frequently Asked Questions
What is an APK file?
An APK is an installation file for an Android app. Opening one from WhatsApp or SMS installs an app outside the Play Store.
Is the wedding invitation APK scam real?
Yes. Police in several states, including Himachal Pradesh, have warned about fake wedding invitations sent as APK files on WhatsApp.
Does the RTO send challans as APK files?
No. The J&K Crime Branch and other police advisories say the RTO and traffic police never send APK files. Check challans on the official Parivahan site.
What can a fake APK do to my phone?
It can read your SMS including OTPs, take over WhatsApp, forward itself to your contacts and use accessibility access to control your screen.
What should I do if I installed a fake APK?
Turn on airplane mode, uninstall the app, call your bank to block cards and UPI, change passwords from another device and report on 1930.
Sources
- India TV: Himachal Pradesh police warn of wedding invitation APK scam
- ThePrint: Rajasthan police warns against wedding invite scams
- Outlook Money: Maharashtra govt employee loses Rs 1.9 lakh
- BOOM: Fake RTO e-Challan APK scam
- Greater Kashmir: J&K Crime Branch warns against fake RTO challan APK
- Parivahan (official)
- National Cyber Crime Reporting Portal