Scam guide · Fake apps
Fake bank app (APK) scam on WhatsApp: how to spot it and what to do
By Aman Gupta, 12+ years in cyber security · Updated 7 October 2026
The short answer
Banks never send their app as an APK file on WhatsApp or SMS. A "KYC update", "reward points" or "electricity bill" APK is almost always a fake app that asks for SMS and accessibility access so it can read your OTPs and act on your phone. Install banking apps only from Google Play, and if you installed an APK from a message, turn off mobile data and Wi-Fi, uninstall it from Settings, and call your bank and 1930.
How the scam works
- A message arrives, often from a stranger or a hacked friend's number: "Your SBI/HDFC/ICICI reward points expire today", "Update PAN/KYC or your account will be blocked", "Pay your electricity bill to avoid disconnection".
- It comes with a file ending in
.apk, named after the bank or a government scheme. - The app looks like the bank's. It asks you to allow "Install unknown apps", then for SMS access, notification access or "Accessibility".
- With those, it reads the OTPs your bank sends and can tap through screens on your behalf. Money leaves while you think you are filling a form.
How to spot a fake banking app
- It came as a file in a chat. That alone is enough. Real banking apps come from Google Play.
- Android asks you to allow installing from WhatsApp, Chrome or File Manager. Google Play never needs that.
- It asks for Accessibility or SMS access right after opening, before you have done anything.
- On Google Play, the real app's developer is the bank itself, with millions of downloads. A copy has a different developer name.
If you installed one
- Turn on airplane mode, or switch off mobile data and Wi-Fi. That stops it sending your OTPs.
- Open Settings → Apps, find the app and uninstall it. If Uninstall is greyed out, first remove it from Settings → Security → Device admin apps.
- Call your bank on the number printed on your card or passbook and ask them to block net banking, UPI and cards for now.
- If any money was taken, call 1930 straight away and file at cybercrime.gov.in.
- From another phone or computer, change your email and banking passwords.
Where SecureOne helps, and where it can't
SecureOne lists every app on your phone that was installed from outside an app store, and its Payment guard checks whether your banking and UPI apps came from a store and which other apps can draw over them. It cannot uninstall anything for you; Android only lets you do that from Settings, and SecureOne shows you where.
Get SecureOne for Android · See every feature and its limits
Quick answers
Do banks send their app on WhatsApp?
No. Indian banks publish their apps on Google Play and their own website. An APK file sent in a chat is not from your bank.
What permissions does a fake bank app ask for?
Usually permission to install unknown apps, then SMS or notification access to read OTPs, and Accessibility so it can tap through screens. A genuine app does not need Accessibility to let you bank.
I installed an APK from WhatsApp. What now?
Switch off data, uninstall it from Settings (remove device admin first if needed), call your bank on the number on your card to block payments, and call 1930 if money was lost.
Lost money to a scam? Call 1930 (National Cyber Crime Helpline) and report at cybercrime.gov.in as soon as you can.